fix: mask differences in auth duration (#946)

jeremyphilemon · web-flow · commit 4ca93aaf89c8 · 2025-04-21T10:26:58.000-07:00
diff --git a/app/(auth)/auth.ts b/app/(auth)/auth.ts
@@ -5,6 +5,7 @@ import Credentials from 'next-auth/providers/credentials';
 import { getUser } from '@/lib/db/queries';
 
 import { authConfig } from './auth.config';
+import { DUMMY_PASSWORD } from '@/lib/constants';
 
 interface ExtendedSession extends Session {
   user: User;
@@ -22,11 +23,24 @@ export const {
       credentials: {},
       async authorize({ email, password }: any) {
         const users = await getUser(email);
-        if (users.length === 0) return null;
-        // biome-ignore lint: Forbidden non-null assertion.
-        const passwordsMatch = await compare(password, users[0].password!);
+
+        if (users.length === 0) {
+          await compare(password, DUMMY_PASSWORD);
+          return null;
+        }
+
+        const [user] = users;
+
+        if (!user.password) {
+          await compare(password, DUMMY_PASSWORD);
+          return null;
+        }
+
+        const passwordsMatch = await compare(password, user.password);
+
         if (!passwordsMatch) return null;
-        return users[0] as any;
+
+        return user as any;
       },
     }),
   ],
diff --git a/lib/constants.ts b/lib/constants.ts
@@ -1,7 +1,11 @@
+import { generateDummyPassword } from './utils';
+
 export const isProductionEnvironment = process.env.NODE_ENV === 'production';
 
 export const isTestEnvironment = Boolean(
   process.env.PLAYWRIGHT_TEST_BASE_URL ||
     process.env.PLAYWRIGHT ||
     process.env.CI_PLAYWRIGHT,
 );
+
+export const DUMMY_PASSWORD = generateDummyPassword();
diff --git a/lib/utils.ts b/lib/utils.ts
@@ -1,16 +1,15 @@
-import type {
-  CoreAssistantMessage,
-  CoreToolMessage,
-  Message,
-  TextStreamPart,
-  ToolInvocation,
-  ToolSet,
-  UIMessage,
+import {
+  generateId,
+  type CoreAssistantMessage,
+  type CoreToolMessage,
+  type Message,
+  type UIMessage,
 } from 'ai';
 import { type ClassValue, clsx } from 'clsx';
 import { twMerge } from 'tailwind-merge';
 
-import type { DBMessage, Document } from '@/lib/db/schema';
+import type { Document } from '@/lib/db/schema';
+import { genSaltSync, hashSync } from 'bcrypt-ts';
 
 export function cn(...inputs: ClassValue[]) {
   return twMerge(clsx(inputs));
@@ -163,3 +162,12 @@ export function getTrailingMessageId({
 
   return trailingMessage.id;
 }
+
+export function generateDummyPassword() {
+  const password = generateId(12);
+
+  const salt = genSaltSync(10);
+  const hash = hashSync(password, salt);
+
+  return hash;
+}
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "ai-chatbot",
-  "version": "3.0.3",
+  "version": "3.0.4",
   "private": true,
   "scripts": {
     "dev": "next dev --turbo",

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "ai-chatbot",`
`3`		`- "version": "3.0.3",`
	`3`	`+ "version": "3.0.4",`
`4`	`4`	`"private": true,`
`5`	`5`	`"scripts": {`
`6`	`6`	`"dev": "next dev --turbo",`