use orion::{errors::UnknownCryptoError, pwhash};

// see guidelines on determining those values: https://doc.libsodium.org/password_hashing/default_phf#guidelines-for-choosing-the-parameters
// 3 password hash iterations
const ITERATIONS: u32 = 3;
// 64MB RAM allocated to a password hash
const MEMORY: u32 = 1 << 16;
// TODO: make those configurable through the .toml file

pub fn hash<'a>(input: &'a str) -> Result<String, UnknownCryptoError> {
	let password = pwhash::Password::from_slice(input.as_bytes())?;

	Ok(pwhash::hash_password(&password, ITERATIONS, MEMORY)?
		.unprotected_as_encoded()
		.to_string())
}

pub fn verify(input: &str, against: &str) -> Result<bool, UnknownCryptoError> {
	if input.len() == 0 {
		// disabled accounts
		return Ok(false);
	}
	let password = pwhash::Password::from_slice(input.as_bytes())?;
	let hash = pwhash::PasswordHash::from_encoded(against)?;

	Ok(pwhash::hash_password_verify(&hash, &password).is_ok())
}
