refactor (v2): better arch

Co-authored-by: Copilot <copilot@github.com>

crates/adapters/auth/src/password.rs

@@ -0,0 +1,51 @@
+use argon2::{
+    Argon2,
+    password_hash::{
+        PasswordHash, PasswordHasher as _, PasswordVerifier, SaltString, rand_core::OsRng,
+    },
+};
+use async_trait::async_trait;
+
+use domain::{
+    errors::{DomainError, DomainResult},
+    user::{
+        ports::PasswordHasher,
+        value_objects::{Password, PasswordHash as DomainPasswordHash},
+    },
+};
+
+pub struct Argon2PasswordHasher;
+
+#[async_trait]
+impl PasswordHasher for Argon2PasswordHasher {
+    async fn hash(&self, password: &Password) -> DomainResult<DomainPasswordHash> {
+        let password_str = password.as_ref().to_owned();
+        tokio::task::spawn_blocking(move || {
+            let salt = SaltString::generate(&mut OsRng);
+            let hash = Argon2::default()
+                .hash_password(password_str.as_bytes(), &salt)
+                .map_err(|e| DomainError::Infrastructure(format!("hash failed: {e}")))?;
+            Ok(DomainPasswordHash::new(hash.to_string()))
+        })
+        .await
+        .map_err(|e| DomainError::Infrastructure(format!("task panicked: {e}")))?
+    }
+
+    async fn verify(&self, password: &Password, hash: &DomainPasswordHash) -> DomainResult<bool> {
+        let password_str = password.as_ref().to_owned();
+        let hash_str = hash.as_str().to_owned();
+        tokio::task::spawn_blocking(move || {
+            let parsed = PasswordHash::new(&hash_str)
+                .map_err(|e| DomainError::Infrastructure(format!("invalid hash: {e}")))?;
+            Ok(Argon2::default()
+                .verify_password(password_str.as_bytes(), &parsed)
+                .is_ok())
+        })
+        .await
+        .map_err(|e| DomainError::Infrastructure(format!("task panicked: {e}")))?
+    }
+}
+
+#[cfg(test)]
+#[path = "tests/password.rs"]
+mod tests;