backbone-auth 2.7.35

Backbone Framework Auth - Authentication and authorization system
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136

//! Password hashing and verification

use anyhow::Result;
use argon2::{
    password_hash::{rand_core::OsRng, PasswordHash, PasswordHasher, SaltString},
    Argon2,
};

/// Password service
pub struct PasswordService {
    argon2: Argon2<'static>,
}

impl PasswordService {
    pub fn new() -> Self {
        // Use secure Argon2 parameters
        let argon2 = Argon2::new(
            argon2::Algorithm::Argon2id,
            argon2::Version::V0x13,
            argon2::Params::new(19456, 2, 1, Some(32)).unwrap(),
        );

        Self { argon2 }
    }

    /// Hash password
    #[tracing::instrument(skip_all)]
    pub fn hash_password(&self, password: &str) -> Result<String> {
        let salt = SaltString::generate(&mut OsRng);
        let password_hash = self.argon2
            .hash_password(password.as_bytes(), &salt)
            .map_err(|e| {
                tracing::error!(event = "auth.password_hash_failed", "Password hashing failed");
                anyhow::anyhow!("Failed to hash password: {}", e)
            })?;

        tracing::debug!(event = "auth.password_hashed", "Password hashed successfully");
        Ok(password_hash.to_string())
    }

    /// Verify password
    #[tracing::instrument(skip_all)]
    pub fn verify_password(&self, password: &str, hash: &str) -> Result<bool> {
        let parsed_hash = PasswordHash::new(hash)
            .map_err(|e| anyhow::anyhow!("Failed to parse password hash: {}", e))?;

        let result = argon2::PasswordVerifier::verify_password(&self.argon2, password.as_bytes(), &parsed_hash).is_ok();

        tracing::debug!(
            event = "auth.password_verified",
            success = result,
            "Password verification completed"
        );

        Ok(result)
    }

    /// Generate random password
    pub fn generate_password(&self, length: usize) -> String {
        use rand::Rng;
        use rand::distributions::Alphanumeric;

        let mut rng = rand::thread_rng();
        (0..length)
            .map(|_| char::from(rng.sample(Alphanumeric)))
            .collect()
    }
}

impl Default for PasswordService {
    fn default() -> Self {
        Self::new()
    }
}

/// Password validation rules
pub struct PasswordValidator {
    min_length: usize,
    require_uppercase: bool,
    require_lowercase: bool,
    require_numbers: bool,
    require_symbols: bool,
}

impl PasswordValidator {
    pub fn new() -> Self {
        Self {
            min_length: 8,
            require_uppercase: true,
            require_lowercase: true,
            require_numbers: true,
            require_symbols: true,
        }
    }

    #[tracing::instrument(skip_all)]
    pub fn validate(&self, password: &str) -> Result<()> {
        if password.len() < self.min_length {
            tracing::warn!(event = "auth.password_validation_failed", reason = "too_short", "Password validation failed: too short");
            return Err(anyhow::anyhow!(
                "Password must be at least {} characters long",
                self.min_length
            ));
        }

        if self.require_uppercase && !password.chars().any(|c| c.is_uppercase()) {
            tracing::warn!(event = "auth.password_validation_failed", reason = "no_uppercase", "Password validation failed: no uppercase");
            return Err(anyhow::anyhow!("Password must contain at least one uppercase letter"));
        }

        if self.require_lowercase && !password.chars().any(|c| c.is_lowercase()) {
            tracing::warn!(event = "auth.password_validation_failed", reason = "no_lowercase", "Password validation failed: no lowercase");
            return Err(anyhow::anyhow!("Password must contain at least one lowercase letter"));
        }

        if self.require_numbers && !password.chars().any(|c| c.is_numeric()) {
            tracing::warn!(event = "auth.password_validation_failed", reason = "no_number", "Password validation failed: no number");
            return Err(anyhow::anyhow!("Password must contain at least one number"));
        }

        if self.require_symbols
            && !password.chars().any(|c| !c.is_alphanumeric())
        {
            tracing::warn!(event = "auth.password_validation_failed", reason = "no_symbol", "Password validation failed: no special character");
            return Err(anyhow::anyhow!("Password must contain at least one special character"));
        }

        Ok(())
    }
}

impl Default for PasswordValidator {
    fn default() -> Self {
        Self::new()
    }
}