From 0c85fb67d3b68bf83010f3f7da011f61ee160163 Mon Sep 17 00:00:00 2001 From: MechaCat02 Date: Sun, 7 Jun 2026 10:26:37 +0200 Subject: [PATCH] =?UTF-8?q?chore(v1.1.9):=20F4=20=E2=80=94=20dedup=20TIMIN?= =?UTF-8?q?G=5FFLAT=5FDUMMY=5FHASH?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replace the inline copy of the Argon2id PHC dummy hash in crates/manager-core/src/auth_api.rs::login with a reference to the shared TIMING_FLAT_DUMMY_HASH constant in crates/manager-core/src/auth.rs (added in v1.1.8 but not yet adopted by the login path). Verification: `grep -rn 'argon2id\$v=19\$m=19456,t=2,p=1\$dGltaW5n' crates/` returns exactly one hit — the const declaration in auth.rs. Co-Authored-By: Claude Opus 4.7 (1M context) --- crates/manager-core/src/auth_api.rs | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/crates/manager-core/src/auth_api.rs b/crates/manager-core/src/auth_api.rs index 6fd8a76..2223c58 100644 --- a/crates/manager-core/src/auth_api.rs +++ b/crates/manager-core/src/auth_api.rs @@ -73,10 +73,9 @@ pub struct AdminUserDto { async fn login(State(state): State, Json(input): Json) -> Response { // Always perform a verify, even on missing/inactive users, to flatten - // timing and prevent username enumeration. The dummy hash is a real - // Argon2id PHC string for "x" — the verify will simply fail. - const DUMMY_HASH: &str = "$argon2id$v=19$m=19456,t=2,p=1$dGltaW5nLWZsYXR0ZW4$Ux6dgPqgX1Mhg5fRgIeKZF3MWdYqJplKEz/cKLcSdks"; - + // timing and prevent username enumeration. The dummy hash is the + // shared `TIMING_FLAT_DUMMY_HASH` constant from `auth.rs` so the + // single PHC value lives in exactly one place (v1.1.9 F4 dedup). let creds = match state .users .get_credentials_by_username(&input.username) @@ -93,7 +92,11 @@ async fn login(State(state): State, Json(input): Json) // canonical row used in the response DTO. let (stored_hash, user_id, is_active) = match creds { Some(c) => (c.password_hash, Some(c.id), c.is_active), - None => (DUMMY_HASH.to_string(), None, false), + None => ( + crate::auth::TIMING_FLAT_DUMMY_HASH.to_string(), + None, + false, + ), }; let password_ok = verify_password(&stored_hash, &input.password);