Password Hashing

final class PasswordHasher
{
    public function __construct(
        private readonly string $pepper,
        private readonly string $algo = PASSWORD_DEFAULT,
        private readonly array $options = [],
    ) {
        if ($this->pepper === '') {
            throw new InvalidArgumentException('Pepper must not be empty.');
        }
    }

    public function hash(string $password): string
    {
        if ($password === '') {
            throw new InvalidArgumentException('Password must not be empty.');
        }

        $hash = password_hash($this->season($password), $this->algo, $this->options);
        if ($hash === false) {
            throw new RuntimeException('Could not hash the password.');
        }

        return $hash;
    }

    public function verify(string $password, string $hash): bool
    {
        if ($password === '' || $hash === '' || ! str_starts_with($hash, '$')) {
            return false;
        }

        return password_verify($this->season($password), $hash);
    }

    public function needsRehash(string $hash): bool
    {
        return password_needs_rehash($hash, $this->algo, $this->options);
    }

    private function season(string $password): string
    {
        return hash_hmac('sha256', $password, $this->pepper, true);
    }
}

$hasher = new PasswordHasher($_ENV['APP_PEPPER'] ?? '');

$hash = $hasher->hash($password);

if (! $hasher->verify($password, $hash)) {
    throw new RuntimeException('Invalid password.');
}

if ($hasher->needsRehash($hash)) {
    $user->password = $hasher->hash($password);
}