57 lines
1.8 KiB
TypeScript
57 lines
1.8 KiB
TypeScript
/**
|
||
* 密码哈希与校验（仅用于 Web 用户注册/登录，与后台管理员密码无关）
|
||
* 使用 Node crypto.scrypt，存储格式 saltHex:hashHex，兼容旧明文密码
|
||
*/
|
||
|
||
import { scryptSync, timingSafeEqual, randomFillSync } from 'crypto'
|
||
|
||
const SALT_LEN = 16
|
||
const KEYLEN = 32
|
||
|
||
function bufferToHex(buf: Buffer): string {
|
||
return buf.toString('hex')
|
||
}
|
||
|
||
function hexToBuffer(hex: string): Buffer {
|
||
return Buffer.from(hex, 'hex')
|
||
}
|
||
|
||
/**
|
||
* 对明文密码做哈希，存入数据库
|
||
* 格式: saltHex:hashHex（约 97 字符，适配 VARCHAR(100)）
|
||
* 与 verifyPassword 一致：内部先 trim，保证注册/登录/重置用同一套规则
|
||
*/
|
||
export function hashPassword(plain: string): string {
|
||
const trimmed = String(plain).trim()
|
||
const salt = Buffer.allocUnsafe(SALT_LEN)
|
||
randomFillSync(salt)
|
||
const hash = scryptSync(trimmed, salt, KEYLEN, { N: 16384, r: 8, p: 1 })
|
||
return bufferToHex(salt) + ':' + bufferToHex(hash)
|
||
}
|
||
|
||
/**
|
||
* 校验密码：支持新格式（salt:hash）与旧明文（兼容历史数据）
|
||
* 与 hashPassword 一致：对输入先 trim 再参与校验
|
||
*/
|
||
export function verifyPassword(plain: string, stored: string | null | undefined): boolean {
|
||
const trimmed = String(plain).trim()
|
||
if (stored == null || stored === '') {
|
||
return trimmed === ''
|
||
}
|
||
if (stored.includes(':')) {
|
||
const [saltHex, hashHex] = stored.split(':')
|
||
if (!saltHex || !hashHex || saltHex.length !== SALT_LEN * 2 || hashHex.length !== KEYLEN * 2) {
|
||
return false
|
||
}
|
||
try {
|
||
const salt = hexToBuffer(saltHex)
|
||
const expected = hexToBuffer(hashHex)
|
||
const derived = scryptSync(trimmed, salt, KEYLEN, { N: 16384, r: 8, p: 1 })
|
||
return derived.length === expected.length && timingSafeEqual(derived, expected)
|
||
} catch {
|
||
return false
|
||
}
|
||
}
|
||
return trimmed === stored
|
||
}
|