feat(F4): add PIN hashing utilities with PBKDF2-SHA256

vigilar/alerts/pin.py

@@ -0,0 +1,22 @@
+"""PIN hashing and verification using PBKDF2-SHA256."""
+
+import hashlib
+import os
+
+
+def hash_pin(pin: str) -> str:
+    salt = os.urandom(16)
+    dk = hashlib.pbkdf2_hmac("sha256", pin.encode(), salt, iterations=600_000)
+    return f"pbkdf2_sha256${salt.hex()}${dk.hex()}"
+
+
+def verify_pin(pin: str, stored_hash: str) -> bool:
+    if not stored_hash:
+        return True
+    parts = stored_hash.split("$")
+    if len(parts) != 3 or parts[0] != "pbkdf2_sha256":
+        return False
+    salt = bytes.fromhex(parts[1])
+    expected = parts[2]
+    dk = hashlib.pbkdf2_hmac("sha256", pin.encode(), salt, iterations=600_000)
+    return dk.hex() == expected