chore: cap parallelism of argon2id hashing

utils/auth.go

@@ -3,11 +3,14 @@ package utils
 import (
 	"encoding/base64"
 	"errors"
-	"github.com/alexedwards/argon2id"
-	"golang.org/x/crypto/bcrypt"
 	"net/http"
 	"regexp"
+	"runtime"
 	"strings"
+
+	"github.com/alexedwards/argon2id"
+	"github.com/duke-git/lancet/v2/mathutil"
+	"golang.org/x/crypto/bcrypt"
 )
 
 var md5Regex = regexp.MustCompile(`^[a-f0-9]{32}$`)
@@ -80,10 +83,8 @@ func CompareArgon2Id(hashed, plain, pepper string) bool {
 func HashArgon2Id(plain, pepper string) (string, error) {
 	plainPepperedPassword := strings.TrimSpace(plain) + pepper
 	params := *argon2id.DefaultParams
-	// Check for the uint8 overflow bug on high-core-count CPUs.
-	if params.Parallelism == 0 {
-		// If the overflow is detected, set parallelism to a safe default.
-		params.Parallelism = 2
+	if params.Parallelism == 0 { // https://github.com/muety/wakapi/issues/866
+		params.Parallelism = uint8(mathutil.Min[int](runtime.NumCPU(), 255))
 	}
 	hash, err := argon2id.CreateHash(plainPepperedPassword, &params)
 	if err == nil {