use bcrypt for password hash

server/password-hash.js

@@ -0,0 +1,23 @@
+const passwordHashOld = require('password-hash');
+const bcrypt = require('bcrypt');
+const saltRounds = 10;
+
+exports.generate = function (password) {
+    return bcrypt.hashSync(password, saltRounds);
+}
+
+exports.verify = function (password, hash) {
+    if (isSHA1(hash)) {
+        return passwordHashOld.verify(password, hash)
+    } else {
+        return bcrypt.compareSync(password, hash);
+    }
+}
+
+function isSHA1(hash) {
+    return (typeof hash === "string" && hash.startsWith("sha1"))
+}
+
+exports.needRehash = function (hash) {
+    return isSHA1(hash);
+}