Rongsong Shen
f91642dbc0
Cause: ConfigFileProvider.Authenticate compared the stored plaintext password with != (timing side channel, passwords readable from the file), and config/auth.yaml shipped admin/admin, user1/user1 etc. as plaintext with nothing reporting that a default credential was active. Fix: auth.yaml passwords may be bcrypt hashes (golang.org/x/crypto/bcrypt, v0.23.0 as already pinned in go.mod, now vendored); plaintext entries are still accepted but compared in constant time (SHA-256 + subtle), and an unknown user costs the same bcrypt work. The provider reports startup warnings (SecurityWarner, logged by main) for every plaintext entry and for every shipped default credential still active. The shipped auth.yaml and auth.yaml.example now store bcrypt hashes of the same dev passwords, so tests/regression/run.sh (admin/admin) keeps working. tools/encrypt gains -action=hash to generate entries. Tests: TestConfigFileProvider_BcryptPassword, TestConfigFileProvider_SecurityWarnings, TestShippedAuthConfig_HashedDefaults. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
21 lines
673 B
Go
21 lines
673 B
Go
package auth
|
|
|
|
// UserRoleSeeder is an optional interface for providers that can enumerate all users.
|
|
// Used to pre-populate the role store at startup so permissions work after restart.
|
|
type UserRoleSeeder interface {
|
|
AllUsers() []string
|
|
}
|
|
|
|
// SecurityWarner is an optional interface for providers that detect insecure
|
|
// configuration (plaintext or default credentials); main logs each warning at
|
|
// startup.
|
|
type SecurityWarner interface {
|
|
SecurityWarnings() []string
|
|
}
|
|
|
|
// AuthProvider is the interface for authentication strategies.
|
|
type AuthProvider interface {
|
|
Authenticate(username, password string) error
|
|
GetUserRoles(username string) []string
|
|
Name() string
|
|
}
|