document-management/backend/dms/security/passwords.py

"""Argon2id 密码散列与校验。"""

from __future__ import annotations

from argon2 import PasswordHasher, Type
from argon2.exceptions import Argon2Error


_PASSWORD_HASHER = PasswordHasher(type=Type.ID)
_DUMMY_PASSWORD_HASH = _PASSWORD_HASHER.hash(
    "fixed-invalid-credential-placeholder"
)


def hash_password(password: str) -> str:
    if not password:
        raise ValueError("密码不能为空")
    return _PASSWORD_HASHER.hash(password)


def verify_password(password_hash: str | None, password: str) -> bool:
    try:
        return _PASSWORD_HASHER.verify(
            password_hash or _DUMMY_PASSWORD_HASH,
            password,
        )
    except Argon2Error:
        return False