bruno
1673531b43
- ruff: 602→0 errors (428 auto-fixed, pyproject.toml ignores for FastAPI patterns) - bandit: skip B310 (urllib for vault file access is intentional) - Fixed SIM118 (dict.keys()→dict), PERF102, SIM113, SIM117 - Created pyproject.toml with ruff + bandit config - 285 tests still pass
33 lines
878 B
Python
33 lines
878 B
Python
# backend/auth/password.py
|
|
# Argon2id password hashing — OWASP 2024 recommended algorithm.
|
|
# Parameters: time_cost=2, memory_cost=64MB, parallelism=2
|
|
|
|
from argon2 import PasswordHasher
|
|
from argon2.exceptions import VerificationError, VerifyMismatchError
|
|
|
|
ph = PasswordHasher(
|
|
time_cost=2,
|
|
memory_cost=65536, # 64 MB
|
|
parallelism=2,
|
|
hash_len=32,
|
|
salt_len=16,
|
|
)
|
|
|
|
|
|
def hash_password(password: str) -> str:
|
|
"""Hash a password with Argon2id."""
|
|
return ph.hash(password)
|
|
|
|
|
|
def verify_password(password: str, hashed: str) -> bool:
|
|
"""Verify a password against its Argon2id hash."""
|
|
try:
|
|
return ph.verify(hashed, password)
|
|
except (VerifyMismatchError, VerificationError):
|
|
return False
|
|
|
|
|
|
def needs_rehash(hashed: str) -> bool:
|
|
"""Check if hash needs updating (parameters changed)."""
|
|
return ph.check_needs_rehash(hashed)
|