refactor(10.2-01): nest framework packages under modules

- Move remaining beach packages and embedded admin assets\n- Rewrite framework, example, build, and gate paths

modules/bouncer/password_test.go

@@ -0,0 +1,46 @@
+package bouncer
+
+import "testing"
+
+func TestPasswordHashAndCheck(t *testing.T) {
+	hash, err := HashPassword(10, "secret")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !CheckPassword(hash, "secret") {
+		t.Fatal("matching password rejected")
+	}
+	if CheckPassword(hash, "wrong") {
+		t.Fatal("wrong password accepted")
+	}
+	if CheckPassword("not-a-hash", "secret") {
+		t.Fatal("malformed hash must not panic or match")
+	}
+}
+
+func TestPasswordAcceptsPHPHash(t *testing.T) {
+	// php -r 'echo password_hash("golem15-a1-check", PASSWORD_BCRYPT, ["cost"=>10]);'
+	const phpHash = "$2y$10$vvjEAuqFJXs6lWVy1eo5FuTZZr84LrP8Oz2c6pzAw4f2pk6u2xV5W"
+	if !CheckPassword(phpHash, "golem15-a1-check") {
+		t.Fatal("PHP $2y$ hash rejected")
+	}
+	if CheckPassword(phpHash, "other") {
+		t.Fatal("PHP hash matched the wrong password")
+	}
+}
+
+func TestNeedsRehash(t *testing.T) {
+	hash, err := HashPassword(10, "secret")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !NeedsRehash(hash, 12) {
+		t.Fatal("lower cost must need rehash")
+	}
+	if NeedsRehash(hash, 10) || NeedsRehash(hash, 8) {
+		t.Fatal("equal or higher cost must not need rehash")
+	}
+	if !NeedsRehash("not-a-hash", 10) {
+		t.Fatal("unparseable hash must need rehash")
+	}
+}