NAME

DBIx::Class::CryptColumn - Automatically hash password/passphrase columns

VERSION

version 0.002

SYNOPSIS

__PACKAGE__->load_components(qw(CryptColumn));

__PACKAGE__->add_columns(
    id => {
        data_type         => 'integer',
        is_auto_increment => 1,
    },
    passphrase => {
        data_type          => 'text',
        inflate_passphrase => {
            encoder        => 'Argon2',
            verify_method  => 'verify_passphrase',
            rehash_method  => 'passphrase_needs_rehash',
        },
    },
);

__PACKAGE__->set_primary_key('id');

In application code:

# 'plain' will automatically be hashed using the specified
# inflate_passphrase arguments
$rs->create({ passphrase => 'plain' });

my $row = $rs->find({ id => $id });

# Returns a Crypt::Passphrase::PassphraseHash object, which has
# verify_password and needs_rehash as methods
my $passphrase = $row->passphrase;

if ($row->verify_passphrase($input)) {
  if ($row->passphrase_needs_rehash) {
    $row->update({ passphrase => $input });
  }
  ...
}

$row->passphrase('new passphrase');

DESCRIPTION

This component can be used to automatically hash password columns using any scheme supported by Crypt::Passphrase whenever the value of these columns is changed, as well as conveniently check if any given password matches the hash.

Its main advantage over other similar DBIx::Class extensions is that it provides the cryptographic agility of Crypt::Passphrase; that means that it allows you to define a single scheme that will be used for new passwords, but several schemes to check passwords against. It will be able to tell you if you should rehash your password, not only because the scheme is outdated, but also because the desired parameters have changed.

If the verify_method option is set it adds a method with that name to the row class to verify if a password matches the known hash, and likewise rehash_method will add a method for checking if a password needs to be rehashed.

METHODS

register_column

Chains with the register_column method in DBIx::Class::Row, and sets up passphrase columns according to the options documented above. This would not normally be directly called by end users.

set_column

Hash a passphrase column whenever it is set.

new

Hash all passphrase columns on new() so that copy(), create(), and others DWIM.

SEE ALSO

DBIx::Class::PassphraseColumn

DBIx::Class::EncodedColumn

AUTHOR

Leon Timmermans <leont@cpan.org>

COPYRIGHT AND LICENSE

This software is copyright (c) 2023 by Leon Timmermans.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.