/**
 * Argon2id password hasher. OWASP 2024 baseline parameters.
 * Output is a self-describing PHC string; verification is constant-config.
 */
import argon2 from 'argon2';
import type { PasswordHasher } from '../domain/ports.js';

const OPTIONS = {
  type: argon2.argon2id,
  memoryCost: 19456, // 19 MiB
  timeCost: 2,
  parallelism: 1,
} as const;

export class Argon2PasswordHasher implements PasswordHasher {
  async hash(plain: string): Promise<string> {
    return argon2.hash(plain, OPTIONS);
  }

  async verify(hash: string, plain: string): Promise<boolean> {
    try {
      return await argon2.verify(hash, plain);
    } catch {
      // Malformed hash or verification failure: never throw upward.
      return false;
    }
  }
}
