feat: accept caller-provided user passwords

Author: pratik50

src/handlers/http/modal/query/querier_rbac.rs

@@ -53,11 +53,11 @@ pub async fn post_user(
     validator::user_role_name(&username)?;
     let mut metadata = get_metadata(&tenant_id).await?;
 
-    let user_roles: HashSet<String> = if let Some(body) = body {
-        serde_json::from_value(body.into_inner())?
-    } else {
-        HashSet::new()
-    };
+    let (user_roles, provided_password) = body
+        .map(|body| serde_json::from_value::<user::CreateUserRequest>(body.into_inner()))
+        .transpose()?
+        .map(user::CreateUserRequest::split_request)
+        .unwrap_or_default();
 
     let mut non_existent_roles = Vec::new();
     for role in &user_roles {
@@ -83,7 +83,15 @@ pub async fn post_user(
         return Err(RBACError::UserExists(username));
     }
 
-    let (mut user, password) = user::User::new_basic(username.clone(), tenant_id.clone(), false);
+    let (mut user, password) = match provided_password {
+        Some(password) => user::User::new_basic_with_provided_password(
+            username.clone(),
+            tenant_id.clone(),
+            false,
+            password,
+        )?,
+        None => user::User::new_basic(username.clone(), tenant_id.clone(), false),
+    };
     // add user roles
     user.roles.clone_from(&user_roles);
     metadata.users.push(user.clone());

src/handlers/http/rbac.rs

@@ -142,11 +142,11 @@ pub async fn post_user(
     validator::user_role_name(&userid)?;
     let mut metadata = get_metadata(&tenant_id).await?;
 
-    let user_roles: HashSet<String> = if let Some(body) = body {
-        serde_json::from_value(body.into_inner())?
-    } else {
-        HashSet::new()
-    };
+    let (user_roles, provided_password) = body
+        .map(|body| serde_json::from_value::<user::CreateUserRequest>(body.into_inner()))
+        .transpose()?
+        .map(user::CreateUserRequest::split_request)
+        .unwrap_or_default();
 
     let mut non_existent_roles = Vec::new();
     for role in &user_roles {
@@ -171,7 +171,15 @@ pub async fn post_user(
         return Err(RBACError::UserExists(userid));
     }
 
-    let (user, password) = user::User::new_basic(userid.clone(), tenant_id.clone(), false);
+    let (user, password) = match provided_password {
+        Some(password) => user::User::new_basic_with_provided_password(
+            userid.clone(),
+            tenant_id.clone(),
+            false,
+            password,
+        )?,
+        None => user::User::new_basic(userid.clone(), tenant_id.clone(), false),
+    };
 
     metadata.users.push(user.clone());
 
@@ -552,6 +560,8 @@ pub enum RBACError {
     ProtectedUser,
     #[error("Role is protected")]
     ProtectedRole,
+    #[error("providedPassword must be 8-256 bytes with no control characters")]
+    InvalidProvidedPassword,
     #[error("{0}")]
     SerdeError(#[from] serde_json::Error),
     #[error("Failed to connect to storage: {0}")]
@@ -590,6 +600,7 @@ impl actix_web::ResponseError for RBACError {
             Self::UserExists(_) => StatusCode::BAD_REQUEST,
             Self::ProtectedUser => StatusCode::BAD_REQUEST,
             Self::ProtectedRole => StatusCode::BAD_REQUEST,
+            Self::InvalidProvidedPassword => StatusCode::BAD_REQUEST,
             Self::UserDoesNotExist => StatusCode::NOT_FOUND,
             Self::SerdeError(_) => StatusCode::BAD_REQUEST,
             Self::ValidationError(_) => StatusCode::BAD_REQUEST,

src/rbac/user.rs

@@ -103,10 +103,65 @@ pub struct User {
     pub protected: bool,
 }
 
+/// Accept the UI's existing roles array or an object with a caller-supplied password.
+#[derive(Deserialize)]
+#[serde(untagged)]
+pub enum CreateUserRequest {
+    Roles(HashSet<String>),
+    Options(CreateUserOptions),
+}
+
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct CreateUserOptions {
+    #[serde(default)]
+    roles: HashSet<String>,
+    provided_password: Option<String>,
+}
+
+impl CreateUserRequest {
+    pub fn split_request(self) -> (HashSet<String>, Option<String>) {
+        match self {
+            Self::Roles(roles) => (roles, None),
+            Self::Options(options) => (options.roles, options.provided_password),
+        }
+    }
+}
+
 impl User {
     // create a new User and return self with password generated for said user.
     pub fn new_basic(username: String, tenant: Option<String>, protected: bool) -> (Self, String) {
-        let PassCode { password, hash } = Basic::gen_new_password();
+        Self::new_basic_with_passcode(username, tenant, protected, Basic::gen_new_password())
+    }
+
+    pub fn new_basic_with_provided_password(
+        username: String,
+        tenant: Option<String>,
+        protected: bool,
+        password: String,
+    ) -> Result<(Self, String), RBACError> {
+        if !(8..=256).contains(&password.len())
+            || password.trim() != password
+            || password.chars().any(char::is_control)
+        {
+            return Err(RBACError::InvalidProvidedPassword);
+        }
+
+        let hash = gen_hash(&password);
+        Ok(Self::new_basic_with_passcode(
+            username,
+            tenant,
+            protected,
+            PassCode { password, hash },
+        ))
+    }
+
+    fn new_basic_with_passcode(
+        username: String,
+        tenant: Option<String>,
+        protected: bool,
+        PassCode { password, hash }: PassCode,
+    ) -> (Self, String) {
         (
             Self {
                 ty: UserType::Native(Basic {
@@ -705,6 +760,49 @@ impl UserGroup {
     }
 }
 
+#[cfg(test)]
+mod provided_password_tests {
+    use super::*;
+
+    #[test]
+    fn accepts_legacy_roles_array_and_new_password_object() {
+        let legacy: CreateUserRequest = serde_json::from_str(r#"["reader"]"#).unwrap();
+        let (roles, password) = legacy.split_request();
+        assert!(roles.contains("reader"));
+        assert!(password.is_none());
+
+        let modern: CreateUserRequest = serde_json::from_str(
+            r#"{"roles":["reader"],"providedPassword":"a_valid_password_123"}"#,
+        )
+        .unwrap();
+        let (roles, password) = modern.split_request();
+        assert!(roles.contains("reader"));
+        assert_eq!(password.as_deref(), Some("a_valid_password_123"));
+
+        assert!(
+            serde_json::from_str::<CreateUserRequest>(r#"{"providedPasswrod":"typo"}"#).is_err()
+        );
+    }
+
+    #[test]
+    fn supplied_password_is_hashed_and_invalid_values_are_rejected() {
+        let (user, returned) =
+            User::new_basic_with_provided_password("alice".into(), None, false, "Pa$$w0rd".into())
+                .unwrap();
+        assert_eq!(returned, "Pa$$w0rd");
+        let UserType::Native(basic) = &user.ty else {
+            panic!("expected native user")
+        };
+        assert!(basic.verify_password(&returned));
+        assert!(!serde_json::to_string(&user).unwrap().contains(&returned));
+
+        assert!(matches!(
+            User::new_basic_with_provided_password("bob".into(), None, false, "short".into()),
+            Err(RBACError::InvalidProvidedPassword)
+        ));
+    }
+}
+
 #[cfg(test)]
 mod apikey_serde_tests {
     use super::*;