fix: mask differences in auth duration (#946)

This commit is contained in:
Jeremy 2025-04-21 10:26:58 -07:00 committed by GitHub
parent 6e16f3b30a
commit 4ca93aaf89
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 40 additions and 14 deletions

View file

@ -5,6 +5,7 @@ import Credentials from 'next-auth/providers/credentials';
import { getUser } from '@/lib/db/queries';
import { authConfig } from './auth.config';
import { DUMMY_PASSWORD } from '@/lib/constants';
interface ExtendedSession extends Session {
user: User;
@ -22,11 +23,24 @@ export const {
credentials: {},
async authorize({ email, password }: any) {
const users = await getUser(email);
if (users.length === 0) return null;
// biome-ignore lint: Forbidden non-null assertion.
const passwordsMatch = await compare(password, users[0].password!);
if (users.length === 0) {
await compare(password, DUMMY_PASSWORD);
return null;
}
const [user] = users;
if (!user.password) {
await compare(password, DUMMY_PASSWORD);
return null;
}
const passwordsMatch = await compare(password, user.password);
if (!passwordsMatch) return null;
return users[0] as any;
return user as any;
},
}),
],