fix: Normalize timing for passwordless accounts, strengthen test assertions

Author: mtrezza

spec/ParseUser.spec.js

@@ -88,24 +88,21 @@ describe('Parse.User testing', () => {
     await Parse.User.signUp('existinguser', 'password123');
     compareSpy.calls.reset();
 
-    // Login with non-existent user
-    try {
-      await Parse.User.logIn('nonexistentuser', 'wrongpassword');
-    } catch (e) {
-      expect(e.code).toBe(Parse.Error.OBJECT_NOT_FOUND);
-    }
-    // bcrypt.compare should have been called even for non-existent user
+    // Login with non-existent user — should use dummy hash
+    await expectAsync(
+      Parse.User.logIn('nonexistentuser', 'wrongpassword')
+    ).toBeRejected();
     expect(compareSpy).toHaveBeenCalledTimes(1);
+    expect(compareSpy).toHaveBeenCalledWith('wrongpassword', passwordCrypto.dummyHash);
     compareSpy.calls.reset();
 
-    // Login with existing user but wrong password
-    try {
-      await Parse.User.logIn('existinguser', 'wrongpassword');
-    } catch (e) {
-      expect(e.code).toBe(Parse.Error.OBJECT_NOT_FOUND);
-    }
-    // bcrypt.compare should have been called for existing user
+    // Login with existing user but wrong password — should use real hash
+    await expectAsync(
+      Parse.User.logIn('existinguser', 'wrongpassword')
+    ).toBeRejected();
     expect(compareSpy).toHaveBeenCalledTimes(1);
+    expect(compareSpy.calls.mostRecent().args[0]).toBe('wrongpassword');
+    expect(compareSpy.calls.mostRecent().args[1]).not.toBe(passwordCrypto.dummyHash);
   });
 
   it('logs username taken with configured log level', async () => {

src/Routers/UsersRouter.js

@@ -127,7 +127,9 @@ export class UsersRouter extends ClassesRouter {
             user = results[0];
           }
 
-          return passwordCrypto.compare(password, user.password);
+          const hashedPassword =
+            typeof user.password === 'string' ? user.password : passwordCrypto.dummyHash;
+          return passwordCrypto.compare(password, hashedPassword);
         })
         .then(correct => {
           isValidPassword = correct;