Pull request 2383: AGDNS-2743-aghuser

Merge in DNS/adguard-home from AGDNS-2743-aghuser to master

Squashed commit of the following:

commit e3920df62be1625a3cfcc314a4aab3d1a378ca53
Merge: 70ce647f4 106785aab
Author: Stanislav Chzhen <s.chzhen@adguard.com>
Date:   Mon Apr 7 19:44:15 2025 +0300

    Merge branch 'master' into AGDNS-2743-aghuser

commit 70ce647f47921f2bb34a561d63de2041f31e6bce
Author: Stanislav Chzhen <s.chzhen@adguard.com>
Date:   Fri Apr 4 18:17:09 2025 +0300

    aghuser: imp docs

commit 87f6984248189de4a3dc0f2a245775141ea974d0
Author: Stanislav Chzhen <s.chzhen@adguard.com>
Date:   Wed Apr 2 19:03:03 2025 +0300

    aghuser: imp code

commit 636ecae85d1fce1657b5699a29451a9079d40222
Author: Stanislav Chzhen <s.chzhen@adguard.com>
Date:   Tue Apr 1 17:30:54 2025 +0300

    all: add tests

commit 5c842e94111123cf988332ccd1eb6754fa45585d
Author: Stanislav Chzhen <s.chzhen@adguard.com>
Date:   Thu Mar 27 21:44:25 2025 +0300

    all: aghuser

internal/aghuser/aghuser.go

@@ -0,0 +1,58 @@
+package aghuser
+
+import (
+	"context"
+
+	"github.com/AdguardTeam/golibs/errors"
+	"golang.org/x/crypto/bcrypt"
+)
+
+// Login is the type for web user logins.
+type Login string
+
+// NewLogin returns a web user login.
+//
+// TODO(s.chzhen): Add more constraints as needed.
+func NewLogin(s string) (l Login, err error) {
+	if s == "" {
+		return "", errors.ErrEmptyValue
+	}
+
+	return Login(s), nil
+}
+
+// Password is an interface that defines methods for handling web user
+// passwords.
+type Password interface {
+	// Authenticate returns true if the provided password is allowed.
+	Authenticate(ctx context.Context, password string) (ok bool)
+
+	// Hash returns a hashed representation of the web user password.
+	Hash() (b []byte)
+}
+
+// DefaultPassword is the default bcrypt implementation of the [Password]
+// interface.
+type DefaultPassword struct {
+	hash []byte
+}
+
+// NewDefaultPassword returns the new properly initialized *DefaultPassword.
+func NewDefaultPassword(hash string) (p *DefaultPassword) {
+	return &DefaultPassword{
+		hash: []byte(hash),
+	}
+}
+
+// type check
+var _ Password = (*DefaultPassword)(nil)
+
+// Authenticate implements the [Password] interface for *DefaultPassword.
+func (p *DefaultPassword) Authenticate(ctx context.Context, passwd string) (ok bool) {
+	return bcrypt.CompareHashAndPassword([]byte(p.hash), []byte(passwd)) == nil
+}
+
+// Hash implements the [Password] interface for *DefaultPassword.
+func (p *DefaultPassword) Hash() (b []byte) {
+	return p.hash
+}