main
use argon2::password_hash::{PasswordHasher, PasswordVerifier};
use argon2::{Algorithm, Argon2, Params, Version};
use crate::config::auth::PasswordPolicy;
use crate::errors::{AuthError, AuthResult};
const PHC_PREFIX: &str = "$argon2";
const CLIENT_DIGEST_LEN: usize = 64;
/// 遗留摘要要求长度恰为十六进制摘要长度且全为十六进制字符。
fn is_legacy_digest(value: &str) -> bool {
value.len() == CLIENT_DIGEST_LEN && value.bytes().all(|byte| byte.is_ascii_hexdigit())
}
/// 离开库默认档（m=19MiB t=2 p=1）：64MiB/3 轮显著抬升离线爆破成本。
fn argon2_instance() -> Argon2<'static> {
const M_COST: u32 = 64 * 1024;
const T_COST: u32 = 3;
const P_COST: u32 = 1;
match Params::new(M_COST, T_COST, P_COST, None) {
Ok(params) => Argon2::new(Algorithm::default(), Version::default(), params),
Err(_) => Argon2::default(),
}
}
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum PasswordCheck {
Match,
LegacyMatch,
Mismatch,
}
#[tracing::instrument(skip_all, fields(request_id = %envelope::context::resolve_request_id(_request_id)))]
pub async fn hash(client_digest: String, _request_id: Option<&str>) -> AuthResult<String> {
blocking(move || {
argon2_instance()
.hash_password(client_digest.as_bytes())
.map(|hash| hash.to_string())
.map_err(|error| AuthError::PasswordHash(error.to_string()))
})
.await
}
#[tracing::instrument(skip_all, fields(request_id = %envelope::context::resolve_request_id(_request_id)))]
pub async fn verify(
client_digest: String,
stored: String,
_request_id: Option<&str>,
) -> AuthResult<PasswordCheck> {
// 遗留明文摘要路径：仅用于存量账户登录时识别并触发升级重哈希；
// 新账户一律 Argon2。存量清零后可整体移除该分支。
if !stored.starts_with(PHC_PREFIX) {
// 空串与非法长度一律判失败：客户摘要和库里摘要都为空时「相等」会把账户变成空密码可登。
if !is_legacy_digest(&stored) || !is_legacy_digest(&client_digest) {
return Ok(PasswordCheck::Mismatch);
}
return Ok(
if digests_match(stored.as_bytes(), client_digest.as_bytes()) {
PasswordCheck::LegacyMatch
} else {
PasswordCheck::Mismatch
},
);
}
blocking(move || {
Ok(
match argon2_instance().verify_password(client_digest.as_bytes(), stored.as_str()) {
Ok(()) => PasswordCheck::Match,
Err(_) => PasswordCheck::Mismatch,
},
)
})
.await
}
pub fn digests_match(left: &[u8], right: &[u8]) -> bool {
let mut difference = left.len() ^ right.len();
for index in 0..left.len().max(right.len()) {
let left = left.get(index).copied().unwrap_or_default();
let right = right.get(index).copied().unwrap_or_default();
difference |= (left ^ right) as usize;
}
difference == 0
}
pub fn validate_password(password: &str, policy: &PasswordPolicy) -> AuthResult<()> {
if password.len() < policy.min_length
|| (policy.require_upper && !password.chars().any(|c| c.is_ascii_uppercase()))
|| (policy.require_lower && !password.chars().any(|c| c.is_ascii_lowercase()))
|| (policy.require_digit && !password.chars().any(|c| c.is_ascii_digit()))
|| (policy.require_symbol && !password.chars().any(|c| !c.is_ascii_alphanumeric()))
{
return Err(AuthError::InvalidPassword);
}
Ok(())
}
pub fn validate_new_password(value: &str, policy: &PasswordPolicy) -> AuthResult<()> {
if value.len() == CLIENT_DIGEST_LEN && value.bytes().all(|byte| byte.is_ascii_hexdigit()) {
return if value.len() >= policy.min_length {
Ok(())
} else {
Err(AuthError::InvalidPassword)
};
}
validate_password(value, policy)
}
async fn blocking<T, F>(work: F) -> AuthResult<T>
where
F: FnOnce() -> AuthResult<T> + Send + 'static,
T: Send + 'static,
{
match tokio::task::spawn_blocking(work).await {
Ok(result) => result,
Err(error) => Err(AuthError::PasswordHash(error.to_string())),
}
}