"""Argon2id password hashing and verification."""

from argon2 import PasswordHasher
from argon2.exceptions import VerifyMismatchError

# Argon2id is the default for PasswordHasher
ph = PasswordHasher()

def hash_password(password: str) -> str:
    """Hash a plaintext password."""
    return ph.hash(password)

def verify_password(hashed: str, password: str) -> bool:
    """Verify a password against a hash. Returns True if matched."""
    try:
        ph.verify(hashed, password)
        # Note: We skip check_needs_rehash() for simplicity in this single-user app.
        return True
    except VerifyMismatchError:
        return False