Merge pull request #715 from pow-auth/deprecate-password-hash-methods

Deprecate `password_hash_methods`

Author: danschultzer

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## v1.0.35 (TBA)
+
+### Deprecations
+
+* [`Pow.Ecto.Schema.Changeset`] Deprecated `:password_hash_methods` in favor of `:password_hash_verify`
+
 ## v1.0.34 (2023-09-18)
 
 **Note:** This release contains an important security fix. It is recommended to update  immediately if you are using the `Pow.Store.Backend.MnesiaCache`.

README.md

@@ -404,8 +404,8 @@ You can change the password hashing function easily. For example, this is how yo
 defmodule MyApp.Users.User do
   use Ecto.Schema
   use Pow.Ecto.Schema,
-    password_hash_methods: {&Argon2.hash_pwd_salt/1,
-                            &Argon2.verify_pass/2}
+    password_hash_verify: {&Argon2.hash_pwd_salt/1,
+                           &Argon2.verify_pass/2}
 
   # ...
 end

guides/production_checklist.md

@@ -65,8 +65,8 @@ You can easily change the password hashing method in Pow. Here's how you can use
 defmodule MyApp.Users.User do
   use Ecto.Schema
   use Pow.Ecto.Schema,
-    password_hash_methods: {&Argon2.hash_pwd_salt/1,
-                            &Argon2.verify_pass/2}
+    password_hash_verify: {&Argon2.hash_pwd_salt/1,
+                           &Argon2.verify_pass/2}
 
   # ...
 end

lib/pow/ecto/schema.ex

@@ -35,7 +35,7 @@ defmodule Pow.Ecto.Schema do
         use Ecto.Schema
         use Pow.Ecto.Schema,
           user_id_field: :email,
-          password_hash_methods: {&Pow.Ecto.Schema.Password.pbkdf2_hash/1,
+          password_hash_verify: {&Pow.Ecto.Schema.Password.pbkdf2_hash/1,
                                   &Pow.Ecto.Schema.Password.pbkdf2_verify/2},
           password_min_length: 8,
           password_max_length: 4096

lib/pow/ecto/schema/changeset.ex

@@ -12,7 +12,7 @@ defmodule Pow.Ecto.Schema.Changeset do
 
     * `:password_min_length`   - minimum password length, defaults to 8
     * `:password_max_length`   - maximum password length, defaults to 4096
-    * `:password_hash_methods` - the password hash and verify functions to use,
+    * `:password_hash_verify`  - the password hash and verify functions to use,
       defaults to:
 
           {&Pow.Ecto.Schema.Password.pbkdf2_hash/1,
@@ -72,7 +72,7 @@ defmodule Pow.Ecto.Schema.Changeset do
   @doc """
   Validates the password field.
 
-  A password hash is generated by using `:password_hash_methods` in the
+  A password hash is generated by using `:password_hash_verify` in the
   configuration. The password is always required if the password hash is `nil`,
   and it's required to be between `:password_min_length` to
   `:password_max_length` characters long.
@@ -206,11 +206,11 @@ defmodule Pow.Ecto.Schema.Changeset do
   @doc """
   Verifies a password in a struct.
 
-  The password will be verified by using the `:password_hash_methods` in the
+  The password will be verified by using the `:password_hash_verify` in the
   configuration.
 
   To prevent timing attacks, a blank password will be passed to the hash method
-  in the `:password_hash_methods` configuration option if the `:password_hash`
+  in the `:password_hash_verify` configuration option if the `:password_hash`
   is `nil`.
   """
   @spec verify_password(Ecto.Schema.t(), binary(), Config.t()) :: boolean()
@@ -277,7 +277,23 @@ defmodule Pow.Ecto.Schema.Changeset do
   end
 
   defp get_password_hash_functions(config) do
-    Config.get(config, :password_hash_methods, {&Password.pbkdf2_hash/1, &Password.pbkdf2_verify/2})
+    case Config.get(config, :password_hash_verify) do
+      nil -> fallback_get_password_hash(config) || {&Password.pbkdf2_hash/1, &Password.pbkdf2_verify/2}
+      functions -> functions
+    end
+  end
+
+  # TODO: Remove by 1.1.0
+  defp fallback_get_password_hash(config) do
+    case Config.get(config, :password_hash_methods) do
+      nil ->
+        nil
+
+      functions ->
+        IO.warn("use of `:password_hash_methods` config value is deprecated, use `:password_hash_verify` instead")
+
+        functions
+    end
   end
 
   defp get_email_validator(config) do

test/pow/ecto/context_test.exs

@@ -5,7 +5,7 @@ defmodule Pow.Ecto.ContextTest do
   defmodule TimingAttackUser do
     @moduledoc false
     use Ecto.Schema
-    use Pow.Ecto.Schema, password_hash_methods: {&__MODULE__.send_hash_password/1, &__MODULE__.send_verify_password/2}
+    use Pow.Ecto.Schema, password_hash_verify: {&__MODULE__.send_hash_password/1, &__MODULE__.send_verify_password/2}
 
     @ecto_derive_inspect_for_redacted_fields false
 

test/pow/ecto/schema/changeset_test.exs

@@ -177,7 +177,7 @@ defmodule Pow.Ecto.Schema.ChangesetTest do
       refute changeset.valid?
       refute changeset.errors[:password_hash]
 
-      config = [password_hash_methods: {fn _ -> nil end, & &1}]
+      config = [password_hash_verify: {fn _ -> nil end, & &1}]
       changeset = Changeset.password_changeset(%User{}, @valid_params, config)
 
       refute changeset.valid?
@@ -213,7 +213,7 @@ defmodule Pow.Ecto.Schema.ChangesetTest do
     test "can use custom password hash functions" do
       password_hash = &(&1 <> "123")
       password_verify = &(&1 == &2 <> "123")
-      config = [password_hash_methods: {password_hash, password_verify}]
+      config = [password_hash_verify: {password_hash, password_verify}]
 
       changeset = Changeset.password_changeset(%User{}, @valid_params, config)
 
@@ -263,7 +263,7 @@ defmodule Pow.Ecto.Schema.ChangesetTest do
 
     test "prevents timing attacks" do
       config = [
-        password_hash_methods: {
+        password_hash_verify: {
           fn password ->
             send(self(), {:password_hash, password})