restore acore_auth

app/Services/WebAccountPasswordService.php

@@ -0,0 +1,57 @@
+<?php
+
+namespace App\Services;
+
+use App\Models\User;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Hash;
+use InvalidArgumentException;
+
+class WebAccountPasswordService
+{
+    private const LEGACY_PREFIX = 'acsrp1:';
+
+    public function __construct(private readonly AzerothCoreSrpService $srp) {}
+
+    public function legacyCredential(string $username, string $saltHex, string $verifierHex): string
+    {
+        $username = strtoupper(trim($username));
+        $saltHex = strtoupper($saltHex);
+        $verifierHex = strtoupper($verifierHex);
+        if (! preg_match('/^[A-Z0-9]{3,16}$/D', $username)
+            || ! preg_match('/^[A-F0-9]{64}$/D', $saltHex)
+            || ! preg_match('/^[A-F0-9]{64}$/D', $verifierHex)) {
+            throw new InvalidArgumentException('Invalid legacy website credential.');
+        }
+
+        return self::LEGACY_PREFIX.$username.':'.$saltHex.':'.$verifierHex;
+    }
+
+    public function matches(User $user, string $password): bool
+    {
+        $stored = (string) $user->password;
+        if (! str_starts_with($stored, self::LEGACY_PREFIX)) {
+            return Hash::check($password, $stored);
+        }
+
+        if (! preg_match('/^acsrp1:([A-Z0-9]{3,16}):([A-F0-9]{64}):([A-F0-9]{64})$/D', $stored, $parts)
+            || ! $this->srp->credentialsMatch($parts[1], $password, $parts[2], $parts[3])) {
+            return false;
+        }
+
+        // Upgrade only the credential we just verified. A concurrent password
+        // change must not be overwritten or authenticate the old password.
+        $updated = DB::connection($user->getConnectionName())->table('users')
+            ->where('id', $user->id)->where('password', $stored)
+            ->update(['password' => Hash::make($password), 'updated_at' => now()]);
+        if ($updated > 0) {
+            return true;
+        }
+
+        $fresh = $user->fresh();
+
+        return $fresh !== null
+            && ! str_starts_with((string) $fresh->password, self::LEGACY_PREFIX)
+            && Hash::check($password, $fresh->password);
+    }
+}