Fix Security Vulnerability: Hash Notification Management Tokens with Bcrypt

[atul-upadhyay-7]

Description

Fixes #8281

The /api/notify route was hashing notification management tokens using plain SHA-256 without a per-record salt. Because the token space is limited, this allowed an attacker with read access to the database (e.g., via backup leak or unrelated injection flaw) to recover tokens offline via brute-force or rainbow tables, and subsequently silently hijack user notification settings.

This PR:

• Replaces the fast, unsalted crypto.createHash('sha256') implementation with bcryptjs using a work factor of 12.
• Automatically handles unique per-record salting.
• Eliminates the vulnerability to offline dictionary and brute-force attacks against the notifications collection.

Pillar

• 🎨 Pillar 1 — New Theme Design
• 📐 Pillar 2 — Geometric SVG Improvement
• 🕐 Pillar 3 — Timezone Logic Optimization
• 🛠️ Other (Bug fix, refactoring, docs)

Visual Preview

N/A - Security backend change only.

Checklist before requesting a review:

• I have read the CONTRIBUTING.md file.
• I have tested these changes locally (localhost:3000/api/streak?user=YOUR_USERNAME).
• I have run npm run format and npm run lint locally and resolved all errors (CI will fail otherwise).
• My commits follow the Conventional Commits format (e.g., feat(themes): ..., fix(calculate): ...).
• I have updated README.md if I added a new theme or URL parameter.
• I have started the repo.
• I have made sure that i have only one commit to merge in this PR.
• The SVG output matches the CommitPulse "premium quality" aesthetic standard (no raw elements, smooth animations, correct fonts).
• (Recommended) I joined the CommitPulse Discord community for contributor discussions, mentorship, and faster PR support.

[vercel]

@atul-upadhyay-7 is attempting to deploy a commit to the jhasourav07's projects Team on Vercel.

A member of the Team first needs to authorize it.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[retenta-bot]

This pull request addresses a critical security vulnerability by improving how notification management tokens are hashed. By switching from SHA-256 to bcrypt, it effectively mitigates risks associated with offline brute-force attacks. This change aligns with our previous decisions to enhance security, such as preventing raw internal error leakage and ensuring accurate data handling. Thank you for your contribution to improving our application's security!

[github-actions]

🚨 Hey @atul-upadhyay-7, the CI Pipeline is failing on this PR and it has been marked as status:blocked.

Please fix the issues before this can be reviewed. Here's how:

1. Run checks locally before pushing:

npm run format:check   # Check Prettier formatting
npm run lint           # Run ESLint
npm run typecheck      # TypeScript type check
npm run test           # Run unit tests (Vitest)
npm run build          # Verify production build passes

2. Auto-fix common issues:

npm run format         # Auto-fix formatting with Prettier
npm run lint -- --fix  # Auto-fix lint errors where possible

3. Check the full failure log here:
👉 View CI Run

Once you push a fix and the CI passes, the status:blocked label will be removed automatically. 💪

[Aamod007]

This PR is currently blocked because of failing CI checks. By changing the hashing mechanism to \�crypt\ (\lib/notification-management-token.ts), the generated hashes are no longer deterministic (since \�crypt\ automatically generates a random salt) and they do not output a 64-character hex string. This breaks our existing test assertions in \lib/notification-management-token.test.ts.

How to fix:
Please update the test assertions to remove the ^[a-f0-9]{64}$\ regex check, and remove the determinism test (
eturns a deterministic hash for the same input). Also, since bcrypt hashes are non-deterministic, you will need to update the token verification logic (wherever this hash is compared) to use \�crypt.compareSync()\ instead of simple string equality.

I am requesting changes until the CI is green.

Label Justification:

• \level:advanced: 3 files changed (including package dependencies).
• \ ype:security: Upgrades token hashing to bcrypt.
• \mentor:Aamod007: Assigned as required.