From 3816f3ef28ff4bd7add90d24da53d0cfb22dc315 Mon Sep 17 00:00:00 2001
From: Ethan Girouard <ethan@girouard.com>
Date: Sun, 19 Jul 2026 09:52:58 -0400
Subject: [PATCH] Use less secure hashing in test mode

---
 src/models/user.rs | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/src/models/user.rs b/src/models/user.rs
index 57a638d..ae903e0 100644
--- a/src/models/user.rs
+++ b/src/models/user.rs
@@ -43,6 +43,20 @@ use crate::util::error::{Error, Result};
 #[diesel(sql_type = sql_types::Text)]
 pub struct HashedPassword(String);
 
+/// Get a `Pbkdf2` instance for hashing
+fn get_pbkdf2() -> Pbkdf2 {
+    use pbkdf2::{Algorithm, Params};
+
+    if cfg!(test) {
+        // Use lower security in testing mode so it doesn't take as long
+        // `Params::new` panics only if `rounds` < `MIN_ROUNDS`
+        Pbkdf2::new(Algorithm::default(), Params::new(Params::MIN_ROUNDS).expect("failed creating Pbkdf2 Params"))
+    } else {
+        // Default uses a sufficiently secure configuration
+        Pbkdf2::default()
+    }
+}
+
 impl HashedPassword {
     /// Check a password attempt against this hashed password
     ///
@@ -55,7 +69,7 @@ impl HashedPassword {
         let pw_hash = PasswordHash::new(&self.0)
             .map_err(|e| Error::message_here(format!("Error parsing `HashedPassword`: {e}")))?;
 
-        match Pbkdf2::default().verify_password(password_attempt.as_bytes(), &pw_hash) {
+        match get_pbkdf2().verify_password(password_attempt.as_bytes(), &pw_hash) {
             Ok(()) => Ok(true),
             Err(PasswordInvalid) => Ok(false),
             Err(e) => Err(Error::message_here(format!(
@@ -134,7 +148,7 @@ impl UserCredentials {
     /// Attempt to convert into `HashedUserCredentials` by hashing the password. Yields a PBKDF2
     /// error on failure.
     pub fn try_hash(self) -> Result<HashedUserCredentials, pbkdf2::password_hash::Error> {
-        let hashed_password = Pbkdf2::default().hash_password(self.password.as_bytes())?;
+        let hashed_password = get_pbkdf2().hash_password(self.password.as_bytes())?;
 
         Ok(HashedUserCredentials {
             username: self.username,