Bcrypt

use bcrypt.qweruse bcrypt_verify, bcrypt_hash from bcrypt      // Quillo 0.6: only these

bcrypt = "0.15"

// Signing in users whose passwords came from an old system, moving them to Argon2.////   quillo run bcrypt.qwe      then open http://localhost:8080/loginuse "bcrypt.qwer"// A user from the old database, hashed by PHP's password_hash.let old_hash = bcrypt_hash("hunter22", 10)?fn sign_in(password: str, stored: str) {    if is_bcrypt(stored) {        if !bcrypt_verify(password, stored) { return { ok: false } }        // Right: keep an Argon2 hash from now on.        return { ok: true, rehashed: crypto.hash_password(password) }    }    { ok: crypto.verify_password(password, stored) }}route GET /login {    let good = sign_in("hunter22", old_hash)    { right: good.ok, moved_to_argon2: starts_with(good.rehashed, "$argon2id$"), wrong: sign_in("hunter2", old_hash).ok }}

//! Bcrypt hashes, to sign in users moved from PHP, Rails, Django or Laravel, then rehash them with Quillo's own Argon2.//! version: 1.0.0//!//! [dependencies]//! bcrypt = "0.15"/// Whether `password` matches a bcrypt `hash` (`$2a$`, `$2b$`, `$2y$`). False for a wrong password and for anything that is not such a hash.pub fn bcrypt_verify(password: &str, hash: &str) -> bool {    bcrypt::verify(password, hash).unwrap_or(false)}/// A bcrypt hash of `password`, at `cost` 4 to 31 (12 is usual): for systems that need bcrypt; Quillo's crypto.hash_password is better.pub fn bcrypt_hash(password: &str, cost: i64) -> Result<String, String> {    bcrypt::hash(password, cost.clamp(4, 31) as u32).map_err(|e| e.to_string())}/// Whether a stored value is a bcrypt hash (and so is due for rehashing).pub fn is_bcrypt(hash: &str) -> bool {    hash.len() == 60 && (hash.starts_with("$2a$") || hash.starts_with("$2b$") || hash.starts_with("$2y$"))}