security: remediate review B findings

internal/auth/password_migration_test.go

@@ -0,0 +1,31 @@
+package auth
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"testing"
+)
+
+func TestPasswordHashUsesBcryptAndVerifies(t *testing.T) {
+	hash := PasswordHash("correct horse battery staple")
+	if len(hash) < 4 || (hash[0:4] != "$2a$" && hash[0:4] != "$2b$") {
+		t.Fatalf("hash=%q is not bcrypt", hash)
+	}
+	if !VerifyPasswordHash(hash, "correct horse battery staple") {
+		t.Fatal("bcrypt password did not verify")
+	}
+	if VerifyPasswordHash(hash, "wrong") {
+		t.Fatal("wrong password verified")
+	}
+}
+
+func TestLegacySHA256PasswordStillVerifies(t *testing.T) {
+	sum := sha256.Sum256([]byte("legacy-pass"))
+	hash := hex.EncodeToString(sum[:])
+	if !VerifyPasswordHash(hash, "legacy-pass") {
+		t.Fatal("legacy hash did not verify")
+	}
+	if VerifyPasswordHash(hash, "wrong") {
+		t.Fatal("wrong legacy password verified")
+	}
+}