fix(security): scope cleanup endpoints and harden backup PIN storage

Closes the two GitHub security advisories still open against this repo.
The other four were remediated in #244-#249.

GHSA-2wqx-qppx-4rgf (High) -- cleanup endpoints:
/api/cleanup/legacy-messages and /api/cleanup/empty-conversations
authenticated with getSession(), which reads the cookie without
re-validating the JWT against the auth server, and then operated
platform-wide: legacy-messages selected and deleted up to 1000 matching
messages with no user filter at all, and empty-conversations enumerated
every conversation in the table. Both now use getUser(), resolve the
internal user id, and scope every query to the caller -- matching the
pattern already used by cleanup/legacy-keys.

GHSA-jpfm-vrpc-p6rr (Medium) -- backup PIN:
PINs were hashed with unsalted SHA-256, while users_select_authenticated
lets any logged-in account read every row of `users`, so one throwaway
signup could dump every backup_pin_hash and reverse the 6-12 digit
keyspace with a precomputed table.

Narrowing the RLS policy alone does not fix this -- the app legitimately
reads other users' rows and several callers do select('*'), which a
column-level REVOKE would break. So the credential column moves out of
`users` into user_backup_pins, a table anon and authenticated hold no
privileges on. New PINs are derived with scrypt (N=16384, r=8, p=1) over
a per-user random salt.

The old digests are discarded rather than relocated: nothing verified
them server-side, they only ever backed the hasPin boolean, and being
reversible is the entire problem. Row existence preserves hasPin for the
5 affected users.

The column drop is a separate migration (20260815120100) because it must
not land until this code is deployed. 20260815120000 is additive and is
already applied to prod.

Author: ralyodio

src/app/api/auth/backup-pin/route.js

@@ -2,9 +2,16 @@
 // Handles setting and checking the user's backup PIN hash
 
 import { NextResponse } from 'next/server';
+import { randomBytes, scrypt as scryptCallback } from 'node:crypto';
+import { promisify } from 'node:util';
 import { createClient } from '@supabase/supabase-js';
 import { createServiceRoleClient } from '@/lib/supabase/service-role.js';
 
+// node:crypto is required for scrypt, so pin this route to the Node runtime.
+export const runtime = 'nodejs';
+
+const scrypt = promisify(scryptCallback);
+
 let supabaseServiceRole = null;
 function getServiceRoleClient() {
 	if (!supabaseServiceRole) {
@@ -94,17 +101,53 @@ async function authenticateUser(request) {
 	}
 }
 
+// scrypt work factors. N=16384/r=8/p=1 is the Node default and costs ~16MB and
+// tens of milliseconds per derivation -- enough to make an offline sweep of the
+// 6-12 digit PIN keyspace impractical per user, and the per-user salt means
+// there is no shared work across users.
+const SCRYPT_N = 16384;
+const SCRYPT_R = 8;
+const SCRYPT_P = 1;
+const SCRYPT_KEYLEN = 64;
+const SCRYPT_SALT_BYTES = 16;
+export const PIN_ALGORITHM = `scrypt-n${SCRYPT_N}-r${SCRYPT_R}-p${SCRYPT_P}`;
+
 /**
- * Hash a PIN using SHA-256
+ * Derive a PIN hash using scrypt and a per-user random salt.
+ *
+ * Replaces the previous unsalted `crypto.subtle.digest('SHA-256', pin)`, which
+ * a rainbow table over the numeric PIN keyspace reversed instantly once the
+ * hash column was readable (GHSA-jpfm-vrpc-p6rr).
+ *
  * @param {string} pin
- * @returns {Promise<string>} hex-encoded hash
+ * @param {string} [saltHex] existing salt, hex-encoded; a new one is generated when omitted
+ * @returns {Promise<{hash: string, salt: string, algorithm: string}>}
  */
-async function hashPin(pin) {
-	const encoder = new TextEncoder();
-	const data = encoder.encode(pin);
-	const hashBuffer = await crypto.subtle.digest('SHA-256', data);
-	const hashArray = Array.from(new Uint8Array(hashBuffer));
-	return hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
+async function hashPin(pin, saltHex) {
+	const salt = saltHex ?? randomBytes(SCRYPT_SALT_BYTES).toString('hex');
+	const derived = /** @type {Buffer} */ (
+		await scrypt(pin, salt, SCRYPT_KEYLEN, { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P })
+	);
+	return { hash: derived.toString('hex'), salt, algorithm: PIN_ALGORITHM };
+}
+
+/**
+ * Resolve the internal users.id for a Supabase Auth user.
+ * @param {{id: string}} user
+ * @returns {Promise<{userId?: string, error?: string}>}
+ */
+async function resolveInternalUserId(user) {
+	const { data, error } = await getServiceRoleClient()
+		.from('users')
+		.select('id')
+		.eq('auth_user_id', user.id)
+		.single();
+
+	if (error || !data?.id) {
+		return { error: error?.message ?? 'User record not found' };
+	}
+
+	return { userId: data.id };
 }
 
 /**
@@ -118,18 +161,27 @@ export async function GET(request) {
 			return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
 		}
 
+		const { userId, error: lookupError } = await resolveInternalUserId(user);
+		if (lookupError || !userId) {
+			console.error('Error checking backup PIN:', lookupError);
+			return NextResponse.json({ error: 'Failed to check backup PIN' }, { status: 500 });
+		}
+
+		// PIN material lives in user_backup_pins, which only the service role can
+		// reach. A row's existence is what marks a PIN as set -- rows migrated from
+		// the old unsalted column carry NULL hashes on purpose.
 		const { data, error } = await getServiceRoleClient()
-			.from('users')
-			.select('backup_pin_hash')
-			.eq('auth_user_id', user.id)
-			.single();
+			.from('user_backup_pins')
+			.select('user_id')
+			.eq('user_id', userId)
+			.maybeSingle();
 
 		if (error) {
 			console.error('Error checking backup PIN:', error);
 			return NextResponse.json({ error: 'Failed to check backup PIN' }, { status: 500 });
 		}
 
-		return NextResponse.json({ hasPin: !!data?.backup_pin_hash });
+		return NextResponse.json({ hasPin: !!data });
 	} catch (error) {
 		console.error('Error in GET /api/auth/backup-pin:', error);
 		return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
@@ -164,12 +216,23 @@ export async function POST(request) {
 			return NextResponse.json({ error: 'PIN must contain only digits' }, { status: 400 });
 		}
 
-		const pinHash = await hashPin(pin);
+		const { userId, error: lookupError } = await resolveInternalUserId(user);
+		if (lookupError || !userId) {
+			console.error('Error setting backup PIN:', lookupError);
+			return NextResponse.json({ error: 'Failed to set backup PIN' }, { status: 500 });
+		}
+
+		const { hash, salt, algorithm } = await hashPin(pin);
 
 		const { error } = await getServiceRoleClient()
-			.from('users')
-			.update({ backup_pin_hash: pinHash })
-			.eq('auth_user_id', user.id);
+			.from('user_backup_pins')
+			.upsert({
+				user_id: userId,
+				pin_hash: hash,
+				pin_salt: salt,
+				algorithm,
+				updated_at: new Date().toISOString()
+			}, { onConflict: 'user_id' });
 
 		if (error) {
 			console.error('Error setting backup PIN:', error);

src/app/api/auth/backup-pin/route.test.js

@@ -1,8 +1,11 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 
+import { createHash } from 'node:crypto';
+
 const mocks = vi.hoisted(() => ({
 	authGetUser: vi.fn(),
-	serviceFrom: vi.fn()
+	serviceFrom: vi.fn(),
+	pinUpsert: vi.fn()
 }));
 
 vi.mock('@supabase/supabase-js', () => ({
@@ -33,14 +36,29 @@ function createUsersQuery() {
 		eq: vi.fn(() => query),
 		single: vi.fn(() =>
 			Promise.resolve({
-				data: { backup_pin_hash: 'pin-hash' },
+				data: { id: 'internal-user-id' },
 				error: null
 			})
 		)
 	};
 	return query;
 }
 
+function createBackupPinsQuery() {
+	const query = {
+		select: vi.fn(() => query),
+		eq: vi.fn(() => query),
+		maybeSingle: vi.fn(() =>
+			Promise.resolve({
+				data: { user_id: 'internal-user-id' },
+				error: null
+			})
+		),
+		upsert: mocks.pinUpsert
+	};
+	return query;
+}
+
 describe('backup PIN cookie authentication', () => {
 	beforeEach(() => {
 		vi.resetModules();
@@ -52,8 +70,10 @@ describe('backup PIN cookie authentication', () => {
 			data: { user: { id: 'auth-user-id' } },
 			error: null
 		});
+		mocks.pinUpsert.mockResolvedValue({ error: null });
 		mocks.serviceFrom.mockImplementation((table) => {
 			if (table === 'users') return createUsersQuery();
+			if (table === 'user_backup_pins') return createBackupPinsQuery();
 			throw new Error(`Unexpected table: ${table}`);
 		});
 	});
@@ -119,6 +139,59 @@ describe('backup PIN cookie authentication', () => {
 		expect(mocks.authGetUser).toHaveBeenCalledWith('cookie-token');
 	});
 
+	it('reads the has-pin flag from the service-role-only table, not from users', async () => {
+		const { GET } = await import('./route.js');
+		const response = await GET(
+			new Request('https://qrypt.chat/api/auth/backup-pin', {
+				headers: { authorization: 'Bearer access-token' }
+			})
+		);
+		const body = await response.json();
+
+		expect(response.status).toBe(200);
+		expect(body).toEqual({ hasPin: true });
+		expect(mocks.serviceFrom).toHaveBeenCalledWith('user_backup_pins');
+	});
+
+	it('stores a salted scrypt hash rather than an unsalted SHA-256 digest', async () => {
+		const { POST } = await import('./route.js');
+		const pin = '123456';
+		const response = await POST({
+			headers: new Headers({ authorization: 'Bearer access-token' }),
+			json: vi.fn().mockResolvedValue({ pin })
+		});
+
+		expect(response.status).toBe(200);
+		expect(mocks.pinUpsert).toHaveBeenCalledTimes(1);
+
+		const [record] = mocks.pinUpsert.mock.calls[0];
+		expect(record.user_id).toBe('internal-user-id');
+		expect(record.algorithm).toMatch(/^scrypt-/);
+
+		// A salt is present and actually mixed in: the stored hash must not be the
+		// bare SHA-256 of the PIN, which is what GHSA-jpfm-vrpc-p6rr was about.
+		expect(record.pin_salt).toMatch(/^[0-9a-f]{32}$/);
+		const unsaltedSha256 = createHash('sha256').update(pin).digest('hex');
+		expect(record.pin_hash).not.toBe(unsaltedSha256);
+		expect(record.pin_hash).toMatch(/^[0-9a-f]{128}$/);
+	});
+
+	it('derives a different hash per user for the same PIN', async () => {
+		const { POST } = await import('./route.js');
+		const request = () => ({
+			headers: new Headers({ authorization: 'Bearer access-token' }),
+			json: vi.fn().mockResolvedValue({ pin: '123456' })
+		});
+
+		await POST(request());
+		await POST(request());
+
+		const [first] = mocks.pinUpsert.mock.calls[0];
+		const [second] = mocks.pinUpsert.mock.calls[1];
+		expect(first.pin_salt).not.toBe(second.pin_salt);
+		expect(first.pin_hash).not.toBe(second.pin_hash);
+	});
+
 	it('returns 400 for malformed JSON instead of a generic 500', async () => {
 		const { POST } = await import('./route.js');
 		const response = await POST({