fix(auth): bound scrypt params, cap concurrency, evict rate-limit keys, re-bootstrap admin

src/lib/server/auth/password.ts

@@ -5,10 +5,38 @@ const R = 8;
 const P = 1;
 const KEYLEN = 32;
 
+// Upper bounds on scrypt params accepted from a stored hash. A crafted users.json must not
+// be able to turn verification into an unbounded CPU sink.
+const MAX_N = 65536;
+const MAX_R = 16;
+const MAX_P = 4;
+
+// Cap concurrent scrypt calls so a burst of logins can't exhaust CPU/memory; extra callers queue.
+const MAX_CONCURRENT_SCRYPT = 4;
+let activeScryptCalls = 0;
+const scryptWaitQueue: Array<() => void> = [];
+
+async function withScryptSlot<T>(fn: () => Promise<T>): Promise<T> {
+	if (activeScryptCalls >= MAX_CONCURRENT_SCRYPT) {
+		await new Promise<void>((resolve) => scryptWaitQueue.push(resolve));
+	}
+	activeScryptCalls++;
+	try {
+		return await fn();
+	} finally {
+		activeScryptCalls--;
+		const next = scryptWaitQueue.shift();
+		if (next) next();
+	}
+}
+
 function scryptAsync(password: string, salt: Buffer, n: number, r: number, p: number): Promise<Buffer> {
-	return new Promise((resolve, reject) => {
-		scrypt(password, salt, KEYLEN, { N: n, r, p, maxmem: 128 * 1024 * 1024 }, (err, key) => (err ? reject(err) : resolve(key)));
-	});
+	return withScryptSlot(
+		() =>
+			new Promise((resolve, reject) => {
+				scrypt(password, salt, KEYLEN, { N: n, r, p, maxmem: 128 * 1024 * 1024 }, (err, key) => (err ? reject(err) : resolve(key)));
+			})
+	);
 }
 
 export const MIN_PASSWORD_LENGTH = 8;
@@ -26,6 +54,7 @@ export async function verifyPassword(password: string, stored: string): Promise<
 	const r = Number(parts[2]);
 	const p = Number(parts[3]);
 	if (![n, r, p].every((x) => Number.isInteger(x) && x > 0)) return false;
+	if (n > MAX_N || r > MAX_R || p > MAX_P) return false;
 	try {
 		const salt = Buffer.from(parts[4], 'base64');
 		const expected = Buffer.from(parts[5], 'base64');

src/lib/server/auth/rate-limit.ts

@@ -1,3 +1,6 @@
+/** Above this many tracked keys, prune stale entries on the next `allow` before inserting. */
+const MAX_TRACKED_KEYS = 10_000;
+
 /** Sliding-window limiter: at most `max` allowed calls per key within `windowMs`. In-memory only. */
 export class RateLimiter {
 	private hits = new Map<string, number[]>();
@@ -8,13 +11,25 @@ export class RateLimiter {
 		private readonly now: () => number = Date.now
 	) {}
 
+	/** Number of keys currently tracked. Exposed for tests. */
+	get size(): number {
+		return this.hits.size;
+	}
+
 	allow(key: string): boolean {
 		const t = this.now();
 		const recent = (this.hits.get(key) ?? []).filter((h) => t - h < this.windowMs);
 		if (recent.length >= this.max) {
-			this.hits.set(key, recent);
+			if (recent.length === 0) this.hits.delete(key);
+			else this.hits.set(key, recent);
 			return false;
 		}
+		if (this.hits.size > MAX_TRACKED_KEYS) {
+			for (const [k, hs] of this.hits) {
+				const mostRecent = hs.length > 0 ? Math.max(...hs) : -Infinity;
+				if (t - mostRecent >= this.windowMs) this.hits.delete(k);
+			}
+		}
 		recent.push(t);
 		this.hits.set(key, recent);
 		return true;

src/lib/server/auth/session.ts

@@ -20,6 +20,11 @@ export function createSessionToken(payload: Omit<SessionPayload, 'exp'>, secret:
 	return `${data}.${sign(data, secret)}`;
 }
 
+/**
+ * Verifies only the token's signature and expiry. This does NOT prove the session is still
+ * valid: callers MUST also check that `payload.uid` refers to a user that still exists, is
+ * active, and that `user.sessionVersion === payload.sv` (the hooks do this).
+ */
 export function verifySessionToken(token: string, secret: string, now = new Date()): SessionPayload | null {
 	const dot = token.lastIndexOf('.');
 	if (dot <= 0) return null;

src/lib/server/users/repository.ts

@@ -43,10 +43,11 @@ export class UsersRepo {
 		const clock = opts.clock ?? (() => new Date());
 		const newId = opts.newId ?? ulid;
 		const bytes = await store.get(USERS_PATH);
-		if (bytes) {
-			const file = UsersFileSchema.parse(JSON.parse(decodeText(bytes)));
-			return new UsersRepo(store, file.users, clock, newId);
+		const existing = bytes ? UsersFileSchema.parse(JSON.parse(decodeText(bytes))).users : [];
+		if (bytes && existing.some((u) => u.role === 'admin')) {
+			return new UsersRepo(store, existing, clock, newId);
 		}
+		// users.json is missing, or present but has no admin: bootstrap/re-bootstrap one.
 		const now = clock().toISOString();
 		const admin: User = {
 			id: 'u_admin',
@@ -60,8 +61,8 @@ export class UsersRepo {
 			createdAt: now,
 			updatedAt: now
 		};
-		const repo = new UsersRepo(store, [], clock, newId);
-		await repo.persist([admin]);
+		const repo = new UsersRepo(store, existing, clock, newId);
+		await repo.persist([...existing, admin]);
 		return repo;
 	}
 
@@ -83,7 +84,9 @@ export class UsersRepo {
 	}
 	/** All non-admin users, sorted by display name. */
 	members(): User[] {
-		return this.users.filter((u) => u.role === 'member').sort((a, b) => a.displayName.localeCompare(b.displayName));
+		return this.users
+			.filter((u) => u.role === 'member')
+			.sort((a, b) => a.displayName.localeCompare(b.displayName) || a.id.localeCompare(b.id));
 	}
 	isActiveMember(id: string): boolean {
 		const u = this.byId(id);

tests/unit/auth/auth.test.ts

@@ -18,6 +18,20 @@ describe('password', () => {
 	it('rejects malformed hashes without throwing', async () => {
 		expect(await verifyPassword('x', 'garbage')).toBe(false);
 	});
+
+	it('rejects stored hashes with out-of-bound scrypt params', async () => {
+		const placeholder = ['AAAAAAAAAAAAAAAAAAAAAA==', 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA='];
+		const bigP = ['scrypt', 32768, 8, 64, ...placeholder].join('$');
+		expect(await verifyPassword('whatever', bigP)).toBe(false);
+		const bigN = ['scrypt', 131072, 8, 1, ...placeholder].join('$');
+		expect(await verifyPassword('whatever', bigN)).toBe(false);
+	});
+
+	it('resolves 10 concurrent hashPassword calls (semaphore sanity)', async () => {
+		const results = await Promise.all(Array.from({ length: 10 }, (_, i) => hashPassword(`pw-${i}`)));
+		expect(results).toHaveLength(10);
+		for (const hash of results) expect(hash.startsWith('scrypt$')).toBe(true);
+	});
 });
 
 describe('session token', () => {
@@ -51,4 +65,14 @@ describe('RateLimiter', () => {
 		now = 60_001;
 		expect(rl.allow('bob')).toBe(true);
 	});
+
+	it('evicts stale keys once the tracked-key cap is exceeded', () => {
+		let now = 0;
+		const rl = new RateLimiter(5, 1_000, () => now);
+		for (let i = 0; i < 10_001; i++) rl.allow(`key-${i}`);
+		expect(rl.size).toBe(10_001);
+		now = 2_000; // window has fully passed for every key inserted above
+		expect(rl.allow('new-key')).toBe(true);
+		expect(rl.size).toBe(1);
+	});
 });

tests/unit/users/repository.test.ts

@@ -4,6 +4,7 @@ import { join } from 'node:path';
 import { afterEach, beforeEach, describe, expect, it } from 'vitest';
 import { verifyPassword } from '../../../src/lib/server/auth/password';
 import { LocalFsStore } from '../../../src/lib/server/storage/local-fs-store';
+import { decodeText, encodeText } from '../../../src/lib/server/storage/store';
 import { UsersRepo, UserValidationError } from '../../../src/lib/server/users/repository';
 
 describe('UsersRepo', () => {
@@ -79,6 +80,37 @@ describe('UsersRepo', () => {
 		await expect(repo.rename(bob.id, '')).rejects.toBeInstanceOf(UserValidationError);
 	});
 
+	it('re-bootstraps a missing admin into an existing users.json, but leaves one with an admin untouched', async () => {
+		const member = {
+			id: 'u_bob',
+			username: 'bob',
+			displayName: 'Bob',
+			passwordHash: 'not-a-real-hash',
+			role: 'member' as const,
+			active: true,
+			mustChangePassword: false,
+			sessionVersion: 1,
+			createdAt: '2026-01-01T00:00:00.000Z',
+			updatedAt: '2026-01-01T00:00:00.000Z'
+		};
+		await store.put('users.json', encodeText(JSON.stringify({ version: 1, users: [member] })), 'application/json');
+
+		const repo = await UsersRepo.load(store, { clock });
+		expect(repo.all()).toHaveLength(2);
+		expect(repo.byUsername('admin')?.role).toBe('admin');
+		expect(repo.byUsername('bob')).toBeDefined();
+		const persisted = JSON.parse(decodeText((await store.get('users.json'))!));
+		expect(persisted.users).toHaveLength(2);
+
+		// a file that already has an admin is left untouched (no extra admin, no rewrite of members).
+		const withAdmin = repo.all();
+		const untouchedStore = new LocalFsStore(await mkdtemp(join(tmpdir(), 'splitwise-users-')));
+		await untouchedStore.put('users.json', encodeText(JSON.stringify({ version: 1, users: withAdmin })), 'application/json');
+		const reloaded = await UsersRepo.load(untouchedStore, { clock });
+		expect(reloaded.all()).toHaveLength(2);
+		expect(reloaded.all().filter((u) => u.role === 'admin')).toHaveLength(1);
+	});
+
 	it('leaves memory untouched when the store write fails', async () => {
 		const repo = await UsersRepo.load(store, { clock });
 		store.put = async () => {