3 Commits

Include renames

Author	SHA1	Message	Date
openhands	8638e81444	refactor(db): typed query helpers, shared test FormData helper ... Replace raw db.execute tuple casts with queryRows/rowsFrom/execResult/ affectedRows helpers from lib/db, drop redundant mysql2 casts on typed query builders, and centralize per-test fakeForm into test/fake-form. Update db mocks in tests so helpers resolve against mocked execute.	2026-09-17 21:02:57 +02:00
openhands	e153300da0	feat(auth): auto-upgrade every legacy password format to bcrypt on login ... checkLogin now verifies and migrates all known password formats without configuration: bcrypt, argon2id/argon2i/argon2d, unsalted md5/sha1/sha256/ sha512, double-md5 (UberCMS/Butterfly), salted md5 with embedded salt (hash:salt, salt:hash, hash$salt), and a guarded plaintext fallback. Every successful legacy login rewrites the stored hash to bcrypt, so the CONVERT_PASSWORDS flag is no longer required (kept for deploy compatibility).	2026-09-17 14:56:31 +02:00
openhands	89c1751e79	refactor: extract shared login credential verification into auth/login-core ... The username normalization, dummy-hash constant, password check and email-verification gate were duplicated between precheckLogin and the NextAuth credentials authorize handler. Move them into a single login-core module so both paths share one source of truth and stay consistent.	2026-08-27 15:17:54 +02:00