Lower bcrypt cost in API tests

services/api/.env

@@ -15,6 +15,9 @@ ADMIN_PASSWORD=development.now
 # JWT Secret to sign and encrypt tokens
 JWT_SECRET=m6bv7!m|E:7:*X3Mx7I)2+Y>B70+&K
 
+# bcrypt cost factor for password hashes
+BCRYPT_SALT_PASSES=12
+
 # App details for emails
 APP_NAME=Bedrock
 APP_URL=http://localhost:2200

services/api/src/utils/auth/password.js

@@ -1,10 +1,13 @@
 import bcrypt from 'bcryptjs';
+import config from '@bedrockio/config';
 
 import { clearAuthenticators, addAuthenticator, assertAuthenticator } from './authenticators.js';
 
 // 5 minutes
 const MFA_THRESHOLD = 5 * 60 * 1000;
 
+const BCRYPT_SALT_PASSES = config.get('BCRYPT_SALT_PASSES', 'number');
+
 async function verifyPassword(user, password) {
   const authenticator = assertAuthenticator(user, 'password');
 
@@ -34,7 +37,7 @@ function verifyRecentPassword(user) {
 }
 
 async function setPassword(user, password) {
-  const salt = await bcrypt.genSalt(12);
+  const salt = await bcrypt.genSalt(BCRYPT_SALT_PASSES);
   const hash = await bcrypt.hash(password, salt);
 
   clearAuthenticators(user, 'password');

services/api/vitest.config.js

@@ -2,6 +2,9 @@ import { defineConfig } from 'vitest/config';
 
 process.env.ENV_NAME = 'test';
 process.env.LOG_LEVEL ||= 'warn';
+// Hashing at the production cost of 12 takes ~200ms per password, which dominates
+// the auth tests. 4 is the minimum bcrypt accepts.
+process.env.BCRYPT_SALT_PASSES ||= '4';
 
 export default defineConfig({
   test: {