modo/auth/
password.rs

1use argon2::{
2    Algorithm, Argon2, Params, Version,
3    password_hash::{PasswordHash, PasswordHasher, PasswordVerifier, SaltString, rand_core::OsRng},
4};
5use serde::Deserialize;
6
7/// Argon2id hashing parameters.
8///
9/// Deserializes from YAML/TOML config. All fields have OWASP-recommended defaults:
10/// 19 MiB memory, 2 iterations, 1 thread, 32-byte output.
11#[non_exhaustive]
12#[derive(Debug, Clone, Deserialize)]
13#[serde(default)]
14pub struct PasswordConfig {
15    /// Memory cost in kibibytes (default: 19456 = 19 MiB).
16    pub memory_cost_kib: u32,
17    /// Number of iterations (default: 2).
18    pub time_cost: u32,
19    /// Degree of parallelism (default: 1).
20    pub parallelism: u32,
21    /// Output hash length in bytes (default: 32).
22    pub output_len: usize,
23}
24
25impl Default for PasswordConfig {
26    fn default() -> Self {
27        Self {
28            memory_cost_kib: 19456,
29            time_cost: 2,
30            parallelism: 1,
31            output_len: 32,
32        }
33    }
34}
35
36/// Hashes `password` with Argon2id using the provided configuration.
37///
38/// Runs on a blocking thread via `tokio::task::spawn_blocking` so it does not
39/// starve the async runtime. Returns a PHC-formatted string that embeds the
40/// algorithm, parameters, salt, and hash — suitable for storage in a database.
41///
42/// # Errors
43///
44/// Returns `Error::internal` if the Argon2id parameters are invalid or the
45/// blocking task panics.
46pub async fn hash(password: &str, config: &PasswordConfig) -> crate::Result<String> {
47    let config = config.clone();
48    let password = password.to_string();
49    tokio::task::spawn_blocking(move || hash_blocking(&password, &config))
50        .await
51        .map_err(|e| crate::Error::internal(format!("password hash task failed: {e}")))?
52}
53
54/// Verifies `password` against a PHC-formatted `hash` produced by [`hash`].
55///
56/// Runs on a blocking thread. Returns `true` if the password matches, `false`
57/// otherwise. Never returns an error for a wrong password — only for a
58/// malformed hash string.
59///
60/// # Errors
61///
62/// Returns `Error::internal` if the hash string is structurally invalid (not
63/// PHC-formatted) or the blocking task panics.
64pub async fn verify(password: &str, hash: &str) -> crate::Result<bool> {
65    let password = password.to_string();
66    let hash = hash.to_string();
67    tokio::task::spawn_blocking(move || verify_blocking(&password, &hash))
68        .await
69        .map_err(|e| crate::Error::internal(format!("password verify task failed: {e}")))?
70}
71
72fn hash_blocking(password: &str, config: &PasswordConfig) -> crate::Result<String> {
73    let params = Params::new(
74        config.memory_cost_kib,
75        config.time_cost,
76        config.parallelism,
77        Some(config.output_len),
78    )
79    .map_err(|e| crate::Error::internal(format!("invalid argon2 params: {e}")))?;
80
81    let argon2 = Argon2::new(Algorithm::Argon2id, Version::V0x13, params);
82    let salt = SaltString::generate(&mut OsRng);
83    let hash = argon2
84        .hash_password(password.as_bytes(), &salt)
85        .map_err(|e| crate::Error::internal(format!("password hashing failed: {e}")))?;
86
87    Ok(hash.to_string())
88}
89
90fn verify_blocking(password: &str, hash: &str) -> crate::Result<bool> {
91    let parsed = PasswordHash::new(hash)
92        .map_err(|e| crate::Error::internal(format!("invalid password hash: {e}")))?;
93
94    Ok(Argon2::default()
95        .verify_password(password.as_bytes(), &parsed)
96        .is_ok())
97}
modo/auth/password.rs

modo/auth/
password.rs
