Updates hashing method

packages/medusa/src/services/auth.js

@@ -1,4 +1,4 @@
-import bcrypt from "bcrypt"
+import { verifyKdf } from "scrypt"
 import { BaseService } from "medusa-interfaces"
 
 /**
@@ -16,6 +16,17 @@ class AuthService extends BaseService {
     this.customerService_ = customerService
   }
 
+  /**
+   * Verifies if a password is valid given the provided password hash
+   * @param {string} password - the raw password to check
+   * @param {string} hash - the hash to compare against
+   * @return {bool} the result of the comparison
+   */
+  async comparePassword_(password, hash) {
+    const buf = new Buffer(hash, "base64")
+    return verifyKdf(buf, password)
+  }
+
   /**
    * Authenticates a given user with an API token
    * @param {string} token - the api_token of the user to authenticate
@@ -45,7 +56,7 @@ class AuthService extends BaseService {
 
   /**
    * Authenticates a given user based on an email, password combination. Uses
-   * bcrypt to match password with hashed value.
+   * scrypt to match password with hashed value.
    * @param {string} email - the email of the user
    * @param {string} password - the password of the user
    * @return {{ success: (bool), user: (object | undefined) }}
@@ -56,7 +67,10 @@ class AuthService extends BaseService {
   async authenticate(email, password) {
     try {
       const user = await this.userService_.retrieveByEmail(email)
-      const passwordsMatch = await bcrypt.compare(password, user.password_hash)
+      const passwordsMatch = await this.comparePassword_(
+        password,
+        user.password_hash
+      )
       if (passwordsMatch) {
         return {
           success: true,
@@ -78,7 +92,7 @@ class AuthService extends BaseService {
 
   /**
    * Authenticates a customer based on an email, password combination. Uses
-   * bcrypt to match password with hashed value.
+   * scrypt to match password with hashed value.
    * @param {string} email - the email of the user
    * @param {string} password - the password of the user
    * @return {{ success: (bool), user: (object | undefined) }}
@@ -96,7 +110,7 @@ class AuthService extends BaseService {
         }
       }
 
-      const passwordsMatch = await bcrypt.compare(
+      const passwordsMatch = await this.comparePassword_(
         password,
         customer.password_hash
       )

packages/medusa/src/services/customer.js

@@ -1,5 +1,5 @@
 import jwt from "jsonwebtoken"
-import bcrypt from "bcrypt"
+import { kdf } from "scrypt"
 import _ from "lodash"
 import { Validator, MedusaError } from "medusa-core-utils"
 import { BaseService } from "medusa-interfaces"
@@ -160,6 +160,16 @@ class CustomerService extends BaseService {
     return customer
   }
 
+  /**
+   * Hashes a password
+   * @param {string} password - the value to hash
+   * @return hashed password
+   */
+  async hashPassword_(password) {
+    const buf = await kdf(password, { N: 1, r: 1, p: 1 })
+    return buf.toString("base64")
+  }
+
   /**
    * Creates a customer from an email - customers can have accounts associated,
    * e.g. to login and view order history, etc. If a password is provided the
@@ -179,7 +189,7 @@ class CustomerService extends BaseService {
     const existing = await this.retrieveByEmail(email).catch(err => undefined)
 
     if (existing && password && !existing.has_account) {
-      const hashedPassword = await bcrypt.hash(password, 10)
+      const hashedPassword = await this.hashPassword_(password)
       customer.password_hash = hashedPassword
       customer.has_account = true
       delete customer.password
@@ -192,7 +202,7 @@ class CustomerService extends BaseService {
       )
     } else {
       if (password) {
-        const hashedPassword = await bcrypt.hash(password, 10)
+        const hashedPassword = await this.hashPassword_(password)
         customer.password_hash = hashedPassword
         customer.has_account = true
         delete customer.password
@@ -232,7 +242,7 @@ class CustomerService extends BaseService {
     }
 
     if (update.password) {
-      const hashedPassword = await bcrypt.hash(update.password, 10)
+      const hashedPassword = await this.hashPassword_(update.password)
       update.password_hash = hashedPassword
       update.has_account = true
       delete update.password