1111// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
1212// See the License for the specific language governing permissions and
1313// limitations under the License.
14+
15+ //! Functions that calculate salted password hash values the same way RabbitMQ
16+ //! nodes do it.
17+ //!
18+ //! Use this module if you need to calculate a password hash for a `crate::requests::UserParams`
19+ //! object that you pass to [`crate::api::Client::create_user`] or [`crate::blocking_api::Client::create_user`].
20+ //!
21+ //! See the [Credentials and Passwords guide](https://rabbitmq.com/docs/passwords/).
22+ //!
23+
1424use rand:: RngCore ;
1525use ring:: digest:: { Context , SHA256 , SHA512 } ;
1626use std:: fmt;
@@ -78,10 +88,19 @@ pub fn base64_encoded_salted_password_hash_sha512(salt: &[u8], password: &str) -
7888 base64_encoded_salted_password_hash ( salt, password, & HashingAlgorithm :: SHA512 )
7989}
8090
91+ /// Supported hashing algorithms for password salting and hashing.
92+ ///
93+ /// This enum represents the cryptographic hash algorithms that can be used
94+ /// for password hashing in RabbitMQ user management. SHA-256 is the default
95+ /// algorithm and is recommended for most use cases.
96+ ///
97+ /// See the [Credentials and Passwords guide](https://rabbitmq.com/docs/passwords/).
8198#[ derive( Clone , Default , PartialEq , Eq , Hash , Debug ) ]
8299pub enum HashingAlgorithm {
100+ /// SHA-256 hashing algorithm (default)
83101 #[ default]
84102 SHA256 ,
103+ /// SHA-512 hashing algorithm
85104 SHA512 ,
86105 // Unlike RabbitMQ that accepts module implementations via configuration,
87106 // we cannot support salting and hashing for arbitrary algorithm names,
@@ -98,6 +117,13 @@ impl fmt::Display for HashingAlgorithm {
98117}
99118
100119impl From < & str > for HashingAlgorithm {
120+ /// Converts a string slice to a `HashingAlgorithm`.
121+ ///
122+ /// Supported string values (case-insensitive):
123+ /// - "SHA256" or "SHA-256" → `HashingAlgorithm::SHA256`
124+ /// - "SHA512" or "SHA-512" → `HashingAlgorithm::SHA512`
125+ ///
126+ /// Any other value defaults to `HashingAlgorithm::SHA256`.
101127 fn from ( s : & str ) -> Self {
102128 match s. to_uppercase ( ) . as_str ( ) {
103129 "SHA256" => HashingAlgorithm :: SHA256 ,
@@ -115,13 +141,43 @@ impl From<String> for HashingAlgorithm {
115141 }
116142}
117143
144+ /// Errors that can occur during password hashing operations.
118145#[ derive( Error , Debug ) ]
119146pub enum HashingError {
147+ /// The specified hashing algorithm is not supported.
120148 #[ error( "Provided algorithm is not supported" ) ]
121149 UnsupportedAlgorithm ,
122150}
123151
124152impl HashingAlgorithm {
153+ /// Generates a Base64-encoded, salted password hash from a clear text password value.
154+ /// Use this function to produce a password hash to be passed to ``
155+ ///
156+ /// This method combines the salt with the password and applies the hash algorithm
157+ /// specified by this enum variant, then returns the result as a Base64-encoded string.
158+ ///
159+ /// # Arguments
160+ ///
161+ /// * `salt`: a byte slice containing the salt to use for hashing
162+ /// * `password`: the plaintext password to hash
163+ ///
164+ /// # Returns
165+ ///
166+ /// A `Result` containing either:
167+ /// - `Ok(String)`: the Base64-encoded salted password hash
168+ /// - `Err(HashingError)`: tn error if the algorithm is not supported
169+ ///
170+ /// # Examples
171+ ///
172+ /// ```rust
173+ /// use rabbitmq_http_client::password_hashing::{HashingAlgorithm, salt};
174+ ///
175+ /// let salt = salt();
176+ /// let algorithm = HashingAlgorithm::SHA256;
177+ /// let hash = algorithm.salt_and_hash(&salt, "a_cleartext_password").unwrap();
178+ /// ```
179+ ///
180+ /// See the [Credentials and Passwords guide](https://rabbitmq.com/docs/passwords/).
125181 pub fn salt_and_hash ( & self , salt : & [ u8 ] , password : & str ) -> Result < String , HashingError > {
126182 Ok ( base64_encoded_salted_password_hash ( salt, password, self ) )
127183 }
0 commit comments