Passwords stored salt and some change is password logic

backend/tests/test_api.py

@@ -52,6 +52,32 @@ def test_login_returns_token():
     assert user_session.json()['is_admin'] is False
 
 
+def test_password_hashes_are_salted_and_legacy_hashes_upgrade_on_login():
+    from hashlib import sha256
+    from backend.app.database import hash_password
+
+    first = hash_password('same-password')
+    second = hash_password('same-password')
+    assert first.startswith('scrypt$16384$8$1$')
+    assert first != second
+
+    legacy_username = f'legacy-{uuid4().hex}'
+    legacy_hash = sha256('legacy-password'.encode('utf-8')).hexdigest()
+    with get_connection() as conn:
+        conn.execute(
+            '''INSERT INTO users
+               (id, username, email, password_hash, is_admin, email_verified)
+               VALUES (?, ?, ?, ?, 0, 1)''',
+            (str(uuid4()), legacy_username, f'{legacy_username}@example.com', legacy_hash),
+        )
+        conn.commit()
+    response = client.post('/api/auth/login', json={'username': legacy_username, 'password': 'legacy-password'})
+    assert response.status_code == 200
+    with get_connection() as conn:
+        upgraded = conn.execute('SELECT password_hash FROM users WHERE username = ?', (legacy_username,)).fetchone()['password_hash']
+    assert upgraded.startswith('scrypt$16384$8$1$')
+
+
 def test_configuration_requires_authentication_and_admin_role():
     assert client.get('/api/user/me').status_code == 401
     assert client.get('/api/admin/plugins').status_code == 401
@@ -515,6 +541,7 @@ def test_public_and_admin_pages_render_html():
     assert client.get('/login').status_code == 200
     login_page = client.get('/login').text
     assert 'Sign in' in login_page
+    assert 'name="otp"' in login_page
     assert 'src="/static/logo.svg"' in login_page
     assert 'id="auth-session" class="auth-session hidden"' in login_page
     assert 'logout.js?v=3' in login_page

backend/tests/test_user_config.py

@@ -44,6 +44,7 @@ def test_user_config_api_and_profile_page():
     assert 'id="auth-profile-link" class="hidden"' in page_response.text
     assert '<a id="auth-username" class="user-name" href="/">' in page_response.text
     assert 'id="auth-avatar"' not in page_response.text
+    assert 'name="new_password_confirmation"' in page_response.text
 
     bob_login = client.post('/api/auth/login', json={
         'username': 'bob',