s.esmaeiliandClaude Opus 5.5
884413513d
compareLocalHash() returns false for any passwordHash that does not start with `$2`: '' (accounts created without a password) and the new OTP_ONLY_PASSWORD_HASH sentinel the data import writes for ~1,590 OTP-only legacy customers. It is used on both local-compare paths of verifyPassword(), IAM off and IAM fallback. bcryptjs 3 already returns false for these. The guard keeps the result from depending on that: a future version or a native binding that throws would turn a wrong password into a 500 (owner ruling 2026-10-07). Behaviour-neutral for existing data. Real hashes start with $2a$, $2b$ or PHP's $2y$, and every row that fails the prefix already failed in bcrypt. Verified live: wrong password 401, correct password 200. Tests: refusal for both values with IAM off and on, bcrypt never called for them, and legacy $2y$ hashes still verify. 21/21. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
henza_admin
@ 1b67448143
henza_pwa
@ b171ffffb5
henza_server
@ 37c7d7a92f