lib/models/user.js

@@ -1,14 +1,19 @@
 'use strict'
+
+import Scrypt from 'scrypt-kdf'
+
+import { createRequire } from 'module'
+const require = createRequire(import.meta.url)
+
 // external modules
 const Sequelize = require('sequelize')
-const scrypt = require('scrypt-kdf')
 const filterXSS = require('xss')
 
 // core
 const logger = require('../logger')
 const { generateAvatarURL } = require('../letter-avatars')
 
-module.exports = function (sequelize, DataTypes) {
+function UserModel (sequelize, DataTypes) {
   const User = sequelize.define('User', {
     id: {
       type: DataTypes.UUID,
@@ -46,8 +51,13 @@ module.exports = function (sequelize, DataTypes) {
     }
   })
 
-  User.prototype.verifyPassword = function (attempt) {
-    return scrypt.verify(Buffer.from(this.password, 'hex'), attempt)
+  User.prototype.verifyPassword = async function (attempt) {
+    try {
+      return (await Scrypt.verify(Buffer.from(this.password, 'hex'), attempt))
+    } catch (error) {
+      logger.error(`Error during login: ${error}`)
+      return false
+    }
   }
 
   User.associate = function (models) {
@@ -151,7 +161,7 @@ module.exports = function (sequelize, DataTypes) {
     }
   }
 
-  function updatePasswordHashHook (user, options) {
+  async function updatePasswordHashHook (user, options) {
     // suggested way to hash passwords to be able to do this asynchronously:
     // @see https://github.com/sequelize/sequelize/issues/1821#issuecomment-44265819
 
@@ -159,7 +169,7 @@ module.exports = function (sequelize, DataTypes) {
       return Promise.resolve()
     }
 
-    return scrypt.kdf(user.getDataValue('password'), { logN: 15 }).then(keyBuf => {
+    return Scrypt.kdf(user.getDataValue('password'), { logN: 15 }).then(keyBuf => {
       user.setDataValue('password', keyBuf.toString('hex'))
     })
   }
@@ -169,3 +179,5 @@ module.exports = function (sequelize, DataTypes) {
 
   return User
 }
+
+export default UserModel

package.json

@@ -95,7 +95,7 @@
     "readline-sync": "1.4.10",
     "rimraf": "6.1.3",
     "sanitize-filename": "1.6.4",
-    "scrypt-kdf": "4.0.0",
+    "scrypt-kdf": "3.0.0",
     "sequelize": "5.22.5",
     "socket.io": "4.8.3",
     "sqlite3": "5.1.7",

yarn.lock

@@ -1596,7 +1596,7 @@ __metadata:
     reveal.js: "npm:3.9.2"
     rimraf: "npm:6.1.3"
     sanitize-filename: "npm:1.6.4"
-    scrypt-kdf: "npm:4.0.0"
+    scrypt-kdf: "npm:3.0.0"
     select2: "npm:3.5.2-browserify"
     sequelize: "npm:5.22.5"
     socket.io: "npm:4.8.3"
@@ -14772,10 +14772,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"scrypt-kdf@npm:4.0.0":
-  version: 4.0.0
-  resolution: "scrypt-kdf@npm:4.0.0"
-  checksum: 10/2e88019932fe1d092d02d7c6764817f835b4d6de8b67a24587e9ecfce4686ca2b4d2b8d75224d904b05a784ba87134062b035955f29e0e8e97ffb0284551df36
+"scrypt-kdf@npm:3.0.0":
+  version: 3.0.0
+  resolution: "scrypt-kdf@npm:3.0.0"
+  checksum: 10/8442bb32304fce74a4a6f002931510ed4505ec8bae0c1215c107df22cae809166fcd599250bee7d1d1a757d27fa6958f9b0ed1262bd8e31d2dd4d72636879a74
   languageName: node
   linkType: hard