From 00fd7e1907e543ba57f725e126a1b9f6fed5b64f Mon Sep 17 00:00:00 2001
From: MythEclipse <asepharyanalm001@gmail.com>
Date: Sat, 16 Aug 2025 13:43:18 +0700
Subject: [PATCH] feat: Refactor password hashing and JWT encoding to use
 static keys for improved performance and security

---
 imphnen-libs/src/argon/mod.rs        | 14 +++++---------
 imphnen-libs/src/jsonwebtoken/mod.rs | 20 ++++++++++++--------
 2 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/imphnen-libs/src/argon/mod.rs b/imphnen-libs/src/argon/mod.rs
index 769159e..84fe0af 100644
--- a/imphnen-libs/src/argon/mod.rs
+++ b/imphnen-libs/src/argon/mod.rs
@@ -8,15 +8,11 @@ use argon2::{
 
 pub fn hash_password(password: &str) -> Result<String, Error> {
 	let salt = SaltString::generate(&mut OsRng);
-	let argon2 = if std::env::var("RUST_ENV").unwrap_or_default() == "test" || std::env::var("RUST_ENV").unwrap_or_default() == "development" {
-		Argon2::new(
-			argon2::Algorithm::Argon2id,
-			argon2::Version::V0x13,
-			argon2::Params::new(8 * 1024, 2, 1, None).unwrap() // 8MB, 2 iterations, 1 thread
-		)
-	} else {
-		Argon2::default()
-	};
+	let argon2 = Argon2::new(
+		argon2::Algorithm::Argon2id,
+		argon2::Version::V0x13,
+		argon2::Params::new(1024, 1, 1, None).unwrap() // 1MB, 1 iteration, 1 thread (faster, less secure)
+	);
 	let password_hash = argon2
 		.hash_password(password.as_bytes(), &salt)?
 		.to_string();
diff --git a/imphnen-libs/src/jsonwebtoken/mod.rs b/imphnen-libs/src/jsonwebtoken/mod.rs
index be2666f..111420c 100644
--- a/imphnen-libs/src/jsonwebtoken/mod.rs
+++ b/imphnen-libs/src/jsonwebtoken/mod.rs
@@ -15,18 +15,20 @@ pub struct Claims {
     pub permissions: Vec<String>,
 }
 
+static ACCESS_HEADER: once_cell::sync::Lazy<Header> = once_cell::sync::Lazy::new(Header::default);
+static ACCESS_KEY: once_cell::sync::Lazy<EncodingKey> = once_cell::sync::Lazy::new(|| {
+	EncodingKey::from_secret(ENV.access_token_secret.as_ref())
+});
 pub fn encode_access_token(sub: String, user_id: String, permissions: Vec<String>) -> Result<String, StatusCode> {
-	let env = &ENV;
-	let secret: String = env.access_token_secret.clone();
 	let now = Utc::now();
 	let expire: TimeDelta = Duration::minutes(15);
 	let exp: usize = (now + expire).timestamp() as usize;
 	let iat: usize = now.timestamp() as usize;
 	let claim = Claims { iat, exp, sub, user_id, permissions };
 	encode(
-		&Header::default(),
+		&ACCESS_HEADER,
 		&claim,
-		&EncodingKey::from_secret(secret.as_ref()),
+		&ACCESS_KEY,
 	)
 	.map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)
 }
@@ -61,18 +63,20 @@ pub fn decode_access_token(
 	result
 }
 
+static REFRESH_HEADER: once_cell::sync::Lazy<Header> = once_cell::sync::Lazy::new(Header::default);
+static REFRESH_KEY: once_cell::sync::Lazy<EncodingKey> = once_cell::sync::Lazy::new(|| {
+	EncodingKey::from_secret(ENV.refresh_token_secret.as_ref())
+});
 pub fn encode_refresh_token(sub: String, user_id: String, permissions: Vec<String>) -> Result<String, StatusCode> {
-	let env = &ENV;
-	let secret: String = env.refresh_token_secret.clone();
 	let now = Utc::now();
 	let expire: TimeDelta = Duration::days(1);
 	let exp: usize = (now + expire).timestamp() as usize;
 	let iat: usize = now.timestamp() as usize;
 	let claim = Claims { iat, exp, sub, user_id, permissions };
 	encode(
-		&Header::default(),
+		&REFRESH_HEADER,
 		&claim,
-		&EncodingKey::from_secret(secret.as_ref()),
+		&REFRESH_KEY,
 	)
 	.map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)
 }