【安全加密】密码存储：加盐哈希与升级策略

---注册与改密：盐哈希入库存
local function newSalt()
    local s = {}
    for i = 1, 16 do
        s[i] = string.char(math.random(65, 90))
    end
    return table.concat(s)
end

function Auth.setPassword(userId, plain)
    local salt = newSalt()
    local dk = Cipher.pbkdf(plain, salt, 1000)
    DB.exec("UPDATE accounts SET salt = ?, dk = ?, iter = ? WHERE id = ?",
        salt, dk, 1000, userId)
end

---登录校验：同参数重算比对
function Auth.verify(userId, plain)
    local row = DB.queryRow(
        "SELECT salt, dk, iter FROM accounts WHERE id = ?", userId)
    if not row then return false end
    return Cipher.pbkdf(plain, row.salt, row.iter) == row.dk
end

---透明升级：登录成功时顺带重哈希
function Auth.onLoginOk(userId, plain)
    local row = DB.queryRow(
        "SELECT iter FROM accounts WHERE id = ?", userId)
    if row.iter < 5000 then
        -- 参数升级：1000 轮提到 5000 轮
        local salt = newSalt()
        local dk = Cipher.pbkdf(plain, salt, 5000)
        DB.exec("UPDATE accounts SET salt=?, dk=?, iter=? WHERE id=?",
            salt, dk, 5000, userId)
    end
end