feat: add multi-user management and secure LuCI access

server/internal/authn/password_test.go

@@ -0,0 +1,34 @@
+package authn
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestPasswordHashAndVerify(t *testing.T) {
+	hash, err := HashPassword("correct-horse-battery-staple")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.HasPrefix(hash, "$argon2id$") {
+		t.Fatalf("unexpected password hash format: %q", hash)
+	}
+	if !VerifyPassword(hash, "correct-horse-battery-staple") {
+		t.Fatal("correct password was rejected")
+	}
+	if VerifyPassword(hash, "wrong-password") {
+		t.Fatal("wrong password was accepted")
+	}
+	if VerifyPassword("$argon2id$v=19$m=999999999,t=2,p=1$c2FsdA$aGFzaA", "anything") {
+		t.Fatal("unsafe Argon2 parameters were accepted")
+	}
+}
+
+func TestPasswordLengthLimits(t *testing.T) {
+	if _, err := HashPassword("too-short"); err == nil {
+		t.Fatal("short password was accepted")
+	}
+	if _, err := HashPassword(strings.Repeat("x", 1025)); err == nil {
+		t.Fatal("oversized password was accepted")
+	}
+}