fix(plugin-auth): WebContainer scrypt compatibility with @noble/hashes

Author: os-zhuang

.changeset/plugin-auth-webcontainer-scrypt.md

@@ -4,21 +4,24 @@
 
 WebContainer (StackBlitz) signup compatibility: `AuthManager` now auto-detects
 WebContainer runtimes at construction time and swaps better-auth's default
-`node:crypto.scrypt`-based password hasher for the pure-JS hasher from
-`@better-auth/utils/password` (which uses `@noble/hashes/scrypt` under the
-hood).
+`node:crypto.scrypt`-based password hasher for a pure-JS scrypt hasher built
+directly on `@noble/hashes`.
 
 **Why:** WebContainer's `node:crypto` polyfill ships an incomplete `scrypt`
 implementation that throws `TypeError: y.run is not a function` on every
-signup, blocking template demos on StackBlitz. The pure-JS implementation is
-byte-compatible with the Node hasher (same scrypt params, same `salt:keyHex`
-storage format), so accounts created under either hasher remain mutually
-verifiable — no migration, no template changes.
+signup, blocking template demos on StackBlitz. We can't simply dynamic-import
+`@better-auth/utils/password` because its `exports` map gates the pure-JS
+build behind a non-`"node"` condition — Node-the-runtime (which WebContainer
+reports itself as) always resolves to the `password.node.mjs` build. So we
+reimplement the same scrypt hash directly with byte-identical params
+(N=16384, r=16, p=1, dkLen=64) and the same `{saltHex}:{keyHex}` storage
+format. Hashes produced by either implementation verify against the other —
+no migration, no template changes.
 
 **Scope:** detection short-circuits to `undefined` on real Node, so production
-deployments are completely unaffected — the JS fallback module is only
-dynamically imported when one of `process.versions.webcontainer`,
-`SHELL` containing `jsh`, or `STACKBLITZ` env is present.
+deployments are completely unaffected — `@noble/hashes` is only dynamically
+imported when one of `process.versions.webcontainer`, `SHELL` containing
+`jsh`, or `STACKBLITZ` env is present.
 
 Templates (`@template/todo`, `@template/contracts`, …) require no changes;
 the fix lives entirely inside `@objectstack/plugin-auth`.

packages/plugins/plugin-auth/package.json

@@ -19,7 +19,7 @@
   },
   "dependencies": {
     "@better-auth/oauth-provider": "^1.6.11",
-    "@better-auth/utils": "^0.4.0",
+    "@noble/hashes": "^2.0.1",
     "@objectstack/core": "workspace:*",
     "@objectstack/platform-objects": "workspace:*",
     "@objectstack/spec": "workspace:*",

packages/plugins/plugin-auth/src/auth-manager.ts

@@ -367,13 +367,19 @@ export class AuthManager {
    *
    * better-auth defaults to `@better-auth/utils/password.node`, which calls
    * `node:crypto.scrypt`. WebContainer polyfills that API incompletely and
-   * signup throws `TypeError: y.run is not a function`. The pure-JS variant
-   * at `@better-auth/utils/password` uses `@noble/hashes/scrypt` with
-   * identical params (N=16384, r=16, p=1, dkLen=64) and emits the same
-   * `{salt}:{keyHex}` format, so existing hashes remain verifiable.
+   * signup throws `TypeError: y.run is not a function`.
+   *
+   * We can't dynamic-import `@better-auth/utils/password` because that
+   * package's `exports` map gates the pure-JS build behind a non-`"node"`
+   * condition — Node-the-runtime (which WebContainer reports itself as)
+   * always resolves to `password.node.mjs`. So we reimplement the same hash
+   * here using `@noble/hashes/scrypt` directly, with byte-identical params
+   * (N=16384, r=16, p=1, dkLen=64) and the same `{saltHex}:{keyHex}` storage
+   * format. Hashes produced by either implementation verify against the
+   * other — no migration needed.
    *
    * Returns `undefined` outside WebContainer so production deployments keep
-   * the native (fast) hasher and never load the JS fallback.
+   * the native (fast) hasher and never load `@noble/hashes`.
    */
   private async resolvePasswordHasher(): Promise<
     { hash: (password: string) => Promise<string>; verify: (args: { hash: string; password: string }) => Promise<boolean> } | undefined
@@ -385,14 +391,32 @@ export class AuthManager {
         Boolean((globalThis as any).process?.env?.STACKBLITZ));
     if (!isWebContainer) return undefined;
     try {
-      const mod = await import('@better-auth/utils/password');
+      const { scryptAsync } = await import('@noble/hashes/scrypt.js');
+      const PARAMS = { N: 16384, r: 16, p: 1, dkLen: 64, maxmem: 128 * 16384 * 16 * 2 } as const;
+      const toHex = (b: Uint8Array): string => {
+        let s = '';
+        for (let i = 0; i < b.length; i++) s += b[i]!.toString(16).padStart(2, '0');
+        return s;
+      };
+      const generateKey = (password: string, saltHex: string): Promise<Uint8Array> =>
+        scryptAsync(password.normalize('NFKC'), saltHex, PARAMS);
       return {
-        hash: (password: string) => mod.hashPassword(password),
-        verify: ({ hash, password }) => mod.verifyPassword(hash, password),
+        hash: async (password: string) => {
+          const saltBytes = (globalThis as any).crypto.getRandomValues(new Uint8Array(16));
+          const saltHex = toHex(saltBytes);
+          const key = await generateKey(password, saltHex);
+          return `${saltHex}:${toHex(key)}`;
+        },
+        verify: async ({ hash, password }) => {
+          const [saltHex, keyHex] = hash.split(':');
+          if (!saltHex || !keyHex) throw new Error('Invalid password hash');
+          const target = await generateKey(password, saltHex);
+          return toHex(target) === keyHex;
+        },
       };
     } catch (err: any) {
       console.warn(
-        `[AuthManager] WebContainer detected but pure-JS password hasher unavailable: ${err?.message ?? err}. Falling back to default.`,
+        `[AuthManager] WebContainer detected but pure-JS scrypt unavailable: ${err?.message ?? err}. Falling back to default.`,
       );
       return undefined;
     }