# #region AuthSecurityModule [C:2] [TYPE Module] [SEMANTICS auth, password, hashing, bcrypt, security]
#
# @BRIEF Utility for password hashing and verification using Passlib.
# @LAYER     Core
# @RELATION DEPENDS_ON -> [EXT:Library:bcrypt]
#
# @INVARIANT  Uses bcrypt for hashing with standard work factor.

import bcrypt


# #region verify_password [TYPE Function]
# @BRIEF Verifies a plain password against a hashed password.
# @PRE      plain_password is a string, hashed_password is a bcrypt hash.
# @POST     Returns True if password matches, False otherwise.
# @RELATION DEPENDS_ON -> [EXT:Library:bcrypt]
#
def verify_password(plain_password: str, hashed_password: str) -> bool:
    if not hashed_password:
        return False
    try:
        return bcrypt.checkpw(
            plain_password.encode("utf-8"),
            hashed_password.encode("utf-8"),
        )
    except Exception:
        return False
# #endregion verify_password

# #region get_password_hash [TYPE Function]
# @BRIEF Generates a bcrypt hash for a plain password.
# @PRE      password is a string.
# @POST     Returns a secure bcrypt hash string.
# @RELATION DEPENDS_ON -> [EXT:Library:bcrypt]
#
def get_password_hash(password: str) -> str:
    return bcrypt.hashpw(password.encode("utf-8"), bcrypt.gensalt()).decode("utf-8")
# #endregion get_password_hash

# #endregion AuthSecurityModule
