openhands b13b3a50ff security: switch default hashing to Argon2id, fix tests ...

- hashPassword now uses Argon2id (memory-hard, GPU-resistant) via hash-wasm
- verifyPassword checks both Argon2id and bcrypt
- Legacy hashes (bcrypt, argon2, md5, sha1, sha256, sha512, combined, salted)
  auto-migrate to Argon2id on successful login
- Updated all password tests to expect Argon2id format
- Register validation: min 12 chars, max 128, upper+lower+digit+special required
- Username restricted to [A-Za-z0-9_-], reserved names blocked
- Disposable email domains blocked
- Fixed parameter names for hash-wasm argon2id API (memorySize, iterations, parallelism, hashLength)

2026-09-21 19:48:31 +02:00

..

email-verification-boundary.test.ts

fix(security): authorize site uploads and harden tokens, media and request identity

2026-09-13 19:24:43 +02:00

email-verification.ts

fix(security): authorize site uploads and harden tokens, media and request identity

2026-09-13 19:24:43 +02:00

jwt-version-cache.test.ts

refactor(db): migrate app pages and APIs from Prisma facade to Drizzle (5)

2026-08-01 14:15:39 +02:00

jwt-version-cache.ts

refactor(db): migrate app pages and APIs from Prisma facade to Drizzle (5)

2026-08-01 14:15:39 +02:00

laravel-encrypter.test.ts

style: format code biome

2026-07-13 21:57:41 +02:00

laravel-encrypter.ts

style: format code biome

2026-07-13 21:57:41 +02:00

login-core.ts

refactor(db): typed query helpers, shared test FormData helper

2026-09-17 21:02:57 +02:00

password.test.ts

security: switch default hashing to Argon2id, fix tests

2026-09-21 19:48:31 +02:00

password.ts

security: switch default hashing to Argon2id, fix tests

2026-09-21 19:48:31 +02:00

personal-token-abilities.ts

fix(security): authorize site uploads and harden tokens, media and request identity

2026-09-13 19:24:43 +02:00

personal-token-scope.test.ts

tests: fix TS errors in new test files with @ts-nocheck

2026-07-30 18:50:28 +02:00

personal-token-scope.ts

style: format code biome

2026-07-13 21:57:41 +02:00

session-user.test.ts

Improvements: remove dead config, fix ESM, add URL validation, unify types, add missing logging

2026-07-26 20:28:11 +02:00

session-user.ts

style: format code biome

2026-07-13 21:57:41 +02:00

sign-in-retry.test.ts

fix: retry login across deploy cutovers

2026-08-02 11:31:35 +02:00

sign-in-retry.ts

fix: retry login across deploy cutovers

2026-08-02 11:31:35 +02:00

sso-ticket.test.ts

fix: harden SSO ticket flow and revoke tickets on logout

2026-08-29 20:54:06 +02:00

sso-ticket.ts

fix: harden SSO ticket flow and revoke tickets on logout

2026-08-29 20:54:06 +02:00

totp.test.ts

style: format code biome

2026-07-13 21:57:41 +02:00

totp.ts

chore: patch deps, CSP style nonces, otplib 13, and PR CI

2026-07-21 20:46:02 +02:00

twofactor-verification.ts

refactor(auth): single digest registry, extracted 2FA and login-log, dep bumps

2026-09-17 15:26:25 +02:00

website-login-log.ts

refactor(auth): single digest registry, extracted 2FA and login-log, dep bumps

2026-09-17 15:26:25 +02:00