// Signing in users whose passwords came from an old system, moving them to Argon2.
//
//   quillo run bcrypt.qwe      then open http://localhost:8080/login

use "bcrypt.qwer"

// A user from the old database, hashed by PHP's password_hash.
let old_hash = bcrypt_hash("hunter22", 10)?

fn sign_in(password: str, stored: str) {
    if is_bcrypt(stored) {
        if !bcrypt_verify(password, stored) { return { ok: false } }
        // Right: keep an Argon2 hash from now on.
        return { ok: true, rehashed: crypto.hash_password(password) }
    }
    { ok: crypto.verify_password(password, stored) }
}

route GET /login {
    let good = sign_in("hunter22", old_hash)
    { right: good.ok, moved_to_argon2: starts_with(good.rehashed, "$argon2id$"), wrong: sign_in("hunter2", old_hash).ok }
}