supabase / auth / 11048263084

69%

push

github

feat: add support for migration of firebase scrypt passwords (#1768)

## What kind of change does this PR introduce?

Fix #1750. Firebase uses a [modified version of
scrypt](https://github.com/firebase/scrypt) We add support for Firebase
Scrypt hashes so that developers can move over from Firebase (or
similar) without the obligation to force a password reset for all users.

As there is no pre-defined convention for Firebase scrypt hashes, we
establish the following:

```
$fbscrypt$v=1,n=<N>,r=<r>,p=<p>[,ss=<salt_separator>][,sk=<signer_key>]$<salt>$<hash>
```

```
$fbscrypt: Firebase scrypt Identifier
$v: version identifier. Intended to allow for flexibility in parameters used.
$n: N is the CPU/memory cost parameter.
$r: block size
$p: parallelization
$ss: salt seperator, optional, only if using firebase,  base64-encoded string used to separate the salt from other parameters.
$sk: signer key, a base64-encoded string used as an additional input to the hash function.
$<salt>: base64 encoded salt
$<hash>: base64 encoded output
````

Developers can extract their [hash parameters from the firebase
console](https://firebaseopensource.com/projects/firebase/scrypt/)

For testing and debugging, clone this
[utility](https://github.com/firebase/scrypt/#finding-the-password-hash-parameters)
and follow the instructions in `BUILDING`.

On MacOS please add the following flags when attempting to build so as
to guard against error: `AES_FUNCTION` missing

```
export CFLAGS="-I$(brew --prefix openssl)/include"
export LDFLAGS="-L$(brew --prefix openssl)/lib -L/usr/local/opt/openssl/lib"
```

[More details about export from
CLI](https://firebase.google.com/docs/cli/auth)

91 of 121 new or added lines in 2 files covered. (75.21%)

9332 of 16113 relevant lines covered (57.92%)

55.94 hits per line