def check_password(user, raw_password):
    """Given a DB entry and a raw password, check its validity."""

    # Check if the user's password is a "hardened hash".
    if user.password.startswith('hh$'):
        alg, salt, bc_pwd = user.password.split('$', 3)[1:]
        hash = get_hexdigest(alg, salt, raw_password)
        algo_and_hash, key_ver = bc_pwd.rsplit('$', 1)
        try:
            shared_key = settings.HMAC_KEYS[key_ver]
        except KeyError:
            log.info('Invalid shared key version "{0}"'.format(key_ver))
            return False
        bc_value = algo_and_hash[6:]
        hmac_value = _hmac_create('$'.join([alg, salt, hash]), shared_key)

        if _bcrypt_verify(hmac_value, bc_value):
            # Password is a match, convert to bcrypt format.
            user.set_password(raw_password)
            user.save()
            return True

        return False

    # Normal bcrypt password checking.
    algo_and_hash, key_ver = user.password.rsplit('$', 1)
    try:
        shared_key = settings.HMAC_KEYS[key_ver]
    except __HOLE__:
        log.info('Invalid shared key version "{0}"'.format(key_ver))
        return False
    bc_value = algo_and_hash[algo_and_hash.find('$'):]  # Yes, bcrypt <3s the leading $.
    hmac_value = _hmac_create(raw_password, shared_key)
    matched = _bcrypt_verify(hmac_value, bc_value)

    # Update password hash if HMAC key has since changed.
    if matched and getattr(settings, 'PWD_HMAC_REKEY', True):
        latest_key_id = max(settings.HMAC_KEYS.keys())
        if key_ver != latest_key_id:
            user.set_password(raw_password)
            user.save()

    return matched
dataset/ETHPy150Open fwenzel/django-sha2/django_sha2/bcrypt_auth.py/check_password