05/18 Enhanced codes and functionalities 2

app/services/auth_service.py

@@ -24,10 +24,24 @@ def hash_auth_token(auth_hash: str) -> str:
     return ph.hash(auth_hash)
 
 
-def verify_auth_token(auth_hash: str, stored_hash: str) -> bool:
+def verify_auth_token(auth_hash: str, stored_hash: str, user=None) -> bool:
+    """
+    Verify auth_hash against stored Argon2id hash.
+    If user is provided and the stored hash uses outdated parameters,
+    the hash is transparently upgraded on successful verification.
+    Caller must commit the session after this returns True.
+    """
     ph = PasswordHasher()
     try:
-        return ph.verify(stored_hash, auth_hash)
+        result = ph.verify(stored_hash, auth_hash)
+        if result and user is not None and ph.check_needs_rehash(stored_hash):
+            ph_fresh = PasswordHasher(
+                time_cost=current_app.config['ARGON2_TIME_COST'],
+                memory_cost=current_app.config['ARGON2_MEMORY_COST'],
+                parallelism=current_app.config['ARGON2_PARALLELISM'],
+            )
+            user.master_hash = ph_fresh.hash(auth_hash)
+        return result
     except (VerifyMismatchError, VerificationError, InvalidHashError):
         return False