fix: mask differences in auth duration (#946)

app/(auth)/auth.ts

@@ -5,6 +5,7 @@ import Credentials from 'next-auth/providers/credentials';
 import { getUser } from '@/lib/db/queries';
 
 import { authConfig } from './auth.config';
+import { DUMMY_PASSWORD } from '@/lib/constants';
 
 interface ExtendedSession extends Session {
   user: User;
@@ -22,11 +23,24 @@ export const {
       credentials: {},
       async authorize({ email, password }: any) {
         const users = await getUser(email);
-        if (users.length === 0) return null;
-        // biome-ignore lint: Forbidden non-null assertion.
-        const passwordsMatch = await compare(password, users[0].password!);
+
+        if (users.length === 0) {
+          await compare(password, DUMMY_PASSWORD);
+          return null;
+        }
+
+        const [user] = users;
+
+        if (!user.password) {
+          await compare(password, DUMMY_PASSWORD);
+          return null;
+        }
+
+        const passwordsMatch = await compare(password, user.password);
+
         if (!passwordsMatch) return null;
-        return users[0] as any;
+
+        return user as any;
       },
     }),
   ],

lib/constants.ts

@@ -1,3 +1,5 @@
+import { generateDummyPassword } from './utils';
+
 export const isProductionEnvironment = process.env.NODE_ENV === 'production';
 
 export const isTestEnvironment = Boolean(
@@ -5,3 +7,5 @@ export const isTestEnvironment = Boolean(
     process.env.PLAYWRIGHT ||
     process.env.CI_PLAYWRIGHT,
 );
+
+export const DUMMY_PASSWORD = generateDummyPassword();

lib/utils.ts

@@ -1,16 +1,15 @@
-import type {
-  CoreAssistantMessage,
-  CoreToolMessage,
-  Message,
-  TextStreamPart,
-  ToolInvocation,
-  ToolSet,
-  UIMessage,
+import {
+  generateId,
+  type CoreAssistantMessage,
+  type CoreToolMessage,
+  type Message,
+  type UIMessage,
 } from 'ai';
 import { type ClassValue, clsx } from 'clsx';
 import { twMerge } from 'tailwind-merge';
 
-import type { DBMessage, Document } from '@/lib/db/schema';
+import type { Document } from '@/lib/db/schema';
+import { genSaltSync, hashSync } from 'bcrypt-ts';
 
 export function cn(...inputs: ClassValue[]) {
   return twMerge(clsx(inputs));
@@ -163,3 +162,12 @@ export function getTrailingMessageId({
 
   return trailingMessage.id;
 }
+
+export function generateDummyPassword() {
+  const password = generateId(12);
+
+  const salt = genSaltSync(10);
+  const hash = hashSync(password, salt);
+
+  return hash;
+}

package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-chatbot",
-  "version": "3.0.3",
+  "version": "3.0.4",
   "private": true,
   "scripts": {
     "dev": "next dev --turbo",