aegis-auth/dist/security/password.js

A credentials-based auth solution for Next.js (and other Node projects) with IP rate-limiting, account lockouts, and sessions in DB.

import { scryptAsync } from "@noble/hashes/scrypt";
import { getRandomValues } from "uncrypto";
import { timingSafeEqual } from "./compare";
import { hex } from "./hex";
async function generateKey({ password, salt, config, }) {
    const { costFactor, parallelization, blockSize, derivedKeyLength } = config.accountSecurity.passwordHashing;
    return await scryptAsync(password.normalize("NFKC"), salt, {
        N: costFactor,
        p: parallelization,
        r: blockSize,
        dkLen: derivedKeyLength,
        maxmem: 128 * costFactor * blockSize * 2,
    });
}
export const hashPassword = async ({ password, config, }) => {
    const salt = hex.encode(getRandomValues(new Uint8Array(16)));
    const key = await generateKey({ password, salt, config });
    return `${salt}:${hex.encode(key)}`;
};
export const verifyPassword = async ({ hash, password, config, }) => {
    const [salt, key] = hash.split(":");
    const targetKey = await generateKey({ password, salt, config });
    return timingSafeEqual(targetKey, new Uint8Array(Buffer.from(key, "hex")));
};
//# sourceMappingURL=password.js.map