Auth

Bespoke auth: haloAuth.login checks a single-round salted SHA-256 hash and returns a profile with no token. The session is unsigned JSON in localStorage and is trusted verbatim on rehydrate.

What it is and how it feeds the rest

Mechanically

Bespoke auth: haloAuth.login checks a single-round salted SHA-256 hash and returns a profile with no token. The session is unsigned JSON in localStorage and is trusted verbatim on rehydrate.

How it connects

Nominally gates the whole app. In practice gates only the UI — the backend performs no identity check at all.

Components

src/components/auth/

Convex modules

haloAuth.ts

Tables

authUsers
profiles

Findings that touch this domain

critical Zero server-side authentication — ctx.auth appears 0 times in 36 modules; 221 public vs 22 internal functions

convex/*.ts

high Single-round salted SHA-256, no stretching, no rate limiting

convex/haloAuth.ts:4-9,28

high Session is unsigned JSON in localStorage containing role; trusted verbatim

src/context/SupabaseAuthContext.tsx:320-324

high Five employee password hashes and salts committed in cleartext

convex/resetHalo.ts:6-38

Open questions

Research priority for this domain is low. Agent findings splice in below this line and survive regeneration.