Argon2id.cs

using NetDevPack.Security.PasswordHasher.Core;
using Microsoft.AspNetCore.Identity;
using Microsoft.Extensions.Options;
using Sodium;
using System;
using NetDevPack.Security.PasswordHasher.Core.Utilities;

namespace NetDevPack.Security.PasswordHasher.Argon2;


/// <summary>
/// General class of the Argon2id implementation. 
/// </summary>
/// <typeparam name="TUser"></typeparam>
public class Argon2Id<TUser> : IPasswordHasher<TUser> where TUser : class
{
    private readonly PasswordHasher<TUser> _identityHasher;
    private readonly ImprovedPasswordHasherOptions _options;

    /// <summary>
    /// Creates a new instance of <see cref="PasswordHasher{TUser}"/>.
    /// </summary>
    /// <param name="identityHasher">AspNet Identity PasswordHasher</param>
    /// <param name="optionsAccessor">The options for this instance.</param>
    public Argon2Id(PasswordHasher<TUser> identityHasher, IOptions<ImprovedPasswordHasherOptions> optionsAccessor = null)
    {
        _identityHasher = identityHasher;
        _options = optionsAccessor?.Value ?? new ImprovedPasswordHasherOptions();
    }

    public string HashPassword(TUser user, string password)
    {
        ArgumentNullException.ThrowIfNull(password);
        ArgumentNullException.ThrowIfNull(user);

        // Unificando a lógica de hash 
        string hash = (_options.OpsLimit.HasValue && _options.MemLimit.HasValue)
            ? PasswordHash.ArgonHashString(password, _options.OpsLimit.Value, _options.MemLimit.Value)
            : _options.Strength switch
        {
                PasswordHasherStrength.Interactive => PasswordHash.ArgonHashString(password, PasswordHash.StrengthArgon.Interactive),
                PasswordHasherStrength.Moderate => PasswordHash.ArgonHashString(password, PasswordHash.StrengthArgon.Moderate),
                PasswordHasherStrength.Sensitive => PasswordHash.ArgonHashString(password, PasswordHash.StrengthArgon.Sensitive),
                _ => throw new ArgumentOutOfRangeException(nameof(_options.Strength), "Valor de força de hash inválido.")
        };

        // Remove o nulo terminal (0x00)
        // TrimEnd é mais eficiente que Replace.
        return hash.TrimEnd('\0');
    }

    public PasswordVerificationResult VerifyHashedPassword(TUser user, string hashedPassword, string providedPassword)
    {
        ArgumentNullException.ThrowIfNull(user);
        ArgumentNullException.ThrowIfNull(hashedPassword);
        ArgumentNullException.ThrowIfNull(providedPassword);

        var info = new HashInfo(hashedPassword);

        // Support for migrating legacy ASP.NET Identity hashes (PBKDF2)
        if (info.IsAspNetV2 || info.IsAspNetV3)
        {
            var result = _identityHasher.VerifyHashedPassword(user, hashedPassword, providedPassword);
            if (result == PasswordVerificationResult.Success ||
                result == PasswordVerificationResult.SuccessRehashNeeded)
            {
                return PasswordVerificationResult.SuccessRehashNeeded;
            }

            return PasswordVerificationResult.Failed;
        }

        return PasswordHash.ArgonHashStringVerify(hashedPassword, providedPassword)
            ? PasswordVerificationResult.Success
            : PasswordVerificationResult.Failed;
    }


}