From 529e011dd210a4897f3c56c40a713b10dde8f086 Mon Sep 17 00:00:00 2001
From: Dominic Ferrando <dominicf2001@gmail.com>
Date: Sat, 18 Jul 2026 01:54:23 -0400
Subject: [PATCH] Improve admin password hash

---
 apps/api/src/server.ts | 4 ++--
 apps/api/src/util.ts   | 3 +++
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/apps/api/src/server.ts b/apps/api/src/server.ts
index 1baa7ca..b22de36 100644
--- a/apps/api/src/server.ts
+++ b/apps/api/src/server.ts
@@ -10,7 +10,7 @@ import {
     Printful,
     Webflow,
 } from "@blade-and-brawn/commerce";
-import { DEFAULT_NAME, env, log } from "./util";
+import { DEFAULT_NAME, env, log, sha256Sum } from "./util";
 import serverTiming from "@elysia/server-timing";
 import jwt from "@elysia/jwt";
 import { CommerceService, WOrderStatusSchema } from "./services/commerce";
@@ -122,7 +122,7 @@ export const app = new Elysia()
 
     // AUTHENTICATION
     .post("/auth/login", async ({ jwt, body, cookie: { auth } }) => {
-        const match = crypto.timingSafeEqual(Buffer.from(body.password, "hex"), Buffer.from(env.ADMIN_PASSWORD, "hex"));
+        const match = crypto.timingSafeEqual(sha256Sum(body.password), Buffer.from(env.ADMIN_PASSWORD, "hex"));
         if (!match) throw status(401, "Invalid credentials");
 
         auth.set({
diff --git a/apps/api/src/util.ts b/apps/api/src/util.ts
index cb43db9..6f0e588 100644
--- a/apps/api/src/util.ts
+++ b/apps/api/src/util.ts
@@ -1,4 +1,5 @@
 import cluster from 'node:cluster';
+import { createHash } from 'node:crypto';
 import { pino } from 'pino';
 
 export const log = pino({
@@ -46,3 +47,5 @@ function optionEnv(key: string, fallback: string = ""): string {
     };
     return val;
 }
+
+export const sha256Sum = (s: string) => createHash("sha256").update(s).digest();