src-advisory/SRCmail
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add passwordHashFile to admin.json

Browse Source
This commit is contained in:
Pascal Dietrich
2026-06-02 23:48:03 +02:00
committed by Linus Rath
parent 9953557af0
commit 22da11514b
3 changed files with 17 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/admin/migrate.ts
+1 -1
View File
@@ -98,7 +98,7 @@ async function migrateAdminJson(): Promise<boolean> {
lastLogin: data.lastLogin ?? null, lastLogin: data.lastLogin ?? null,
passwordChangedAt: data.passwordChangedAt ?? now, passwordChangedAt: data.passwordChangedAt ?? now,
}; };
const configData: AdminConfigData = { passwordHash: data.passwordHash }; const configData: AdminConfigData = { passwordHash: data.passwordHash, passwordHashFile: undefined };
await ensureStateDir(); await ensureStateDir();
const statePath = getStatePath('admin-state.json'); const statePath = getStatePath('admin-state.json');
lib/admin/password.ts
+14 -4
View File
@@ -9,6 +9,7 @@ import {
assertWritable, assertWritable,
} from './paths'; } from './paths';
import type { AdminConfigData, AdminStateData } from './types'; import type { AdminConfigData, AdminStateData } from './types';
import { readFileEnv } from '../read-file-env';
const SCRYPT_KEYLEN = 64; const SCRYPT_KEYLEN = 64;
const SCRYPT_COST = 16384; // 2^14 const SCRYPT_COST = 16384; // 2^14
@@ -146,7 +147,7 @@ export async function initAdminPassword(): Promise<boolean> {
} }
const hash = isHashed(envPassword) ? envPassword : await hashPassword(envPassword); const hash = isHashed(envPassword) ? envPassword : await hashPassword(envPassword);
cachedConfig = { passwordHash: hash }; cachedConfig = { passwordHash: hash, passwordHashFile: undefined };
cachedState = freshState(); cachedState = freshState();
await writeConfigData(cachedConfig); await writeConfigData(cachedConfig);
await writeStateData(cachedState); await writeStateData(cachedState);
@@ -165,7 +166,16 @@ export async function initAdminPassword(): Promise<boolean> {
export async function verifyAdminPassword(password: string): Promise<boolean> { export async function verifyAdminPassword(password: string): Promise<boolean> {
if (!cachedConfig) cachedConfig = await readConfigData(); if (!cachedConfig) cachedConfig = await readConfigData();
if (!cachedConfig) return false; if (!cachedConfig) return false;
return verifyPassword(password, cachedConfig.passwordHash); if (cachedConfig.passwordHash) {
return verifyPassword(password, cachedConfig.passwordHash);
} else if (cachedConfig.passwordHashFile) {
let passwordHash = readFileEnv(cachedConfig.passwordHashFile);
if (passwordHash) {
return verifyPassword(password, passwordHash);
}
}
logger.error('The admin password hash could neither be retrieved from passwordHash nor from passwordHashFile in admin.json');
return false;
} }
/** /**
@@ -176,7 +186,7 @@ export async function changeAdminPassword(currentPassword: string, newPassword:
if (!valid) return false; if (!valid) return false;
const hash = await hashPassword(newPassword); const hash = await hashPassword(newPassword);
cachedConfig = { passwordHash: hash }; cachedConfig = { passwordHash: hash, passwordHashFile: undefined };
await writeConfigData(cachedConfig); await writeConfigData(cachedConfig);
cachedState = { cachedState = {
@@ -205,7 +215,7 @@ export async function setInitialAdminPassword(
const existing = await readConfigData(); const existing = await readConfigData();
if (existing && !options.allowOverwrite) return false; if (existing && !options.allowOverwrite) return false;
const hash = await hashPassword(newPassword); const hash = await hashPassword(newPassword);
cachedConfig = { passwordHash: hash }; cachedConfig = { passwordHash: hash, passwordHashFile: undefined };
cachedState = freshState(); cachedState = freshState();
await writeConfigData(cachedConfig); await writeConfigData(cachedConfig);
await writeStateData(cachedState); await writeStateData(cachedState);
lib/admin/types.ts
+2 -1
View File
@@ -6,7 +6,8 @@
* is config; mutable timestamps live in AdminStateData. * is config; mutable timestamps live in AdminStateData.
*/ */
export interface AdminConfigData { export interface AdminConfigData {
passwordHash: string; passwordHash: string | undefined;
passwordHashFile: string | undefined;
} }
/** /**