[servicecomb-service-center] branch master updated: [feat]RBAC帐号password加密算法支持自定义扩展 (#1365)

[littlecui]

This is an automated email from the ASF dual-hosted git repository.

littlecui pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/servicecomb-service-center.git


The following commit(s) were added to refs/heads/master by this push:
     new 0d4da67f [feat]RBAC帐号password加密算法支持自定义扩展 (#1365)
0d4da67f is described below

commit 0d4da67f6ba58c23c2fa4374ada4a12abc384491
Author: Sphairis <56192846+sphai...@users.noreply.github.com>
AuthorDate: Mon Dec 12 22:33:31 2022 +0800

    [feat]RBAC帐号password加密算法支持自定义扩展 (#1365)
    
    * extend password
    
    * fix error
    
    Co-authored-by: SphaIris <aaalixiaopei123>
---
 pkg/privacy/password.go      | 30 ++++++++++++++++++-----------
 pkg/privacy/password_test.go | 46 +++++++++++++++++---------------------------
 2 files changed, 37 insertions(+), 39 deletions(-)

diff --git a/pkg/privacy/password.go b/pkg/privacy/password.go
index b3c1fd5f..5c7936d7 100644
--- a/pkg/privacy/password.go
+++ b/pkg/privacy/password.go
@@ -21,7 +21,6 @@ import (
        "strings"
 
        scrypt "github.com/elithrar/simple-scrypt"
-       "github.com/go-chassis/foundation/stringutil"
        "golang.org/x/crypto/bcrypt"
 
        "github.com/apache/servicecomb-service-center/pkg/log"
@@ -33,23 +32,26 @@ const (
 
 var ScryptParams = scrypt.Params{N: 1024, R: 8, P: 1, SaltLen: 8, DKLen: 32}
 
-// HashPassword
-// Deprecated: use ScryptPassword, this is only for unit test to test 
compatible with old version
-func HashPassword(pwd string) (string, error) {
-       hash, err := bcrypt.GenerateFromPassword([]byte(pwd), 14)
-       if err != nil {
-               return "", err
-       }
-       return stringutil.Bytes2str(hash), nil
+// DefaultManager default manager
+var DefaultManager PasswordManager = &passwordManager{}
+
+type PasswordManager interface {
+       EncryptPassword(pwd string) (string, error)
+       CheckPassword(hashedPwd, pwd string) bool
 }
-func ScryptPassword(pwd string) (string, error) {
+
+type passwordManager struct {
+}
+
+func (p *passwordManager) EncryptPassword(pwd string) (string, error) {
        hash, err := scrypt.GenerateFromPassword([]byte(pwd), ScryptParams)
        if err != nil {
                return "", err
        }
        return string(hash), nil
 }
-func SamePassword(hashedPwd, pwd string) bool {
+
+func (p *passwordManager) CheckPassword(hashedPwd, pwd string) bool {
        if strings.HasPrefix(hashedPwd, algBcrypt) {
                err := bcrypt.CompareHashAndPassword([]byte(hashedPwd), 
[]byte(pwd))
                if err == bcrypt.ErrMismatchedHashAndPassword {
@@ -62,5 +64,11 @@ func SamePassword(hashedPwd, pwd string) bool {
                log.Warn("incorrect password attempts")
        }
        return err == nil
+}
 
+func ScryptPassword(pwd string) (string, error) {
+       return DefaultManager.EncryptPassword(pwd)
+}
+func SamePassword(hashedPwd, pwd string) bool {
+       return DefaultManager.CheckPassword(hashedPwd, pwd)
 }
diff --git a/pkg/privacy/password_test.go b/pkg/privacy/password_test.go
index c1e0fa20..e2a32514 100644
--- a/pkg/privacy/password_test.go
+++ b/pkg/privacy/password_test.go
@@ -23,42 +23,21 @@ import (
 
        "github.com/apache/servicecomb-service-center/pkg/privacy"
        scrypt "github.com/elithrar/simple-scrypt"
-       "github.com/go-chassis/foundation/stringutil"
        "github.com/stretchr/testify/assert"
        "golang.org/x/crypto/pbkdf2"
 )
 
-func TestHashPassword(t *testing.T) {
-       h, _ := privacy.HashPassword("test")
-       t.Log(h)
-       mac, _ := privacy.ScryptPassword("test")
-       t.Log(mac)
-
-       t.Run("given old hash result, should be compatible", func(t *testing.T) 
{
-               same := privacy.SamePassword(h, "test")
-               assert.True(t, same)
-       })
-
-       sameMac := privacy.SamePassword(mac, "test")
-       assert.True(t, sameMac)
+type mockPassword struct {
+}
 
-       t.Run("use different params for scrypt, should be compatible", func(t 
*testing.T) {
-               h2, _ := scrypt.GenerateFromPassword([]byte("test"), 
scrypt.Params{N: 1024, R: 8, P: 1, SaltLen: 8, DKLen: 32})
-               same := privacy.SamePassword(stringutil.Bytes2str(h2), "test")
-               assert.True(t, same)
-       })
+func (m mockPassword) EncryptPassword(pwd string) (string, error) {
+       return "encrypt password", nil
 }
-func BenchmarkBcrypt(b *testing.B) {
-       h, _ := privacy.HashPassword("test")
-       for i := 0; i < b.N; i++ {
-               same := privacy.SamePassword(h, "test")
-               if !same {
-                       panic("")
-               }
 
-       }
-       b.ReportAllocs()
+func (m mockPassword) CheckPassword(hashedPwd, pwd string) bool {
+       return true
 }
+
 func BenchmarkScrypt(b *testing.B) {
        h, _ := privacy.ScryptPassword("test")
        for i := 0; i < b.N; i++ {
@@ -117,3 +96,14 @@ func BenchmarkPbkdf2(b *testing.B) {
        })
        b.ReportAllocs()
 }
+func TestDefaultManager(t *testing.T) {
+       currentManager := privacy.DefaultManager
+       privacy.DefaultManager = &mockPassword{}
+       defer func() {
+               privacy.DefaultManager = currentManager
+       }()
+       password, _ := privacy.DefaultManager.EncryptPassword("")
+       assert.Equal(t, "encrypt password", password)
+       samePassword := privacy.DefaultManager.CheckPassword("", "")
+       assert.True(t, samePassword)
+}