error: crypto/bcrypt: hashedPassword is not the hash of the given password

I'm making a route to authenticate the user, when I create the user, I save the password as a hash and in the authentication I created this function to validate the password using the crypto/bcrypt lib:

func (user *User) ValidatePassword(password string) bool {
	err := bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(password))
	if err != nil {
		println(user.Password, password)
		panic(err)
	}
	return err == nil
}

when saving the user everything works fine, but when I authenticate, the password validation returns this error:

// hashes compared
$2a$10$gRIPZJZTy3f0KgUjs5eGzeVfVn1fLwkKWL3iSa30OnhLO2VuHkyfa $2a$10$gRIPZJZTy3f0KgUjs5eGzeVfVn1fLwkKWL3iSa30OnhLO2VuHkyfa

// error
http: panic serving 127.0.0.1:62939: crypto/bcrypt: hashedPassword is not the hash of the given password
goroutine 20 [running]:
net/http.(*conn).serve.func1()

I create a hash and convert to string to save:

func NewUser(name, email, password string) (*User, error) {
	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
	if err != nil {
		return nil, err
	}

	return &User{
		ID:       entity.NewID(),
		Name:     name,
		Email:    email,
		Password: string(hash),
	}, nil
}

More info:
user_domain
user_db
user_handler

According to the documentation, I think I'm using CompareHashAndPassword correctly, but I get this error

> // hashes compared
> $2a$10$gRIPZJZTy3f0KgUjs5eGzeVfVn1fLwkKWL3iSa30OnhLO2VuHkyfa $2a$10$gRIPZJZTy3f0KgUjs5eGzeVfVn1fLwkKWL3iSa30OnhLO2VuHkyfa

The logs here means that a hashed password is passed to (*User).ValidatePassword and bcrypt.CompareHashAndPassword compares two hashed passwords. This is incorrect, bcrypt.CompareHashAndPassword is supposed to compare a hashed password and a plain password.

P.S. It's a bad idea to do this Password: string(hash). This is allowed by the language spec, but the resulting string could contain invalid Unicode code points, and other software may not accept it or handle it correctly. For example, invalid code point is rejected by PostgreSQL. The following demo will panic with message: ERROR: invalid byte sequence for encoding "UTF8": 0xff (SQLSTATE 22021). I think you can change the data type of Password to []byte and store the hashed value as binary data in the database.

package main

import (
	"context"
	"fmt"
	"os"

	"github.com/jackc/pgx/v5"
)

func main() {
	urlExample := "postgres://postgres:sa123@localhost:5432/taop"
	conn, err := pgx.Connect(context.Background(), urlExample)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Unable to connect to database: %v\n", err)
		os.Exit(1)
	}
	defer conn.Close(context.Background())

	_, err = conn.Exec(context.Background(), "CREATE TABLE students(password TEXT)")
	if err != nil {
		panic(err)
	}

	_, err = conn.Exec(context.Background(), "INSERT INTO students(name) VALUES ($1)", string([]byte{0xff, 0xfe, 0xfd}))
	if err != nil {
		panic(err)
	}
}