fix: 3 regressions from previous session - dropper expansion, pool backup initial connect, bcrypt auth cache

server/internal/api/router.go

@@ -2,6 +2,7 @@ package api
 
 import (
 	"crypto/rand"
+	"crypto/sha256"
 	"crypto/subtle"
 	"encoding/hex"
 	"encoding/json"
@@ -12,6 +13,7 @@ import (
 	"path/filepath"
 	"strings"
 	"sync"
+	"time"
 
 	"crypto-miner-server/internal/builder"
 	"crypto-miner-server/internal/db"
@@ -22,6 +24,45 @@ import (
 	"golang.org/x/crypto/bcrypt"
 )
 
+// authSessionCache avoids running bcrypt on every API request.
+// Key: SHA-256(user+":"+password) hex — value: expiry time.
+// Entries are valid for authCacheTTL after the last successful login.
+// Bcrypt only runs on cache miss or expiry.
+var (
+	authSessionCache   = map[string]time.Time{}
+	authSessionCacheMu sync.Mutex
+	authCacheTTL       = 5 * time.Minute
+)
+
+func authCacheKey(user, pass string) string {
+	h := sha256.Sum256([]byte(user + ":" + pass))
+	return hex.EncodeToString(h[:])
+}
+
+func authCacheHit(user, pass string) bool {
+	key := authCacheKey(user, pass)
+	authSessionCacheMu.Lock()
+	defer authSessionCacheMu.Unlock()
+	exp, ok := authSessionCache[key]
+	return ok && time.Now().Before(exp)
+}
+
+func authCacheSet(user, pass string) {
+	key := authCacheKey(user, pass)
+	authSessionCacheMu.Lock()
+	authSessionCache[key] = time.Now().Add(authCacheTTL)
+	// Prune expired entries opportunistically.
+	if len(authSessionCache) > 512 {
+		now := time.Now()
+		for k, v := range authSessionCache {
+			if now.After(v) {
+				delete(authSessionCache, k)
+			}
+		}
+	}
+	authSessionCacheMu.Unlock()
+}
+
 var (
 	// authUsers is populated from data/users.json on startup.  On the very first
 	// run (no users.json) a random password is generated, saved, and printed to
@@ -209,14 +250,20 @@ func basicAuthMiddleware(next http.Handler) http.Handler {
 			return
 		}
 
-		usersMu.RLock()
-		storedHash, exists := authUsers[user]
-		usersMu.RUnlock()
+		// Fast path — skip bcrypt if this credential pair was recently validated.
+		// bcrypt at cost-12 takes ~250 ms; the cache keeps the dashboard snappy.
+		if !authCacheHit(user, pass) {
+			usersMu.RLock()
+			storedHash, exists := authUsers[user]
+			usersMu.RUnlock()
 
-		if !exists || !checkPassword(storedHash, pass) {
-			w.Header().Set("WWW-Authenticate", `Basic realm="AetherForge Control Deck"`)
-			http.Error(w, "Unauthorized", http.StatusUnauthorized)
-			return
+			if !exists || !checkPassword(storedHash, pass) {
+				w.Header().Set("WWW-Authenticate", `Basic realm="AetherForge Control Deck"`)
+				http.Error(w, "Unauthorized", http.StatusUnauthorized)
+				return
+			}
+			// Credential verified — cache it for the next few minutes.
+			authCacheSet(user, pass)
 		}
 
 		next.ServeHTTP(w, r)