Production Login page passcode updates

app/infrastructure/security.py

@@ -29,15 +29,19 @@ import logging
 import secrets
 import time
 from dataclasses import dataclass, field
-from typing import Dict, List, Optional
+from typing import Dict, List, Optional, Tuple
 
 import jwt
 
 from app.infrastructure.settings import (
     API_KEYS,
+    AUTH_ADMIN_PASSWORD_HASH,
+    AUTH_ADMIN_USERNAME,
+    AUTH_ALLOW_ANY_LOGIN,
     AUTH_ENABLED,
     AUTH_SECRET_KEY,
     AUTH_TOKEN_TTL_MINUTES,
+    config_source,
 )
 
 logger = logging.getLogger(__name__)
@@ -117,6 +121,110 @@ def hash_password(password: str, *, iterations: int = _PBKDF2_ITERATIONS) -> str
     )
 
 
+def _parse_encoded_hash(encoded: str) -> Optional[Tuple[bytes, bytes, int]]:
+    """
+    Split an encoded digest into ``(salt, digest, iterations)``, or None if it
+    is not one.
+
+    One parser, three callers. `verify_password` needs the parts, while
+    `hash_is_wellformed` and `describe_password_hash` need only the verdict -
+    and a login failing because the *configured* hash is corrupt is a different
+    incident from a wrong password, so the two must agree on what "corrupt"
+    means. Two copies of this parse would eventually disagree.
+
+    Values arrive here straight from the environment, so a hash pasted into a
+    deployment platform's form field as "pbkdf2_sha256$..." is unwrapped rather
+    than rejected: the surrounding quotes are almost never intended as part of
+    the secret, and the failure they cause otherwise is a silent 401.
+    """
+    if not encoded:
+        return None
+    encoded = encoded.strip().strip("'\"")
+    try:
+        prefix, raw_iterations, raw_salt, raw_digest = encoded.split("$")
+        if prefix != _PBKDF2_PREFIX:
+            return None
+        # validate=True so junk is rejected rather than silently discarded:
+        # b64decode's default drops non-alphabet characters, which would let a
+        # subtly corrupted hash decode to the wrong bytes and fail as a "wrong
+        # password" instead of as the configuration error it is.
+        # binascii.Error subclasses ValueError, so it is caught below.
+        salt = base64.b64decode(raw_salt, validate=True)
+        digest = base64.b64decode(raw_digest, validate=True)
+        iterations = int(raw_iterations)
+    except (ValueError, TypeError):
+        return None
+    # A structurally valid string that decodes to nothing is still unusable,
+    # and PBKDF2 rejects a non-positive iteration count by raising.
+    if not salt or not digest or iterations < 1:
+        return None
+    return salt, digest, iterations
+
+
+def hash_is_wellformed(encoded: str) -> bool:
+    """Whether a configured digest can be checked against at all.
+
+    Distinct from "does the password match": this asks whether the credential
+    *store* is usable, which is a deployment fault rather than a sign-in one.
+    """
+    return _parse_encoded_hash(encoded) is not None
+
+
+def password_hash_fingerprint(encoded: str) -> str:
+    """
+    A short, non-reversible identifier for a configured digest.
+
+    Safe to log and to publish: it is a truncated SHA-256 of the *encoded
+    digest*, and that digest already embeds a 16-byte random salt, so this says
+    which credential is loaded without saying anything about the password
+    behind it. It exists so a running deployment can be compared against the
+    config it was supposed to have been built from - the failure this project
+    actually hit - without moving a secret in order to do the comparison.
+    """
+    if not encoded:
+        return ""
+    return hashlib.sha256(encoded.strip().strip("'\"").encode("utf-8")).hexdigest()[:12]
+
+
+def describe_password_hash(encoded: str) -> Dict[str, object]:
+    """A loggable/publishable summary of a configured digest. Never its bytes."""
+    parsed = _parse_encoded_hash(encoded)
+    return {
+        "valid": parsed is not None,
+        "algorithm": _PBKDF2_PREFIX if parsed is not None else None,
+        "iterations": parsed[2] if parsed is not None else None,
+        "fingerprint": password_hash_fingerprint(encoded),
+    }
+
+
+def auth_config_summary() -> Dict[str, object]:
+    """
+    The effective authentication configuration, in a form safe to both log and
+    publish. Contains no password and no hash - only the fingerprint.
+
+    This is deliberately one function with two callers (the startup log in
+    app/main.py and GET /api/health), because its entire purpose is letting two
+    *deployments* be compared, and that only works if both report the same
+    fields computed the same way.
+
+    `*_source` is the field that earns this its keep. A value of "process-env"
+    means the container's own environment supplied it and the .env file baked
+    into the image was ignored - which is invisible from anywhere else, and is
+    precisely how a corrected credential can keep failing after a redeploy.
+    """
+    described = describe_password_hash(AUTH_ADMIN_PASSWORD_HASH)
+    return {
+        "enabled": AUTH_ENABLED,
+        "allow_any_login": AUTH_ALLOW_ANY_LOGIN,
+        "admin_username": AUTH_ADMIN_USERNAME,
+        "password_hash_valid": bool(described["valid"]),
+        "password_hash_iterations": described["iterations"],
+        "password_hash_fingerprint": described["fingerprint"],
+        "admin_username_source": config_source("AUTH_ADMIN_USERNAME"),
+        "password_hash_source": config_source("AUTH_ADMIN_PASSWORD_HASH"),
+    }
+
+
 def verify_password(password: str, encoded: str) -> bool:
     """
     Check a password against an encoded digest.
@@ -127,21 +235,15 @@ def verify_password(password: str, encoded: str) -> bool:
     """
     if not encoded:
         return False
-    encoded = encoded.strip().strip("'\"")
-    try:
-        prefix, raw_iterations, raw_salt, raw_digest = encoded.split("$")
-        if prefix != _PBKDF2_PREFIX:
-            return False
-        expected = base64.b64decode(raw_salt), base64.b64decode(raw_digest)
-        salt, digest = expected
-        iterations = int(raw_iterations)
-    except (ValueError, TypeError):
+    parsed = _parse_encoded_hash(encoded)
+    if parsed is None:
         logger.error(
             "A configured password hash is malformed and cannot be used. Regenerate "
             "it with: python scripts/make_auth_secrets.py"
         )
         return False
 
+    salt, digest, iterations = parsed
     candidate = hashlib.pbkdf2_hmac("sha256", password.encode("utf-8"), salt, iterations)
     return hmac.compare_digest(candidate, digest)