package com.codebyte.api.config;

import java.util.Map;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.crypto.argon2.Argon2PasswordEncoder;
import org.springframework.security.crypto.password.DelegatingPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

/**
 * Password hashing. Argon2id is the encoder, wrapped in a {@link DelegatingPasswordEncoder} so
 * hashes are self-describing ({@code {argon2}...}) and can be migrated to a future algorithm
 * without a data rewrite. Parameters follow the OWASP Argon2id minimum: 19 MiB memory, 2
 * iterations, parallelism 1.
 */
@Configuration
public class PasswordEncoderConfig {

    private static final String ENCODING_ID = "argon2";

    @Bean
    public PasswordEncoder passwordEncoder() {
        // saltLength=16, hashLength=32, parallelism=1, memory=19456 KiB (19 MiB), iterations=2.
        Argon2PasswordEncoder argon2 = new Argon2PasswordEncoder(16, 32, 1, 19456, 2);
        DelegatingPasswordEncoder delegating =
                new DelegatingPasswordEncoder(ENCODING_ID, Map.of(ENCODING_ID, argon2));
        // Verify legacy/unprefixed hashes with Argon2 as well (defensive, no plaintext ever).
        delegating.setDefaultPasswordEncoderForMatches(argon2);
        return delegating;
    }
}