🛡️ Sentinel: [CRITICAL] Fix bcrypt DoS vulnerability with max password length limits

[seonghobae]

🚨 Severity: CRITICAL
💡 Vulnerability: Zod 스키마에서 비밀번호 문자열에 대한 최대 길이 제한이 누락되어, bcrypt를 사용한 패스워드 해싱 시 매우 긴 문자열이 전달될 경우 CPU 고갈로 인한 서비스 거부(DoS) 공격이 발생할 수 있습니다.
🎯 Impact: 악의적인 사용자가 메가바이트 단위의 긴 패스워드를 로그인 또는 비밀번호 재설정 API에 지속적으로 요청함으로써, 서버의 CPU 리소스를 100% 점유하고 정상적인 서비스 처리를 불가능하게 만들 수 있습니다.
🔧 Fix: 비밀번호 입력값을 검증하는 모든 Zod 스키마(LoginRequestSchema, RegisterRequestSchema, ResetPasswordSchema, AdminLoginSchema)에 .max(1024) 제약 조건을 추가하여, 너무 긴 입력값이 해싱 함수로 전달되기 전에 차단하도록 수정했습니다.
✅ Verification: pnpm test 및 pnpm lint를 통해 모든 기능이 정상 작동하며 사이드 이펙트나 리그레션이 없음을 검증했습니다.

• .jules/sentinel.md 에 해당 취약점과 예방 방법에 대한 Journal 기록도 추가되었습니다.

---

PR created automatically by Jules for task 1860804177685348251 started by @seonghobae

Summary by CodeRabbit

• 개선 사항
  • 로그인, 관리자 로그인, 회원가입 및 비밀번호 재설정 시 비밀번호 길이를 최대 1,024자로 제한합니다.
  • 기존 최소 8자 및 비밀번호 확인 일치 검사는 유지됩니다.
  • 지나치게 긴 비밀번호 입력으로 인한 처리 지연과 오류 가능성을 줄였습니다.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 45 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3af732fa-d5f6-4743-b848-d3c3df0cb88a

📥 Commits

Reviewing files that changed from the base of the PR and between 6c6213d and 5784c3b.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (15)

• .claude/skills/persuasion-review/scripts/probe_harness.py
• package.json
• packages/cli/package.json
• packages/cli/src/__tests__/transcript.test.ts
• packages/cli/src/commands/status.ts
• packages/cli/src/lib/inject-agent-hooks.ts
• packages/cli/src/lib/project.ts
• packages/shared/package.json
• packages/web/eslint.config.mjs
• packages/web/package.json
• packages/web/src/components/org/create-org-modal.tsx
• packages/web/src/components/org/create-project-modal.tsx
• packages/web/src/components/org/delete-org-modal.tsx
• packages/web/src/components/org/delete-project-modal.tsx
• packages/web/src/components/org/rename-project-modal.tsx

📝 Walkthrough

Walkthrough

로그인, 회원가입, 관리자 로그인, 비밀번호 재설정의 비밀번호 입력에 최대 1024자 제한을 추가했습니다. bcrypt/bcryptjs 관련 DoS 예방 지침도 문서화했습니다.

Changes

비밀번호 입력 검증

Layer / File(s)	Summary
인증 스키마와 라우트의 길이 제한 packages/shared/src/schemas/auth.ts, packages/web/src/app/api/admin/login/route.ts, packages/web/src/app/api/password-reset/[token]/route.ts, .jules/sentinel.md	비밀번호 필드에 기존 최소 8자 검증을 유지하면서 최대 1024자 검증을 추가했습니다. bcrypt/bcryptjs 입력 길이 제한 지침을 문서화했습니다.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• ContextualWisdomLab/argos#326: 동일한 bcrypt 관련 DoS 위험과 비밀번호 최대 길이 검증을 다룹니다.
• ContextualWisdomLab/argos#332: 인증 및 비밀번호 재설정 흐름의 비밀번호 길이 검증을 변경합니다.
• ContextualWisdomLab/argos#365: 동일한 파일에 비밀번호 최대 길이 1024자를 추가합니다.

Suggested reviewers: greatsumini

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 bcrypt DoS 취약점 해결과 비밀번호 최대 길이 제한이라는 주요 변경을 정확히 설명합니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sentinel/prevent-bcrypt-dos-1860804177685348251

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

packages/shared/src/schemas/auth.ts (1)

5-10: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

1024자 경계값 테스트를 추가하세요.

LoginRequestSchema와 RegisterRequestSchema에 대해 1024자는 통과하고 1025자는 실패하는지 검증하세요. 기존 최소 길이 경계인 7자와 8자도 함께 검증하세요. 이 테스트는 길이 제한이 변경될 때 보안 제어가 후퇴하는 것을 방지합니다.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/shared/src/schemas/auth.ts` around lines 5 - 10, LoginRequestSchema와
RegisterRequestSchema를 대상으로 길이 경계 테스트를 추가하세요. 각 스키마에서 7자는 실패하고 8자는 통과하며, 1024자는
통과하고 1025자는 실패하는지 검증하세요. 테스트는 기존 이메일 유효성 조건을 만족하는 입력을 사용해 비밀번호 길이 제한만 확인하도록
구성하세요.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@packages/shared/src/schemas/auth.ts`:
- Around line 5-10: LoginRequestSchema와 RegisterRequestSchema를 대상으로 길이 경계 테스트를
추가하세요. 각 스키마에서 7자는 실패하고 8자는 통과하며, 1024자는 통과하고 1025자는 실패하는지 검증하세요. 테스트는 기존 이메일
유효성 조건을 만족하는 입력을 사용해 비밀번호 길이 제한만 확인하도록 구성하세요.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 840b3984-d0da-4192-8840-2a0b67548403

📥 Commits

Reviewing files that changed from the base of the PR and between 9ef092b and 6c6213d.

📒 Files selected for processing (4)

• .jules/sentinel.md
• packages/shared/src/schemas/auth.ts
• packages/web/src/app/api/admin/login/route.ts
• packages/web/src/app/api/password-reset/[token]/route.ts

[seonghobae]

Closing as superseded by merged PR #270. The protected developmental branch now enforces a stronger shared password contract than this .max(1024)-only change: it applies the coarse resource bound before expensive work and also rejects values above bcrypt's exact 72 UTF-8-byte compatibility boundary, with shared schemas, Unicode boundary regressions, doctoring, and CHANGELOG evidence. This stale branch should not remain a competing security merge path.

[google-labs-jules]

Closing as superseded by merged PR #270. The protected developmental branch now enforces a stronger shared password contract than this .max(1024)-only change: it applies the coarse resource bound before expensive work and also rejects values above bcrypt's exact 72 UTF-8-byte compatibility boundary, with shared schemas, Unicode boundary regressions, doctoring, and CHANGELOG evidence. This stale branch should not remain a competing security merge path.

Understood. Acknowledging that this work is now obsolete as it has been superseded by PR #270. I will stop work on this task.