v0.31.2

src/basic_auth.rs

@@ -2,7 +2,7 @@
 //! ACLs run first; credentials are never cached with content or written to logs.
 use anyhow::{ensure, Result};
 use argon2::{
-    password_hash::{PasswordHash, PasswordVerifier},
+    password_hash::{phc::PasswordHash, PasswordVerifier},
     Argon2,
 };
 use axum::response::{IntoResponse, Response};
@@ -88,8 +88,10 @@ impl Settings {
             );
             let hash = PasswordHash::new(&user.password_hash)
                 .map_err(|_| anyhow::anyhow!("basic.invalid_hash"))?;
+            // Match the former 16-character minimum for the PHC-encoded salt.
+            // phc 0.6 Salt::len() now measures decoded bytes instead.
             ensure!(
-                hash.salt.is_some_and(|s| s.as_str().len() >= 16)
+                hash.salt.is_some_and(|s| s.to_salt_string().len() >= 16)
                     && hash.hash.is_some_and(|h| h.len() == 32),
                 "basic.invalid_hash"
             );
@@ -221,11 +223,10 @@ impl Compiled {
             .map_err(|_| denied(StatusCode::SERVICE_UNAVAILABLE, None))?;
         let verified = tokio::task::spawn_blocking(move || {
             let _permit = permit;
-            PasswordHash::new(&encoded).ok().is_some_and(|hash| {
-                Argon2::default()
-                    .verify_password(password.as_bytes(), &hash)
+            PasswordHash::new(&encoded).is_ok()
+                && Argon2::default()
+                    .verify_password(password.as_bytes(), encoded.as_str())
                     .is_ok()
-            })
         })
         .await
         .unwrap_or(false);