Handling Object Dependency - php

Question

Consider the following class
class User
{
protected $password;
public function setPassword($password)
{
$this->password = $password;
return $this;
}
public function getPassword()
{
return $this->password;
}
}
I want to apply bcrypt on password using Zend\Crypt\Password\Bcrypt in user object, since this creates a dependency i want to know how to correctly deal with this, i can think about several approaches to make this work, let me elaborate
Approach 1 : Here we instantiate the class inside the method and apply required changes.
class User
{
protected $password;
public function setPassword($password)
{
$bcrypt = new Bcrypt();
$this->password = $bcrypt->create($password);
return $this;
}
public function getPassword()
{
return $this->password;
}
public function verifyPassword($password)
{
$bcrypt = new Bcrypt();
return $bcrypt->verify($password, $this->getPassword());
}
}
Towards my understanding this is not recommended approach since i see two problems here
Bcrypt() is instantiated twice
This makes User object tightly coupled with Bcrypt
I can solve problem-1 by instantiating Bcrypt() once in class constructor and use it whenever required, however this does not solve problem-2
Approach 2 : Move Bcrypt object out of user class and inject it while setting the password
class User
{
protected $password;
public function setPassword($password)
{
$this->password = $password;
return $this;
}
public function getPassword()
{
return $this->password;
}
}
// Init Bcrypt
$bcrypt = new Bcrypt;
// Instantiate user object and create a password
$user = new User;
$user->setPassword($bcrypt->create($password));
// Verify user password
if ($bcrypt->verify($password, $user->getPassword())) {
// Password is verified
}
What is the best way to about it ?
Thanks.

Answer 1

And maybe you can just create a Password class and move this logic there?
You can either do something like this:
class Password
{
private $password;
public __construct($password)
{
$this->password = $password;
}
public crypt(Zend_Crypt_Password_PasswordInterface $crypt)
{
$this->password = $crypt->create($password);
}
}
or use a Decorator.
Both solution gives you a possibility for extending your code.
Instead of Zend_Crypt_Password_PasswordInterface you can also use your own Wrapper. It would be IMHO even better solution.
And then you can set the password for particular user and it does not care whether it was crypted, hashed or whatever:
class User
{
private $password;
public function changePassword(Password $password)
{
$this->password = $password;
}
}

Answer 2

I guess first approach is better because its hide using of bcrypt within User class.
I dont think that other programmer have to keep in mind that he have to use, for example, $bcrypt->verify when working with User class.