fix(security): remove salt from database (#5412)

packages/cli/src/commands/recreate-admin.ts

@@ -1,6 +1,6 @@
 import { command, string } from "@drizzle-team/brocli";
 
-import { createSaltAsync, hashPasswordAsync } from "@homarr/auth";
+import { hashPasswordAsync } from "@homarr/auth";
 import { createId } from "@homarr/common";
 import { generateSecureRandomToken } from "@homarr/common/server";
 import { and, count, db, eq } from "@homarr/db";
@@ -67,9 +67,8 @@ export const recreateAdmin = command({
       permission: "admin",
     });
 
-    const salt = await createSaltAsync();
     const password = generateSecureRandomToken(24);
-    const hashedPassword = await hashPasswordAsync(password, salt);
+    const hashedPassword = await hashPasswordAsync(password);
 
     const userId = createId();
     await db.insert(users).values({
@@ -77,7 +76,6 @@ export const recreateAdmin = command({
       name: result.data,
       provider: "credentials",
       password: hashedPassword,
-      salt,
     });
 
     await db.insert(groupMembers).values({

packages/cli/src/commands/reset-password.ts

@@ -22,7 +22,7 @@ export const resetPassword = command({
       where: and(eq(users.name, options.username), eq(users.provider, "credentials")),
     });
 
-    if (!user?.salt) {
+    if (!user?.password) {
       console.error(`User ${options.username} not found`);
       return;
     }
@@ -33,7 +33,7 @@ export const resetPassword = command({
     await db
       .update(users)
       .set({
-        password: await hashPasswordAsync(newPassword, user.salt),
+        password: await hashPasswordAsync(newPassword),
       })
       .where(eq(users.id, user.id));
 

packages/cli/src/commands/users-update-password.ts

@@ -29,7 +29,7 @@ export const usersUpdatePassword = command({
       where: options.id ? eq(users.id, options.id) : eq(users.name, options.username!),
     });
 
-    if (!user?.salt) {
+    if (!user?.password) {
       console.error("User not found or has no credentials record");
       return;
     }
@@ -37,7 +37,7 @@ export const usersUpdatePassword = command({
     await db
       .update(users)
       .set({
-        password: await hashPasswordAsync(options.password, user.salt),
+        password: await hashPasswordAsync(options.password),
       })
       .where(eq(users.id, user.id));