Documentation / @zerotal/auth / HashService
Class: HashService
Defined in: auth/src/HashService.ts:13
Password hashing service — wraps Bun.password natively. Bound in the
container as hash and reached through the Hash facade.
Remarks
Uses argon2id by default (more secure than bcrypt for new projects). Pass
"bcrypt" to the constructor to fall back. The algorithm marker is embedded in
the hash string, so check verifies hashes of either algorithm and
needsRehash can detect stale ones.
Param
algorithm
Hashing algorithm for new hashes; defaults to "argon2id".
Constructors
Constructor
new HashService(
algorithm?):HashService
Defined in: auth/src/HashService.ts:16
Parameters
algorithm?
"bcrypt" | "argon2id"
Returns
HashService
Methods
make()
make(
password):Promise<string>
Defined in: auth/src/HashService.ts:30
Hash a plain-text password with the configured algorithm.
Parameters
password
string
The plain-text password to hash.
Returns
Promise<string>
The hash string — store this in your database.
Example
const hash = await Hash.make('secret123');
check()
check(
password,hash):Promise<boolean>
Defined in: auth/src/HashService.ts:46
Verify a plain-text password against a stored hash. The algorithm is read from the hash itself, so hashes made with either algorithm verify correctly.
Parameters
password
string
The plain-text password to check.
hash
string
The stored hash to compare against.
Returns
Promise<boolean>
true when the password matches.
Example
const valid = await Hash.check('secret123', user.password);
needsRehash()
needsRehash(
hash):boolean
Defined in: auth/src/HashService.ts:63
True when a stored hash should be re-hashed because it was produced with a
different algorithm than this service is configured to use. Re-hashing on
login keeps stored credentials current as you migrate algorithms (e.g.
bcrypt → argon2id) — see Auth.attempt, which rehashes transparently.
Bun does not expose a native needsRehash, so we read the algorithm marker
encoded in the hash string: argon2id hashes begin $argon2id$, bcrypt
hashes begin $2a$ / $2b$ / $2y$.
Parameters
hash
string
The stored hash to inspect.
Returns
boolean
true when the hash's algorithm differs from the configured one.
selfTest()
selfTest():
Promise<boolean>
Defined in: auth/src/HashService.ts:74
Hash a password and verify it round-trips correctly. Used in tests and health checks.
Returns
Promise<boolean>
true when a freshly made hash verifies against its input.