/* © SRSoftware 2025 */
package de.srsoftware.umbrella.user;/* © SRSoftware 2025 */

import static de.srsoftware.tools.Strings.hex;
import static java.nio.charset.StandardCharsets.UTF_8;

import de.srsoftware.tools.PasswordHasher;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;

/**
 * This is a bad hasher for several reasons:
 * First, it uses sha-1, which is regarded outdated nowadays.
 * Second, it does not use salted passwords, which makes it prone to rainbow table attacks
 */
public class BadHasher implements PasswordHasher<String> {
	private static final String SHA1 = "SHA-1";

	private final MessageDigest digest;

	/**
	 * Create a new instance
	 * @throws NoSuchAlgorithmException if SHA256 cannot be instantiated
	 */
	public BadHasher() throws NoSuchAlgorithmException {
		digest = MessageDigest.getInstance(SHA1);
	}

	@Override
	public String hash(String password, String ignored) {
		var bytes      = digest.digest(password.getBytes(UTF_8));

		return hex(bytes);
	}

	@Override
	public String salt(String hashedPassword) {
		return null;
	}
}
