<?php

namespace App\Auth;

use Illuminate\Auth\EloquentUserProvider;
use Illuminate\Contracts\Auth\Authenticatable as UserContract;

/**
 * Uses PHP's password_verify() so stored hashes work whether they were created with
 * bcrypt, Argon2i, or Argon2id, while the app default hasher remains bcrypt for new passwords.
 */
class FlexibleEloquentUserProvider extends EloquentUserProvider
{
    public function validateCredentials(UserContract $user, #[\SensitiveParameter] array $credentials): bool
    {
        $plain = $credentials['password'] ?? null;
        if (! is_string($plain)) {
            return false;
        }

        $hashed = $user->getAuthPassword();
        if (! is_string($hashed) || $hashed === '') {
            return false;
        }

        return password_verify($plain, $hashed);
    }
}
