yf_password class

    public function column_fits($table, $column = 'password')
    {
        $key = $table . '.' . $column;
        if ( ! isset($this->_column_fits[$key])) {
            $info = db()->utils()->column_info($table, $column);
            $length = (int) ($info['length'] ?? 0);
            $type = strtolower((string) ($info['type'] ?? ''));
            $min = $this->min_column_length();
            $this->_column_fits[$key] = ($length >= $min) || in_array($type, ['text', 'mediumtext', 'longtext', 'blob']);
            if ( ! $this->_column_fits[$key]) {
                trigger_error(__CLASS__ . ': column ' . $key . ' is too short for ' . $this->_algo() . ' (needs ' . $min . '), re-hash skipped; see https://github.com/yfix/yf/blob/master/docs/UPGRADING.md', E_USER_WARNING);
            }
        }
        return $this->_column_fits[$key];
    }

    public function detect($stored)
    {
        $stored = (string) $stored;
        if ($stored === '') {
            return '';
        }
        if (ctype_xdigit($stored)) {
            $by_length = [32 => 'md5', 40 => 'sha1', 64 => 'sha256'];
            if (isset($by_length[strlen($stored)])) {
                return $by_length[strlen($stored)];
            }
        }
        if ($stored[0] === '$') {
            $info = password_get_info($stored);
            if ( ! empty($info['algo'])) {
                return strpos($stored, '$argon2') === 0 ? 'argon2id' : 'bcrypt';
            }
        }
        return 'plain';
    }

    public function hash($plain, $algo = null)
    {
        $algo = $this->_algo($algo);
        if ($algo === 'bcrypt') {
            return password_hash((string) $plain, PASSWORD_BCRYPT, $this->OPTIONS);
        }
        if ($algo === 'argon2id') {
            return password_hash((string) $plain, PASSWORD_ARGON2ID, $this->OPTIONS);
        }
        return hash($algo, (string) $plain . $this->SALT);
    }

    public function hash_token($token)
    {
        return hash('sha256', (string) $token);
    }

    public function is_hash($stored)
    {
        return ! in_array($this->detect($stored), ['', 'plain'], true);
    }

    public function min_column_length()
    {
        if ($this->MIN_COLUMN_LENGTH !== null) {
            return (int) $this->MIN_COLUMN_LENGTH;
        }
        $lengths = ['md5' => 32, 'sha1' => 40, 'sha256' => 64, 'bcrypt' => 60, 'argon2id' => 97];
        return $lengths[$this->_algo()];
    }

    public function new_token()
    {
        return bin2hex(random_bytes(32));
    }

    public function rehash($table, $id, $old_stored, $plain, $column = 'password')
    {
        if ( ! $this->REHASH_ON_LOGIN || ! $this->column_fits($table, $column)) {
            return false;
        }
        $hash = $this->hash($plain);
        $ok = db()->update($table, [$column => $hash], '`id` = ' . (int) $id . ' AND `' . $column . '` = "' . db()->es($old_stored) . '"');
        return ($ok && db()->affected_rows() > 0) ? $hash : false;
    }

    public function verify($plain, $stored, $legacy = [])
    {
        $plain = (string) $plain;
        $stored = (string) $stored;
        $no = ['ok' => false, 'rehash' => false, 'via' => ''];
        if ($plain === '' || $stored === '') {
            return $no;
        }
        $via = $this->detect($stored);
        $algo = $this->_algo();
        if ($via !== $algo && $via !== 'plain' && ! $this->ALLOW_LEGACY) {
            return $no;
        }
        if ($via === 'bcrypt' || $via === 'argon2id') {
            if ( ! password_verify($plain, $stored)) {
                return $no;
            }
            $rehash = ($via !== $algo) || password_needs_rehash($stored, $via === 'bcrypt' ? PASSWORD_BCRYPT : PASSWORD_ARGON2ID, $this->OPTIONS);
            return ['ok' => true, 'rehash' => $rehash, 'via' => $via];
        }
        if (in_array($via, ['md5', 'sha1', 'sha256'], true)) {
            // rows in the configured form were written by hash() with SALT; other digests came from the caller's
            // legacy code with its own salt, so the empty default SALT must not widen what those rows accept
            $salts = isset($legacy['salts']) ? (array) $legacy['salts'] : [$this->SALT];
            if ($via === $algo || $this->SALT !== '') {
                $salts[] = $this->SALT;
            }
            $salts = array_unique($salts);
            $candidates = [];
            foreach ($salts as $salt) {
                $candidates[$salt] = hash($via, $plain . $salt);
            }
            if ( ! empty($legacy['md5_escaped'])) {
                $candidates['__escaped'] = hash($via, db()->_mysql_escape_mimic($plain));
            }
            foreach ($candidates as $salt => $candidate) {
                if (hash_equals($stored, $candidate)) {
                    $rehash = ($via !== $algo) || ($salt !== $this->SALT);
                    return ['ok' => true, 'rehash' => $rehash, 'via' => $via];
                }
            }
        }
        if ( ! empty($legacy['plain']) && $this->ALLOW_LEGACY && hash_equals($stored, $plain)) {
            // a replayed digest matches "plain" too (old behaviour); re-hashing it would lock the real password out
            return ['ok' => true, 'rehash' => $via === 'plain', 'via' => 'plain'];
        }
        return $no;
    }

    public function __call($name, $args)
    {
        return main()->extend_call($this, $name, $args);
    }

    public function _algo($algo = null)
    {
        $algo = strtolower((string) ($algo ?: $this->ALGO));
        $aliases = ['argon2' => 'argon2id', 'argon2i' => 'argon2id', '2y' => 'bcrypt', 'password_hash' => 'bcrypt', 'default' => 'bcrypt'];
        $algo = $aliases[$algo] ?? $algo;
        return in_array($algo, ['md5', 'sha1', 'sha256', 'bcrypt', 'argon2id'], true) ? $algo : 'sha256';
    }