Feat/breached password check - #8
Merged
Merged
Conversation
Ships zero implementations — checking this necessarily means an outbound network call (e.g. to HIBP's k-anonymity API), and the engine never talks to the internet on its own initiative anywhere else, so it doesn't start here. The consuming app implements this against HIBP, a self-hosted breached-password list, or anything else that fits.
Both take an optional breachChecker now. A confirmed breach rejects the password with ErrPasswordBreached (and records a password_breach_rejected audit event); a checker error fails open — logged, not treated as a rejection, since blocking account creation on a third-party API's uptime is a worse tradeoff than the security gained. On ChangePassword specifically, the check runs AFTER the current- password verification — a caller can't probe the new password's breach status without already proving they own the account. New Config.BreachedPasswordChecker field (optional). Public facade signatures for SignUp/ChangePassword are unchanged. Updates existing signup_test.go/account_test.go call sites for the new param.
Covers: a confirmed breach rejecting SignUp/ChangePassword, a checker error failing open, the current-password check running before the new-password breach check on ChangePassword (and the checker never being called in that case), and the rejection being recorded as a password_breach_rejected audit event.
Runnable end-to-end check with no database dependency: go run ./cmd/smoketest/breached-password-check. Uses two tiny local fake checkers (not a real HIBP client — see the testing doc for why) to demonstrate the actual contract: a confirmed breach rejects the password, a checker error fails open, and a clean password with no breach succeeds. (The 'checker skipped when policy already rejects' case is covered once password policy exists — see the follow-on branch.)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.