From 76ea1b4ecf63949e618892518c4057eaf7ff015c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=EC=9C=A0=EC=B0=BD=EC=9A=B1?= <changukyu@gmail.com>
Date: Sun, 12 Jul 2026 00:11:20 +0900
Subject: [PATCH] feat(cloud): argon2id password + CSRF token helpers

---
 cloud/src/Security/Csrf.php      | 11 +++++++++++
 cloud/src/Security/Password.php  | 13 +++++++++++++
 cloud/tests/PasswordCsrfTest.php | 21 +++++++++++++++++++++
 3 files changed, 45 insertions(+)
 create mode 100644 cloud/src/Security/Csrf.php
 create mode 100644 cloud/src/Security/Password.php
 create mode 100644 cloud/tests/PasswordCsrfTest.php

diff --git a/cloud/src/Security/Csrf.php b/cloud/src/Security/Csrf.php
new file mode 100644
index 0000000..2f0e643
--- /dev/null
+++ b/cloud/src/Security/Csrf.php
@@ -0,0 +1,11 @@
+<?php
+declare(strict_types=1);
+namespace App\Security;
+
+final class Csrf
+{
+    public static function issue(callable $randHex): string { return (string)$randHex(); }
+    public static function check(string $expected, string $given): bool {
+        return $expected !== '' && hash_equals($expected, $given);
+    }
+}
diff --git a/cloud/src/Security/Password.php b/cloud/src/Security/Password.php
new file mode 100644
index 0000000..daa8022
--- /dev/null
+++ b/cloud/src/Security/Password.php
@@ -0,0 +1,13 @@
+<?php
+declare(strict_types=1);
+namespace App\Security;
+
+final class Password
+{
+    public static function hash(string $plain): string {
+        return password_hash($plain, PASSWORD_ARGON2ID);
+    }
+    public static function verify(string $plain, string $hash): bool {
+        return password_verify($plain, $hash);
+    }
+}
diff --git a/cloud/tests/PasswordCsrfTest.php b/cloud/tests/PasswordCsrfTest.php
new file mode 100644
index 0000000..c949568
--- /dev/null
+++ b/cloud/tests/PasswordCsrfTest.php
@@ -0,0 +1,21 @@
+<?php
+declare(strict_types=1);
+namespace App\Tests;
+use App\Security\{Password, Csrf};
+use PHPUnit\Framework\TestCase;
+
+final class PasswordCsrfTest extends TestCase
+{
+    public function testHashVerify(): void {
+        $h = Password::hash('s3cret!');
+        $this->assertNotSame('s3cret!', $h);
+        $this->assertTrue(Password::verify('s3cret!', $h));
+        $this->assertFalse(Password::verify('wrong', $h));
+    }
+    public function testCsrf(): void {
+        $t = Csrf::issue(fn() => 'abc123');
+        $this->assertSame('abc123', $t);
+        $this->assertTrue(Csrf::check($t, 'abc123'));
+        $this->assertFalse(Csrf::check($t, 'nope'));
+    }
+}