Add auth role to api

api/src/auth.service.ts

@@ -0,0 +1,33 @@
+import argon2 from 'argon2';
+import crypto from 'node:crypto';
+
+export class AuthService {
+    /**
+     * Hashes a raw password using the Argon2id industry standard.
+     */
+    async hashPassword(password: string): Promise<string> {
+        return argon2.hash(password, {
+            type: argon2.argon2id, // Strongest configuration variant against timing attacks
+            memoryCost: 2 ** 16,   // 64MB memory utilization block
+            timeCost: 3,           // 3 computational passes
+        });
+    }
+
+    /**
+     * Cryptographically verifies a password against a known hash.
+     */
+    async verifyPassword(password: string, hash: string): Promise<boolean> {
+        try {
+            return await argon2.verify(hash, password);
+        } catch {
+            return false; // Safely catches malformed hashes without crashing
+        }
+    }
+
+    /**
+     * Generates a unique, high-entropy 64-character hex session token.
+     */
+    generateSessionToken(): string {
+        return crypto.randomBytes(32).toString('hex');
+    }
+}