Реализован production-hardening по fix1: env/reconfigure, IPv4-only, TLS, secrets, firewall, docs

apps/util/encrypt.go

@@ -2,7 +2,11 @@ package util
 
 import (
 	"crypto/sha256"
+	"errors"
 	"fmt"
+	"strings"
+
+	"golang.org/x/crypto/bcrypt"
 )
 
 func SHA224String(password string) string {
@@ -16,3 +20,25 @@ func SHA224String(password string) string {
 	return str
 }
 
+func HashPassword(password string) (string, error) {
+	if len(strings.TrimSpace(password)) < 6 {
+		return "", errors.New("password too short")
+	}
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	if err != nil {
+		return "", err
+	}
+	return string(hash), nil
+}
+
+func IsBcryptHash(hash string) bool {
+	return strings.HasPrefix(hash, "$2a$") || strings.HasPrefix(hash, "$2b$") || strings.HasPrefix(hash, "$2y$")
+}
+
+func VerifyPassword(password string, storedHash string) (ok bool, legacy bool) {
+	if IsBcryptHash(storedHash) {
+		err := bcrypt.CompareHashAndPassword([]byte(storedHash), []byte(password))
+		return err == nil, false
+	}
+	return SHA224String(password) == storedHash, true
+}