[test] Add tests for hash method update on login

integration_tests.hxml

@@ -1,5 +1,6 @@
 -cp src
 -cp test
 -lib hx3compat
+-lib argon2
 -main IntegrationTests
--neko bin/integration_tests.n
+-neko bin/integration_tests.n

test/IntegrationTests.hx

@@ -250,6 +250,7 @@ class IntegrationTests extends TestBase {
 		runner.add(new tests.integration.TestHg());
 		runner.add(new tests.integration.TestMisc());
 		runner.add(new tests.integration.TestFixRepo());
+		runner.add(new tests.integration.TestPasswords());
 
 		final success = runner.run();
 

test/tests/integration/TestPasswords.hx

@@ -0,0 +1,59 @@
+package tests.integration;
+
+import haxelib.server.Hashing;
+
+class TestPasswords extends IntegrationTests {
+
+	override function setup() {
+		super.setup();
+		final r = haxelib(["register", foo.user, foo.email, foo.fullname, foo.pw, foo.pw]).result();
+		assertSuccess(r);
+	}
+
+	/**
+		Simulates an old user account whose md5 hash was rehashed with argon2id.
+	**/
+	function createOldUserAccount(data:{user:String, email:String, fullname:String, pw:String}) {
+		final user = dbCnx.escape(data.user);
+		final fullname = dbCnx.escape(data.fullname);
+		final email = dbCnx.escape(data.email);
+
+		// not a good way to make a salt, but this is for testing purposes
+		final saltBytes = Hashing.generateSalt();
+		final saltHex = saltBytes.toHex();
+
+		final hash = dbCnx.escape(Hashing.hash(haxe.crypto.Md5.encode(data.pw), saltBytes));
+
+		dbCnx.request(
+			'INSERT INTO User(name, fullname, email, pass, salt, hashmethod)
+			VALUES ("$user", "$fullname", "$email", "$hash", 0x$saltHex, "$Md5");'
+		);
+		dbCnx.commit();
+	}
+
+	public function testHashUpdate() {
+		createOldUserAccount(bar);
+
+		// submitting should work with the password
+		final r = haxelib([
+			"submit",
+			Path.join([IntegrationTests.projectRoot, "test/libraries/libBar.zip"]),
+			bar.pw
+		]).result();
+		assertSuccess(r);
+
+		// after submission, should have updated to new hash properly
+		final user = dbCnx.escape(bar.user);
+		final resultSet = dbCnx.request(
+			'SELECT pass,salt,hashmethod FROM User WHERE name="$user";'
+		);
+		assertTrue(resultSet.hasNext());
+		final result = resultSet.next();
+		assertFalse(resultSet.hasNext());
+
+		// hash method should be updated, as well as the hash itself
+		assertEquals(Argon2id, result.hashmethod);
+		assertEquals(Hashing.hash(bar.pw, result.salt), result.pass);
+	}
+
+}