retrotoon-studio/server/_core/localAuth.ts

import { randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
import * as db from "../db";

const LOCAL_OPEN_ID_PREFIX = "local:";

export function normalizeEmail(email: string) {
  return email.trim().toLowerCase();
}

export function hashPassword(password: string, salt = randomBytes(16).toString("hex")) {
  const derivedKey = scryptSync(password, salt, 64).toString("hex");
  return `${salt}:${derivedKey}`;
}

export function verifyPassword(password: string, storedHash: string) {
  const [salt, expectedHash] = storedHash.split(":");
  if (!salt || !expectedHash) return false;

  const actualHash = scryptSync(password, salt, 64).toString("hex");
  return timingSafeEqual(Buffer.from(actualHash, "hex"), Buffer.from(expectedHash, "hex"));
}

export function buildLocalOpenId(email: string) {
  return `${LOCAL_OPEN_ID_PREFIX}${normalizeEmail(email)}`;
}

export async function ensureBootstrapLocalAdmin(email: string, password: string) {
  const configuredEmail = normalizeEmail(process.env.LOCAL_ADMIN_EMAIL ?? "");
  const configuredPassword = process.env.LOCAL_ADMIN_PASSWORD ?? "";
  const normalizedEmail = normalizeEmail(email);

  if (!configuredEmail || !configuredPassword) return;
  if (normalizedEmail !== configuredEmail) return;
  if (password !== configuredPassword) return;

  const existingUser = await db.getUserByEmail(configuredEmail);
  if (existingUser?.passwordHash && verifyPassword(configuredPassword, existingUser.passwordHash)) {
    return;
  }

  const passwordHash = hashPassword(configuredPassword);
  await db.upsertUser({
    openId: existingUser?.openId ?? buildLocalOpenId(configuredEmail),
    email: configuredEmail,
    name: existingUser?.name ?? "RetroToon Admin",
    passwordHash,
    loginMethod: "local",
    role: "admin",
    lastSignedIn: new Date(),
  });
}