password: take/verify scrypt passwords too from mysterious sources
Lewis: May this revision serve well! <did:plc:3fwecdnvtcscjnrx2p4n7alz>
51 unmodified lines525354555656575859604 unmodified lines656667686969707172735 unmodified lines79808182838384858687639 unmodified linesExpand all727728729730731731732733734735214 unmodified linesExpand all950951952953954954955956957958126 unmodified linesExpand all1085108610871088108910891090109110921093109410951096109710981099110011011102110311041105110611071108422 unmodified linesExpand all15311532153315341524153515361537153815391664 unmodified linesExpand all320432053206320732083209321032113212321332143215321632173218321932201456 unmodified linesExpand all4677467846794680468146824683468446854686468746884689469046914692469346941455 unmodified linesExpand all61506151615261536154615561566157615861596160616161626163616461656166616746 unmodified lines621462156216621762186219622062216222622362246225622662276228622962306231623262331768 unmodified linesExpand all8002800380048005800680078008800980101714 unmodified linesExpand all51 unmodified linessource = "registry+https://github.com/rust-lang/crates.io-index"checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"dependencies = [ "cfg-if", "cipher", "cipher 0.4.4", "cpufeatures 0.2.17", "zeroize",]
4 unmodified lineschecksum = "831010a0f742e1209b3bcea8fab6a8e149051ba6099432c8cb2cc117dec3ead1"dependencies = [ "aead", "aes", "cipher", "cipher 0.4.4", "ctr", "ghash", "subtle",]5 unmodified lineschecksum = "ae0784134ba9375416d469ec31e7c5f9fa94405049cf08c5ce5b4698be673e0d"dependencies = [ "aead", "aes", "cipher", "cipher 0.4.4", "ctr", "polyval", "subtle", "zeroize",639 unmodified linesExpand allsource = "registry+https://github.com/rust-lang/crates.io-index"checksum = "e412e2cd0f2b2d93e02543ceae7917b3c70331573df19ee046bcbc35e45e87d7"dependencies = [ "byteorder", "cipher", "cipher 0.4.4",]
[[package]]name = "bollard"214 unmodified linesExpand allversion = "0.1.2"source = "registry+https://github.com/rust-lang/crates.io-index"checksum = "26b52a9543ae338f279b96b0b9fed9c8093744685043739079ce85cd58f289a6"dependencies = [ "cipher", "cipher 0.4.4",]
[[package]]name = "cbor4ii"126 unmodified linesExpand allsource = "registry+https://github.com/rust-lang/crates.io-index"checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"dependencies = [ "crypto-common 0.1.7", "inout", "inout 0.1.4", "zeroize",]
[[package]]name = "cipher"version = "0.5.2"source = "registry+https://github.com/rust-lang/crates.io-index"checksum = "e8cf2a2c93cd704877c0858356ed03480ff301ee950b43f1cbe4573b088bfa6c"dependencies = [ "block-buffer 0.12.1", "crypto-common 0.2.2", "inout 0.2.2",]
[[package]]name = "clap"version = "4.6.7"source = "registry+https://github.com/rust-lang/crates.io-index"checksum = "aa8876b300ab35ba921adea3dfd70157a46249b33f95c9084ae5709785478946"422 unmodified linesExpand allversion = "0.9.2"source = "registry+https://github.com/rust-lang/crates.io-index"checksum = "0369ee1ad671834580515889b80f2ea915f23b8be8d0daa4bbaf2ac5c7590835"dependencies = [ "cipher", "cipher 0.4.4",]
[[package]]name = "ctutils"1664 unmodified linesExpand all "generic-array",]
[[package]]name = "inout"version = "0.2.2"source = "registry+https://github.com/rust-lang/crates.io-index"checksum = "4250ce6452e92010fdf7268ccc5d14faa80bb12fc741938534c58f16804e03c7"dependencies = [ "hybrid-array",]
[[package]]name = "interval-heap"version = "0.0.5"source = "registry+https://github.com/rust-lang/crates.io-index"checksum = "11274e5e8e89b8607cfedc2910b6626e998779b48a019151c7604d0adcb86ac6"1456 unmodified linesExpand allsource = "registry+https://github.com/rust-lang/crates.io-index"checksum = "03351d0f1c066c114015408dc6a3e101f080fc03ef9d8d799aa58ec760cac5a6"
[[package]]name = "pbkdf2"version = "0.13.0"source = "registry+https://github.com/rust-lang/crates.io-index"checksum = "112d82ceb8c5bf524d9af484d4e4970c9fd5a0cc15ba14ad93dccd28873b0629"dependencies = [ "digest 0.11.3", "hmac 0.13.0",]
[[package]]name = "pem"version = "3.0.6"source = "registry+https://github.com/rust-lang/crates.io-index"checksum = "1d30c53c26bc5b31a98cd02d20f25a7c8567146caf63ed593a9d87b2775291be"1455 unmodified linesExpand all "tracing-subscriber",]
[[package]]name = "salsa20"version = "0.11.0"source = "registry+https://github.com/rust-lang/crates.io-index"checksum = "2f874456e72520ff1375a06c588eaf074b0f01f9e9e1aada45bd9b7954a6e42c"dependencies = [ "cfg-if", "cipher 0.5.2",]
[[package]]name = "same-file"version = "1.0.6"source = "registry+https://github.com/rust-lang/crates.io-index"checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"46 unmodified linessource = "registry+https://github.com/rust-lang/crates.io-index"checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
[[package]]name = "scrypt"version = "0.12.0"source = "registry+https://github.com/rust-lang/crates.io-index"checksum = "d87af57419b594aa23fa95f09f0e06d80d84ba01c26148c43844cad6ff4485f0"dependencies = [ "cfg-if", "pbkdf2", "salsa20", "sha2 0.11.0",]
[[package]]name = "sec1"version = "0.7.3"source = "registry+https://github.com/rust-lang/crates.io-index"checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"1768 unmodified linesExpand all "redis", "regex", "reqwest", "s3", "scrypt", "serde", "serde_bytes", "serde_ipld_dagcbor", "serde_json",1714 unmodified linesExpand all116 unmodified linesExpand all11711811912012112212312412559 unmodified lines185186187188189190191192193194116 unmodified linesExpand alls3s = "0.17"s3s-fs = "0.17"secrecy = { version = "0.10", features = ["serde"] }reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls-webpki-roots", "http2", "charset", "macos-system-configuration"] }scrypt = "0.12"serde = { version = "1.0", features = ["derive"] }serde_bytes = "0.11"serde_ipld_dagcbor = "0.6"serde_json = "1.0"59 unmodified lines
[profile.dev.package.md-5]opt-level = 3
[profile.dev.package.scrypt]opt-level = 3
# Set the default to optimized so fortify works in CI.[profile.dev.package.tikv-jemalloc-sys]opt-level = 134 unmodified lines35363738394041424311 unmodified lines55565758596061626335 unmodified lines9910010110210110310410534 unmodified linesfutures = { workspace = true }futures-util = { workspace = true }governor = { workspace = true }hickory-resolver = { workspace = true }hex = { workspace = true }hkdf = { workspace = true }hmac = { workspace = true }http = { workspace = true }image = { workspace = true }11 unmodified linesparking_lot = { workspace = true }rand = { workspace = true }regex = { workspace = true }reqwest = { workspace = true }scrypt = { workspace = true }serde = { workspace = true }serde_bytes = { workspace = true }serde_ipld_dagcbor = { workspace = true }serde_json = { workspace = true }35 unmodified linestranquil-api = { workspace = true }tranquil-oauth-server = { workspace = true }tracing-subscriber = { workspace = true, features = ["env-filter"] }wiremock = { workspace = true }hex = { workspace = true }tokio-tungstenite = { workspace = true }s3 = { workspace = true }redis = { workspace = true }253 unmodified linesExpand all2542552562572582582592602612622 unmodified lines26526626726826926927027127227351 unmodified lines253 unmodified linesExpand all password: &str, password_hash: Option<&PasswordHash>,) -> Option<CredentialMatch> { let main_valid = password_hash .map(|h| bcrypt::verify(password, h.as_str()).unwrap_or(false)) .map(|h| tranquil_pds::auth::verify_password(password, h)) .unwrap_or(false); if main_valid { return Some(CredentialMatch::MainPassword); }2 unmodified lines .await .unwrap_or_default(); app_passwords .into_iter() .find(|app| bcrypt::verify(password, app.password_hash.as_str()).unwrap_or(false)) .find(|app| tranquil_pds::auth::verify_password(password, &app.password_hash)) .map(|app| { let scopes = app.scopes.unwrap_or_else(|| { if app.privilege.is_privileged() { "transition:generic transition:chat.bsky".to_string()51 unmodified lines72 unmodified lines737475767777787980812 unmodified lines84858687888889909192298 unmodified linesExpand all72 unmodified lines .await .log_db_err("fetching password hash")? .ok_or(ApiError::AccountNotFound)?;
let password_valid = bcrypt::verify(&input.password, password_hash.as_str()).unwrap_or(false); let password_valid = tranquil_pds::auth::verify_password(&input.password, &password_hash);
if !password_valid { let app_password_hashes = state .repos2 unmodified lines .await .unwrap_or_default();
let app_password_valid = app_password_hashes.iter().fold(false, |acc, h| { acc | bcrypt::verify(&input.password, h.as_str()).unwrap_or(false) acc | tranquil_pds::auth::verify_password(&input.password, h) });
if !app_password_valid { warn!(did = %&auth.did, "Re-auth failed: invalid password");298 unmodified linesExpand all