class

KemalIdentity::Testing::LegacyTestVerifier

Inherits KemalIdentity::Passwords::LegacyVerifier < Reference < Object

A stand-in for the password scheme an application is migrating off.

A single unsalted SHA-256 pass, which is what a legacy scheme usually turns out to be and is exactly why it is being retired. It lives behind kemal_identity/testing on purpose: this shard ships the LegacyVerifier contract and no implementations, because a published Sha256Verifier is a published working SHA-256 password check and the first thing somebody does with a class that exists is use it for something new.

Constants

PREFIX = "legacy$"

Constructors

new(name : String = "legacy-sha256", prefix : String = PREFIX)

Source

Class methods

digest_for(password : String) : String

Source

Instance methods

handles?(digest : String) : Bool

Whether this verifier recognises digest by its shape alone, with no secret involved.

MigratingHasher uses this to route a digest to exactly one verifier, which is what stops a login paying for every legacy scheme in turn. Getting it wrong in the permissive direction — claiming a digest that belongs to the current hasher — makes verify the thing that decides, so it fails closed; getting it wrong in the other direction leaves those accounts unable to log in, which is loud.

Source

name

Names the scheme, for the audit trail and for the "how many are left" query. It ends up in a log line, so it is a short identifier and not a sentence.

Source

verify(secret : KemalIdentity::Secret, digest : String) : Bool

Whether secret produced digest under the old scheme. Returns false rather than raising, for anything at all.

Source