Initial commit

internal/auth/password.go

@@ -0,0 +1,71 @@
+package auth
+
+import (
+	"errors"
+
+	"gardomatic.kleiax.de/internal/platform/validate"
+	"golang.org/x/crypto/bcrypt"
+)
+
+// Password holds a bcrypt hash and, while constructing a new password, its
+// plaintext value for policy validation. Plaintext is never exposed.
+type Password struct {
+	plaintext *string
+	hash      []byte
+}
+
+// NewPassword reconstructs a password value from an existing bcrypt hash.
+func NewPassword(hash []byte) *Password {
+	return &Password{hash: hash}
+}
+
+// Set hashes plaintextPassword and replaces the stored hash.
+func (p *Password) Set(plaintextPassword string) error {
+	hash, err := bcrypt.GenerateFromPassword([]byte(plaintextPassword), 12)
+	if err != nil {
+		return err
+	}
+
+	p.plaintext = &plaintextPassword
+	p.hash = hash
+
+	return nil
+}
+
+// Get returns a defensive copy of the bcrypt hash.
+func (p *Password) Get() []byte {
+	return p.hash
+}
+
+// Matches reports whether plaintextPassword matches the stored bcrypt hash.
+func (p *Password) Matches(plaintextPassword string) (bool, error) {
+	err := bcrypt.CompareHashAndPassword(p.hash, []byte(plaintextPassword))
+	if err != nil {
+		switch {
+		case errors.Is(err, bcrypt.ErrMismatchedHashAndPassword):
+			return false, nil
+		default:
+			return false, err
+		}
+	}
+
+	return true, nil
+}
+
+// Validate adds password-hash validation errors to v.
+func (p *Password) Validate(v *validate.Validator) {
+	if p.plaintext != nil {
+		ValidatePasswordPlaintext(v, *p.plaintext)
+	}
+
+	if p.hash == nil {
+		panic("missing password hash for user")
+	}
+}
+
+// ValidatePasswordPlaintext applies the password policy to plaintext input.
+func ValidatePasswordPlaintext(v *validate.Validator, plaintext string) {
+	v.Check(plaintext != "", "password", "must be provided")
+	v.Check(len(plaintext) >= 8, "password", "must be at least 8 bytes long")
+	v.Check(len(plaintext) <= 72, "password", "must not be more than 72 bytes long")
+}