Enhance upload handling: add db-backed upload rate limiting and lease management, enforce stricter validation for deployment configurations, optimize test suite and retired functionality, and improve input handling and error recovery.

src/routes/auth.js

@@ -18,6 +18,8 @@ const credentialsValidator = (body) => {
     return {value: {username, password, inviteCode}};
 };
 
+const DUMMY_PASSWORD_HASH = "$2b$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy";
+
 export function createAuthRouter({repositories, authRateLimiters, config}) {
     const router = express.Router();
 
@@ -50,9 +52,11 @@ export function createAuthRouter({repositories, authRateLimiters, config}) {
     router.post("/login", ...authRateLimiters, validateBody(credentialsValidator), asyncHandler(async (req, res) => {
         const {username, password} = req.validatedBody;
         const user = repositories.getUser(username);
-        if (!user) return res.status(400).json({error: "User not found"});
-        const valid = await bcrypt.compare(password, user.password);
-        if (!valid) return res.status(403).json({error: "Invalid password"});
+        const valid = await bcrypt.compare(password, user?.password || DUMMY_PASSWORD_HASH);
+        if (!user || !valid) {
+            // Keep the message generic and still perform bcrypt work for unknown users.
+            return res.status(user ? 403 : 400).json({error: "Invalid username or password"});
+        }
         req.session.user = username;
         req.session.sessionVersion = Number(user.session_version || 0);
         return res.json({message: "Login successful"});