adapter-auth: JWT, OIDC, password hashing

crates/adapters/auth/src/password.rs

@@ -0,0 +1,37 @@
+//! Password hashing adapter using the `password-auth` crate.
+
+use domain::errors::DomainResult;
+use domain::ports::AuthService;
+
+/// Concrete `AuthService` implementation backed by `password-auth`
+/// (Argon2id by default).
+pub struct PasswordAuthService;
+
+impl AuthService for PasswordAuthService {
+    fn hash_password(&self, password: &str) -> DomainResult<String> {
+        Ok(password_auth::generate_hash(password))
+    }
+
+    fn verify_password(&self, password: &str, hash: &str) -> DomainResult<bool> {
+        Ok(password_auth::verify_password(password, hash).is_ok())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn hash_and_verify_round_trip() {
+        let svc = PasswordAuthService;
+        let hash = svc.hash_password("supersecret").unwrap();
+        assert!(svc.verify_password("supersecret", &hash).unwrap());
+    }
+
+    #[test]
+    fn wrong_password_rejected() {
+        let svc = PasswordAuthService;
+        let hash = svc.hash_password("correct").unwrap();
+        assert!(!svc.verify_password("wrong", &hash).unwrap());
+    }
+}