second commit

app/security/passwords.py

@@ -0,0 +1,28 @@
+"""Argon2id-Passwort-Hashing (siehe Konzept 6.2)."""
+from __future__ import annotations
+
+from argon2 import PasswordHasher
+from argon2.exceptions import VerifyMismatchError, InvalidHash
+
+# Parameter angelehnt an aktuelle OWASP-Empfehlung; in Produktion je nach
+# Server-Hardware kalibrieren (siehe Konzept 6.2).
+_hasher = PasswordHasher(time_cost=2, memory_cost=19 * 1024, parallelism=1)
+
+
+def hash_password(password: str) -> str:
+    return _hasher.hash(password)
+
+
+def verify_password(password_hash: str, password: str) -> bool:
+    try:
+        _hasher.verify(password_hash, password)
+    except (VerifyMismatchError, InvalidHash):
+        return False
+    return True
+
+
+def needs_rehash(password_hash: str) -> bool:
+    try:
+        return _hasher.check_needs_rehash(password_hash)
+    except InvalidHash:
+        return True