From bd9b0c38711f93406320a89cd937d1ae9b498c99 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=B7=AB=E5=87=A4=E8=90=8D?=
 <wufp@wufengpingdeMacBook-Air.local>
Date: Fri, 7 Aug 2026 11:20:31 +0800
Subject: [PATCH] Fix password hashing for Workers runtime

---
 lib/user-auth.ts             | 3 ++-
 tests/rendered-html.test.mjs | 1 +
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/user-auth.ts b/lib/user-auth.ts
index 962c8a1..57d22ab 100644
--- a/lib/user-auth.ts
+++ b/lib/user-auth.ts
@@ -15,7 +15,8 @@ export type RequestPrincipal =
 
 const SESSION_COOKIE = "koc_session";
 const SESSION_MAX_AGE_SECONDS = 60 * 60 * 24 * 7;
-const PASSWORD_ITERATIONS = 120_000;
+// Cloudflare Workers caps PBKDF2 at 100,000 iterations.
+const PASSWORD_ITERATIONS = 100_000;
 
 function bytesToHex(bytes: Uint8Array) {
   return [...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("");
diff --git a/tests/rendered-html.test.mjs b/tests/rendered-html.test.mjs
index 62b40bd..2f57add 100644
--- a/tests/rendered-html.test.mjs
+++ b/tests/rendered-html.test.mjs
@@ -288,6 +288,7 @@ test("provides simple username-password login and three server-enforced roles",
   assert.match(logoutRoute, /deleteSession/);
   assert.match(logoutRoute, /clearSessionCookie/);
   assert.match(auth, /PBKDF2/);
+  assert.match(auth, /PASSWORD_ITERATIONS = 100_000/);
   assert.match(auth, /HttpOnly/);
   assert.match(auth, /SameSite=Lax/);
   assert.match(auth, /SELECT id FROM users WHERE role = 'super_admin' LIMIT 1/);