Molecule.dev

← All @molecule/* packages · App templates

@molecule/api-password-bcrypt

Provider bond · password · API (Node) · v1.0.1 · Apache-2.0

Password provider using bcryptjs for molecule.dev

npm install @molecule/api-password-bcrypt

npm · Source on GitHub · Implements @molecule/api-password

How it works

@molecule/api-password-bcrypt is a provider bond on the API (Node) side: it implements the password core interface (@molecule/api-password) with a concrete vendor or library behind it.

Your code calls the core; you wire this provider once at startup. Swapping vendors later is one line in that wiring, not a rewrite.

Works with: @molecule/api-password

Reference

Auto-generated, AI-first package reference for the molecule.dev ecosystem. It is written to be read by coding agents as much as by people, and is generated from this package's source — edit src/index.ts JSDoc, not this file.

Password hashing provider using bcryptjs for molecule.dev.

Type

provider

Installation

npm install @molecule/api-password-bcrypt @molecule/api-password bcryptjs

API

Constants

provider

Password provider backed by the bcryptjs library.

const provider: PasswordProvider

Core Interface

Implements @molecule/api-password interface.

Bond Wiring

Setup function to register this provider with the core interface:

import { setProvider } from '@molecule/api-password'
import { provider } from '@molecule/api-password-bcrypt'

export function setupPasswordBcrypt(): void {
  setProvider(provider)
}

Injection Notes

Requirements

Peer dependencies:

  • @molecule/api-password ^1.0.1

Runtime Dependencies

  • @molecule/api-password
  • bcryptjs

bcrypt semantics a consumer must know (verified against the real bcryptjs):

  • Only the first 72 BYTES of a password are read — passwords sharing the same first 72 bytes compare equal (multi-byte UTF-8 hits the cap sooner). Don't prepend long app-controlled prefixes before hashing.
  • compare() returns false (never throws) for a malformed/non-bcrypt stored hash — an empty or corrupted passwordHash column is indistinguishable from a wrong password by design (no user enumeration). It DOES throw Illegal arguments when passed undefined/null — that means a wiring bug (e.g. an OAuth-only account with no password hash), not a wrong password; guard those rows before calling.
  • The default cost reads SALT_ROUNDS, clamped to 10–16: cost is EXPONENTIAL and bcryptjs accepts absurd values (32 = hours per hash, silently).