Radicade Public Code

Server/Auth/AdminSecurity.cs

@@ -0,0 +1,78 @@
+using System.Security.Cryptography;
+using System.Text;
+
+namespace RadicadeServer.Auth;
+
+
+
+
+
+public static class AdminSecurity
+{
+
+
+	private const int Pbkdf2Iterations = 600_000;
+	private const int SaltSize = 16;
+	private const int HashSize = 32;
+
+	public static string HashPassword(string password)
+	{
+		var salt = RandomNumberGenerator.GetBytes(SaltSize);
+		var hash = Rfc2898DeriveBytes.Pbkdf2(
+			Encoding.UTF8.GetBytes(password), salt, Pbkdf2Iterations, HashAlgorithmName.SHA256, HashSize);
+		return $"pbkdf2${Pbkdf2Iterations}${Convert.ToBase64String(salt)}${Convert.ToBase64String(hash)}";
+	}
+
+	public static bool VerifyPassword(string storedHash, string password)
+	{
+		if (string.IsNullOrWhiteSpace(storedHash)) return false;
+
+		var parts = storedHash.Split('$');
+		if (parts.Length != 4 || parts[0] != "pbkdf2") return false;
+		if (!int.TryParse(parts[1], out var iterations)) return false;
+
+		try
+		{
+			var salt = Convert.FromBase64String(parts[2]);
+			var expected = Convert.FromBase64String(parts[3]);
+			var actual = Rfc2898DeriveBytes.Pbkdf2(
+				Encoding.UTF8.GetBytes(password), salt, iterations, HashAlgorithmName.SHA256, expected.Length);
+			return CryptographicOperations.FixedTimeEquals(actual, expected);
+		}
+		catch
+		{
+			return false;
+		}
+	}
+
+	public static bool NeedsRehash(string storedHash)
+	{
+		if (string.IsNullOrWhiteSpace(storedHash)) return false;
+
+		var parts = storedHash.Split('$');
+		if (parts.Length != 4 || parts[0] != "pbkdf2") return true;
+		return !int.TryParse(parts[1], out var iterations) || iterations < Pbkdf2Iterations;
+	}
+
+
+
+
+
+	public static string? ValidatePasswordPolicy(string? password, string? username = null)
+	{
+		if (string.IsNullOrWhiteSpace(password) || password.Length < 12)
+			return "Password must be at least 12 characters long.";
+		if (!password.Any(char.IsUpper))
+			return "Password must contain at least one uppercase letter.";
+		if (!password.Any(char.IsLower))
+			return "Password must contain at least one lowercase letter.";
+		if (!password.Any(char.IsDigit))
+			return "Password must contain at least one number.";
+		if (!password.Any(ch => !char.IsLetterOrDigit(ch)))
+			return "Password must contain at least one symbol (e.g. ! @ # $ %).";
+		if (!string.IsNullOrWhiteSpace(username) && username.Length >= 3 &&
+			password.Contains(username, StringComparison.OrdinalIgnoreCase))
+			return "Password must not contain your username.";
+		return null;
+	}
+}