Fix python hashing for deprecated passwords

auth/libraries/pip-auth/authlib/auth_handler.py

@@ -58,7 +58,7 @@ def hash(self, to_hash: str) -> str:
         return self.hashing_handler.hash(to_hash)
 
     def is_equals(self, to_hash: str, to_compare: str) -> bool:
-        return self.hashing_handler.verify(hash=to_compare, password=to_hash)
+        return self.hashing_handler.is_equals(to_hash, to_compare)
 
     def create_authorization_token(self, user_id: int, email: str) -> Response:
         return self.token_factory.create(user_id, email)

auth/libraries/pip-auth/authlib/hashing_handler.py

@@ -1,20 +1,46 @@
-from typing import Optional
+import base64
+import hashlib
 
 import argon2
 
 
+SHA512_HASHED_LENGTH = 152
+ARGON2_HASH_START = "$argon2"
+
+
 class HashingHandler:
-    def hash(self, to_hash: str, hash_reference: Optional[str] = None) -> str:
+    def hash(self, to_hash: str) -> str:
         ph = argon2.PasswordHasher()
         return ph.hash(to_hash)
 
-    def verify(self, hash: str, password: str) -> bool:
-        ph = argon2.PasswordHasher()
-        try:
-            return ph.verify(hash, password)
-        except (
-            argon2.exceptions.VerifyMismatchError,
-            argon2.exceptions.VerificationError,
-            argon2.exceptions.InvalidHashError,
-        ):
+    def is_equals(self, toHash: str, toCompare: str) -> bool:
+        if not toHash or not toCompare:
+            return False
+        if self.is_argon2_hash(toCompare):
+            ph = argon2.PasswordHasher()
+            try:
+                return ph.verify(toCompare, toHash)
+            except (
+                argon2.exceptions.VerifyMismatchError,
+                argon2.exceptions.VerificationError,
+                argon2.exceptions.InvalidHashError,
+            ):
+                return False
+        elif self.is_sha512_hash(toCompare):
+            return self.sha512(toHash, toCompare[0:64]) == toCompare
+        else:
             return False
+
+    def is_sha512_hash(self, hash: str) -> bool:
+        return (
+            not hash.startswith(ARGON2_HASH_START) and len(hash) == SHA512_HASHED_LENGTH
+        )
+
+    def is_argon2_hash(self, hash: str) -> bool:
+        return hash.startswith(ARGON2_HASH_START)
+
+    def sha512(self, to_hash: str, salt: str) -> str:
+        hash = hashlib.new("sha512", to_hash.encode())
+        hash.update(salt.encode())
+        hashValue = base64.b64encode(hash.digest()).decode("utf-8")
+        return salt + hashValue

auth/libraries/pip-auth/tests/test_hashing.py

@@ -1,6 +1,11 @@
+from authlib.hashing_handler import ARGON2_HASH_START
+
 from .base import BaseTestEnvironment
 
 
+DEPRECATED_PW_HASH = "316af7b2ddc20ead599c38541fbe87e9a9e4e960d4017d6e59de188b41b2758flD5BVZAZ8jLy4nYW9iomHcnkXWkfk3PgBjeiTSxjGG7+fBjMBxsaS1vIiAMxYh+K38l0gDW4wcP+i8tgoc4UBg=="  # noqa: E501
+
+
 class TestHashing(BaseTestEnvironment):
     def test_random_salt(self):
         to_hash = "Some password to hash"
@@ -11,4 +16,8 @@ def test_random_salt(self):
     def test_hash_and_is_equals(self):
         to_hash = "Some pw"
         hash = self.auth_handler.hash(to_hash)
+        self.assertEqual(hash[0:7], ARGON2_HASH_START)
         self.assertTrue(self.auth_handler.is_equals(to_hash, hash))
+
+    def test_deprecated_pw(self):
+        self.assertTrue(self.auth_handler.is_equals("admin", DEPRECATED_PW_HASH))