[markshust]

Summary

• BcryptHasher::verify() returned false straight away for values over 72 bytes or containing a NUL byte, with no hashing work. Code that calls HashManager directly could tell "rejected for length" from "wrong password" by timing.
• BcryptHasher now builds a dummy hash at the configured cost in its constructor and runs password_verify() against it (protected verifyDummy()) before returning false. This mirrors BcryptPasswordHasher in marko/authentication (fix!: reject bcrypt passwords over 72 bytes or containing nul #467/fix!: rehash passwords on login and back authentication with marko/hashing #508) and reuses the same dummy salt and digest.
• HashManager::verify() passes the call to the active hasher, so it gets the fix with no change of its own. Argon2Hasher accepts every input, so it has no rejection path.
• Updated the "Bcrypt Length Limit" section of the hashing docs page.

Test plan

• Oversize and NUL inputs return false and run the dummy verification exactly once (a subclass records verifyDummy() calls). Valid inputs never run it.
• The dummy hash is a well-formed 60-char $2y$ hash at the configured or default cost, and crypt() accepts it. A malformed hash would make password_verify() return instantly.
• Through HashManager::verify() with the bcrypt driver, both refused inputs run the dummy check.
• composer ci green locally

Fixes #517

🤖 Generated with Claude Code

https://claude.ai/code/session_01KyjR4cJTfro54iFZ9CWkv1