Apply Codex audit fixes

Author: krotname

.github/workflows/actionlint.yml

@@ -18,5 +18,7 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
       - name: Run actionlint
         uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8 # v2

.github/workflows/ci.yml

@@ -19,6 +19,8 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
       - name: Setup Java
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:

.github/workflows/codeql.yml

@@ -19,6 +19,8 @@ jobs:
       security-events: write
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
       - name: Setup Java
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:

.github/workflows/dependency-review.yml

@@ -14,5 +14,7 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
       - name: Review dependency changes
         uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

.github/workflows/release.yml

@@ -16,6 +16,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
       - name: Set up Java
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:

gradle/wrapper/gradle-wrapper.properties

@@ -1,8 +1,9 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
 distributionUrl=https\://services.gradle.org/distributions/gradle-9.5.1-all.zip
-networkTimeout=10000
-retries=0
+distributionSha256Sum=c72fb9991f6025cbe337d52ba77e531b3faf62bdd3e348fe1ccee9f51c71adb0
+networkTimeout=60000
+retries=3
 retryBackOffMs=500
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME

src/main/java/dev/krotname/networkchat/network/AccountStore.java

@@ -16,6 +16,9 @@
 /** File-backed account registry with salted SHA-256 token hashes. */
 public final class AccountStore {
   private static final String HASH_ALGORITHM = "SHA-256";
+  private static final int MIN_USER_NAME_LENGTH = 3;
+  private static final int MAX_USER_NAME_LENGTH = 64;
+  private static final String USER_NAME_PATTERN = "[\\p{L}\\p{N}_-]+";
 
   private final Map<String, AccountRecord> accounts;
   private final boolean enabled;
@@ -39,7 +42,9 @@ public static AccountStore load(Path accountFile) throws IOException {
         continue;
       }
       AccountRecord account = parseLine(line, lineNumber);
-      loadedAccounts.put(account.userName(), account);
+      if (loadedAccounts.putIfAbsent(account.userName(), account) != null) {
+        throw new IllegalArgumentException("Duplicate account user name on line " + lineNumber);
+      }
     }
     return new AccountStore(loadedAccounts, true);
   }
@@ -78,6 +83,13 @@ public int size() {
     return accounts.size();
   }
 
+  public static boolean isValidUserName(String userName) {
+    return userName != null
+        && userName.length() >= MIN_USER_NAME_LENGTH
+        && userName.length() <= MAX_USER_NAME_LENGTH
+        && userName.matches(USER_NAME_PATTERN);
+  }
+
   private static AccountRecord parseLine(String line, int lineNumber) {
     String[] columns = line.split(",", -1);
     if (columns.length != 4) {
@@ -87,7 +99,7 @@ private static AccountRecord parseLine(String line, int lineNumber) {
     UserRole role = parseRole(columns[1].trim(), lineNumber);
     String salt = columns[2].trim();
     String tokenHash = columns[3].trim().toLowerCase(Locale.ROOT);
-    if (userName.isBlank() || salt.isBlank() || tokenHash.isBlank()) {
+    if (!isValidUserName(userName) || salt.isBlank() || tokenHash.isBlank()) {
       throw new IllegalArgumentException("Invalid account file line " + lineNumber);
     }
     return new AccountRecord(userName, role, salt, tokenHash);

src/main/java/dev/krotname/networkchat/network/AccountTool.java

@@ -15,6 +15,10 @@ public static void main(String[] args) {
       System.err.println("Usage: AccountTool <username> <USER|ADMIN> <token>");
       System.exit(2);
     }
+    if (!AccountStore.isValidUserName(args[0])) {
+      System.err.println("Invalid username. Use 3-64 letters, digits, '_' or '-'.");
+      System.exit(2);
+    }
     UserRole role = UserRole.valueOf(args[1].toUpperCase(Locale.ROOT));
     String salt = randomSalt();
     System.out.printf("%s,%s,%s,%s%n", args[0], role, salt, AccountStore.hashToken(salt, args[2]));

src/main/java/dev/krotname/networkchat/network/ChatServer.java

@@ -28,8 +28,6 @@
 /** Chat server that authenticates users, keeps sessions, and broadcasts messages. */
 public final class ChatServer implements AutoCloseable {
   private static final Logger LOG = Logger.getLogger(ChatServer.class.getName());
-  private static final int MIN_USER_NAME_LENGTH = 3;
-  private static final int MAX_USER_NAME_LENGTH = 64;
   private static final int MIN_ROOM_NAME_LENGTH = 1;
   private static final int MAX_ROOM_NAME_LENGTH = 64;
 
@@ -249,9 +247,7 @@ private HandshakeResult serverHandshake(ChatConnection connection) throws IOExce
   }
 
   private boolean isNameValid(String userName) {
-    return userName.length() >= MIN_USER_NAME_LENGTH
-        && userName.length() <= MAX_USER_NAME_LENGTH
-        && userName.matches("[\\p{L}\\p{N}_-]+");
+    return AccountStore.isValidUserName(userName);
   }
 
   /** Sends all registered users to the new client so UI state is correct right after connect. */

src/test/java/dev/krotname/networkchat/AccountStoreTest.java

@@ -54,4 +54,22 @@ void rejectsRowsWithMissingColumnsOrValues() throws Exception {
     assertThrows(IllegalArgumentException.class, () -> AccountStore.load(missingColumns));
     assertThrows(IllegalArgumentException.class, () -> AccountStore.load(missingValues));
   }
+
+  @Test
+  void rejectsDuplicateOrInvalidUserNames() throws Exception {
+    Path duplicateUsers = tempDir.resolve("duplicate-users.csv");
+    Path invalidUser = tempDir.resolve("invalid-user.csv");
+    Files.writeString(
+        duplicateUsers,
+        "alice,USER,salt," + AccountStore.hashToken("salt", "secret") + "\n"
+            + "alice,ADMIN,other," + AccountStore.hashToken("other", "secret") + "\n",
+        StandardCharsets.UTF_8);
+    Files.writeString(
+        invalidUser,
+        "al,USER,salt," + AccountStore.hashToken("salt", "secret") + "\n",
+        StandardCharsets.UTF_8);
+
+    assertThrows(IllegalArgumentException.class, () -> AccountStore.load(duplicateUsers));
+    assertThrows(IllegalArgumentException.class, () -> AccountStore.load(invalidUser));
+  }
 }