fix(security): propagate unexpected Argon2 verification failures

Author: mckaragoz

src/CodeBeam.UltimateAuth.Server/Extensions/UAuthExceptionHandlingExtensions.cs

@@ -25,6 +25,8 @@ public static IApplicationBuilder UseUAuthExceptionHandling(this IApplicationBui
         });
     }
 
+    // TODO: Standardize runtime error codes as stable machine-readable identifiers.
+    // Keep human-readable details separate from codes and ProblemDetails.Type.
     private static Task WriteProblemDetails(HttpContext context, UAuthRuntimeException ex)
     {
         var status = ex.StatusCode;

src/client/CodeBeam.UltimateAuth.Client/Infrastructure/UAuthResultMapper.cs

@@ -110,6 +110,8 @@ private static void EnsureTransport(UAuthTransportResult raw)
         };
     }
 
+    // TODO: Preserve flattened ProblemDetails extensions during deserialization.
+    // Ensure custom extensions and traceId survive the server-to-SDK round-trip.
     private static UAuthProblem? TryDeserializeProblem(UAuthTransportResult raw)
     {
         if (raw.Body is null || raw.Body.Value.ValueKind != JsonValueKind.Object)

src/security/CodeBeam.UltimateAuth.Security.Argon2/Argon2PasswordHasher.cs

@@ -49,27 +49,36 @@ public bool Verify(PasswordHash hash, string secret)
             !int.TryParse(parts[2], out var parallelism))
                     return false;
 
-        try
-        {
-            var salt = Convert.FromBase64String(parts[3]);
-            var expectedHash = Convert.FromBase64String(parts[4]);
-
-            var argon2 = new Argon2id(Encoding.UTF8.GetBytes(secret))
-            {
-                Salt = salt,
-                Iterations = iterations,
-                MemorySize = memory,
-                DegreeOfParallelism = parallelism
-            };
+        if (iterations <= 0 || memory <= 0 || parallelism <= 0)
+            return false;
 
-            var actualHash = argon2.GetBytes(expectedHash.Length);
+        byte[] salt;
+        byte[] expectedHash;
 
-            return CryptographicOperations.FixedTimeEquals(actualHash, expectedHash);
+        try
+        {
+            salt = Convert.FromBase64String(parts[3]);
+            expectedHash = Convert.FromBase64String(parts[4]);
         }
-        catch
+        catch (FormatException)
         {
             return false;
         }
+
+        if (salt.Length == 0 || expectedHash.Length == 0)
+            return false;
+
+        var argon2 = new Argon2id(Encoding.UTF8.GetBytes(secret))
+        {
+            Salt = salt,
+            Iterations = iterations,
+            MemorySize = memory,
+            DegreeOfParallelism = parallelism
+        };
+
+        var actualHash = argon2.GetBytes(expectedHash.Length);
+
+        return CryptographicOperations.FixedTimeEquals(actualHash, expectedHash);
     }
 
     public bool NeedsRehash(PasswordHash hash)

tests/CodeBeam.UltimateAuth.Tests.Unit/Client/UAuthFlowClientTests.cs

@@ -515,8 +515,7 @@ public async Task BeginPkce_Should_Throw_When_AuthorizationCode_Missing()
 
         Func<Task> act = async () => await client.BeginPkceAsync();
 
-        await act.Should().ThrowAsync<InvalidOperationException>()
-            .WithMessage("*Invalid PKCE authorize response*");
+        await act.Should().ThrowAsync<UAuthProtocolException>().WithMessage("*authorization code*");
     }
 
     [Fact]

tests/CodeBeam.UltimateAuth.Tests.Unit/Security/Argon2PasswordHasherTest.cs

@@ -291,6 +291,23 @@ public void NeedsRehash_Should_Return_True_When_Parallelism_Changed()
             .BeTrue();
     }
 
+    [Theory]
+    [InlineData("0.65536.1.c2FsdA==.aGFzaA==")]
+    [InlineData("3.0.1.c2FsdA==.aGFzaA==")]
+    [InlineData("3.65536.0.c2FsdA==.aGFzaA==")]
+    [InlineData("3.65536.1..aGFzaA==")]
+    [InlineData("3.65536.1.c2FsdA==.")]
+    public void Verify_ShouldReturnFalse_ForMalformedHash(string encoded)
+    {
+        var hasher = CreateHasher();
+
+        var hash = PasswordHash.Create(
+            PasswordAlgorithms.Argon2,
+            encoded);
+
+        hasher.Verify(hash, "password123").Should().BeFalse();
+    }
+
     private static Argon2PasswordHasher CreateHasher()
     {
         return CreateHasher(new Argon2Options());