fix: harden auth, config access, and backups

go-backend/internal/security/password.go

@@ -0,0 +1,25 @@
+package security
+
+import (
+	"strings"
+
+	"golang.org/x/crypto/bcrypt"
+)
+
+func HashPassword(plain string) (string, error) {
+	hash, err := bcrypt.GenerateFromPassword([]byte(plain), bcrypt.DefaultCost)
+	if err != nil {
+		return "", err
+	}
+	return string(hash), nil
+}
+
+func VerifyPassword(storedHash, plain string) (bool, bool) {
+	if strings.HasPrefix(storedHash, "$2") {
+		return bcrypt.CompareHashAndPassword([]byte(storedHash), []byte(plain)) == nil, false
+	}
+	if MD5(plain) == storedHash {
+		return true, true
+	}
+	return false, false
+}