tempest/cryptography has undocumented hard dependency on Argon2

[TimWolla]

Tempest version

3.0

PHP version

8.5

Operating system

Linux

Description

Trying to use Tempest on a PHP version that does not include Argon2 will fail:

  Fatal error: Uncaught Error: Undefined constant "Tempest\Cryptography\Password\PASSWORD_ARGON2ID" in vendor/tempest/framework/packages/cryptography/src/Password/HashingAlgorithm.php:10
  Stack trace:
  #0 vendor/tempest/framework/packages/cryptography/src/Password/hashing.config.php(5): [constant expression]()
  #1 vendor/tempest/framework/packages/core/src/Kernel/LoadConfig.php(33): require()
  #2 vendor/tempest/framework/packages/core/src/FrameworkKernel.php(191): Tempest\Core\Kernel\LoadConfig->__invoke()
  #3 vendor/tempest/framework/packages/core/src/FrameworkKernel.php(73): Tempest\Core\FrameworkKernel->loadConfig()
  #4 vendor/tempest/framework/packages/core/src/Tempest.php(14): Tempest\Core\FrameworkKernel::boot('/home/runner/wo...', Array, NULL, NULL)
  #5 vendor/tempest/framework/packages/console/src/ConsoleApplication.php(42): Tempest\Core\Tempest::boot(NULL, Array, NULL)
  #6 vendor/tempest/framework/packages/console/bin/tempest(8): Tempest\Console\ConsoleApplication::boot()
  #7 vendor/bin/tempest(119): include('/home/runner/wo...')
  #8 {main}

This will happen even when overriding the password hashing algorithm to BCrypt in app/hashing.config.php:

<?php

use Tempest\Cryptography\Password\BcryptConfig;

return new BcryptConfig();

[TimWolla]

Relatedly: For interactive authentication Argon2 is also a worse choice than BCrypt. The recommended default for web applications should still be BCrypt. See: https://news-web.php.net/php.internals/120996