fix: [ Aegon fix]

src/lib/auth/password.test.ts

@@ -1,4 +1,5 @@
-import { hash as bcryptHash } from "@node-rs/argon2";
+import { randomBytes } from "node:crypto";
+import { argon2id } from "hash-wasm";
 import { describe, expect, it, vi } from "vitest";
 
 const mockEnv = vi.hoisted(() => ({
@@ -29,10 +30,10 @@ describe("md5Hex", () => {
 });
 
 describe("hashPassword (default driver: bcrypt)", () => {
-	it("emits an argon2id hash and round-trips", async () => {
+	it("emits a bcrypt hash and round-trips", async () => {
 		mockEnv.PASSWORD_HASH = undefined;
 		const h = await hashPassword("s3cret!");
-		expect(h).toMatch(/^\$argon2id\$/);
+		expect(h).toMatch(/^\$2y\$\d{2}\$/);
 		expect(await verifyPassword("s3cret!", h)).toBe(true);
 		expect(await verifyPassword("wrong", h)).toBe(false);
 	});
@@ -50,9 +51,25 @@ describe("hashPassword (PASSWORD_HASH=argon2id)", () => {
 	});
 });
 
-describe("argon2", () => {
-	it("verifies an argon2 hash and round-trips", async () => {
-		const h = await bcryptHash("hunter2");
+describe("verifyPassword", () => {
+	it("verifies argon2id hashes", async () => {
+		const h = await argon2id({
+			password: "hunter2",
+			salt: randomBytes(16),
+			outputType: "encoded",
+			parallelism: 1,
+			iterations: 4,
+			memorySize: 1024,
+			hashLength: 32,
+		});
+		expect(await verifyPassword("hunter2", h)).toBe(true);
+		expect(await verifyPassword("nope", h)).toBe(false);
+	});
+
+	it("verifies legacy bcrypt hashes ($2y$)", async () => {
+		mockEnv.PASSWORD_HASH = undefined;
+		const h = await hashPassword("hunter2");
+		expect(h).toMatch(/^\$2y\$/);
 		expect(await verifyPassword("hunter2", h)).toBe(true);
 		expect(await verifyPassword("nope", h)).toBe(false);
 	});
@@ -67,12 +84,12 @@ describe("isMd5Of", () => {
 });
 
 describe("checkLogin", () => {
-	it("upgrades a legacy md5 hash to the configured hash when conversion is enabled", async () => {
+	it("upgrades a legacy md5 hash to bcrypt when conversion is enabled", async () => {
 		mockEnv.PASSWORD_HASH = undefined;
 		const stored = await md5Hex("oldpass");
 		const res = await checkLogin("oldpass", stored, { convertPasswords: true });
 		expect(res.valid).toBe(true);
-		expect(res.upgradedHash).toMatch(/^\$argon2id\$/);
+		expect(res.upgradedHash).toMatch(/^\$2y\$/);
 		expect(await verifyPassword("oldpass", res.upgradedHash as string)).toBe(
 			true,
 		);