1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
|
package player
import (
"crypto/sha256"
"encoding/base64"
"fmt"
"strings"
"testing"
)
func TestHashPasswordUsesArgon2idAndVerifies(t *testing.T) {
hash, err := HashPassword("secret password")
if err != nil {
t.Fatal(err)
}
if !strings.HasPrefix(hash, "argon2id:") {
t.Fatalf("hash format = %q, want argon2id", hash)
}
if !CheckPassword("secret password", hash) {
t.Fatal("correct password rejected")
}
if CheckPassword("wrong password", hash) {
t.Fatal("wrong password accepted")
}
// Salts must be unique per call: two hashes of the same password differ.
other, _ := HashPassword("secret password")
if other == hash {
t.Fatal("two hashes of the same password are identical (salt reuse)")
}
}
func TestCheckPasswordVerifiesLegacySHA256(t *testing.T) {
salt := make([]byte, 16)
for i := range salt {
salt[i] = byte(i)
}
sum := sha256.Sum256(append(salt, []byte("legacy pw")...))
legacy := fmt.Sprintf("sha256:%s:%x", base64.RawStdEncoding.EncodeToString(salt), sum)
if !CheckPassword("legacy pw", legacy) {
t.Fatal("correct legacy password rejected")
}
if CheckPassword("wrong", legacy) {
t.Fatal("wrong legacy password accepted")
}
if !NeedsRehash(legacy) {
t.Fatal("legacy hash not flagged for rehash")
}
if NeedsRehash("argon2id:1:65536:2:c2FsdA:x") {
t.Fatal("argon2id hash flagged for rehash")
}
}
func TestCheckPasswordRejectsGarbage(t *testing.T) {
for _, stored := range []string{"", "plain", "argon2id:1:2:3:no-salt:zz", "unknown:v1:salt:deadbeef"} {
if CheckPassword("anything", stored) {
t.Fatalf("garbage hash accepted: %q", stored)
}
}
}
|
