feat: hash passwords

server/package.json

@@ -15,9 +15,12 @@
     "setup": "docker compose up -d",
     "teardown": "docker compose down",
     "keygen": "ts-node src/scripts/keygen.ts",
+    "hash": "ts-node src/scripts/hash.ts",
+    "verify": "ts-node src/scripts/verify.ts",
     "dev": "npm run setup && npm run node; npm run teardown"
   },
   "dependencies": {
+    "bcrypt": "^6.0.0",
     "cookie-parser": "^1.4.7",
     "cors": "^2.8.6",
     "dotenv": "^17.3.1",
@@ -31,6 +34,7 @@
     "winston": "^3.19.0"
   },
   "devDependencies": {
+    "@types/bcrypt": "^6.0.0",
     "@types/cookie-parser": "^1.4.10",
     "@types/cors": "^2.8.19",
     "@types/express": "^5.0.6",

server/src/routes/auth.ts

@@ -1,3 +1,4 @@
+import { compare } from 'bcrypt';
 import express from 'express';
 import { logger } from '../util/logging';
 import User from '../model/user';
@@ -12,9 +13,7 @@ router.post('/login', async (req, res) => {
     const data : LoginRequest = req.body;
     const user = await User.findOne({where: { userID: data.username}});
     if (!user) return res.status(401).json(new Msg('Invalid credentials'));
-    const isMatch = (data.password == user.password);
-    //TODO hash passwords
-    //const isMatch = await bcrypt.compare(password, user.passwordHash);
+    const isMatch = await compare(data.password, user.password);
     if (!isMatch) return res.status(401).json(new Msg('Invalid credentials'));
 
     // successfully authenticated

server/src/scripts/hash.ts

@@ -0,0 +1,5 @@
+import {hash} from  'bcrypt';
+let pass = process.argv[2];
+hash(pass, 10, function(err, hash) {
+    console.log(hash);
+});

server/src/scripts/verify.ts

@@ -0,0 +1,6 @@
+import {compare} from  'bcrypt';
+let pass = process.argv[2];
+let hash = process.argv[3];
+compare(pass,hash, function(err, result){
+    console.log(result);
+});