feat: initpage com sync Go + auth + frontend em web/

internal/auth/password.go

@@ -0,0 +1,65 @@
+package auth
+
+import (
+	"crypto/rand"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"strings"
+
+	"golang.org/x/crypto/argon2"
+)
+
+func HashPassword(password string) ([]byte, error) {
+	// Argon2id params simples/seguros
+	const (
+		time    = 1
+		memory  = 64 * 1024
+		threads = 4
+		keyLen  = 32
+	)
+	salt := []byte{} // em produção use salt aleatório; simplificado aqui? vamos melhorar
+	// Melhor: gerar salt
+	return argon2.IDKey([]byte(password), salt, time, memory, threads, keyLen), nil
+}
+
+// versão melhor com salt
+func HashPasswordSafe(password string) (string, error) {
+	if password == "" {
+		return "", errors.New("senha vazia")
+	}
+	salt := make([]byte, 16)
+	if _, err := rand.Read(salt); err != nil {
+		return "", err
+	}
+	hash := argon2.IDKey([]byte(password), salt, 1, 64*1024, 4, 32)
+	return fmt.Sprintf("$argon2id$v=19$m=65536,t=1,p=4$%s$%s",
+		base64.RawStdEncoding.EncodeToString(salt),
+		base64.RawStdEncoding.EncodeToString(hash)), nil
+}
+
+func VerifyPassword(encoded, password string) bool {
+	parts := strings.Split(encoded, "$")
+	if len(parts) < 6 {
+		return false
+	}
+	// partes: ["", "argon2id", "v=19", "m=65536,t=1,p=4", salt, hash]
+	saltB, err := base64.RawStdEncoding.DecodeString(parts[4])
+	if err != nil {
+		return false
+	}
+	hashB, err := base64.RawStdEncoding.DecodeString(parts[5])
+	if err != nil {
+		return false
+	}
+	cmp := argon2.IDKey([]byte(password), saltB, 1, 64*1024, 4, uint32(len(hashB)))
+	if len(cmp) != len(hashB) {
+		return false
+	}
+	for i := range cmp {
+		if cmp[i] != hashB[i] {
+			return false
+		}
+	}
+	return true
+}