access-list: Hash basic-auth passwords and redact API reads #18

Merged

eva merged 2 commits from blake/sec-accesslist-hash into develop

2026-09-14 13:41:00 +00:00

blake commented

2026-09-14 13:32:32 +00:00

Collaborator

What

bcrypt-hash access-list item passwords on create/update (skip already-hashed values)
Empty password on update keeps the existing hash for the same username
Proxy basic-auth compares via bcrypt; legacy plaintext rows still work until re-saved
GET list/detail/create/update responses redact password fields

Why

Admin API and DB previously exposed proxy basic-auth secrets in cleartext.

Test

go test ./internal/proxy/
Create access list with item password via API; GET returns empty password; basic auth still succeeds against hashed store
Legacy plaintext item still authenticates until next save

Related: #17

## What - bcrypt-hash access-list item passwords on create/update (skip already-hashed values) - Empty password on update keeps the existing hash for the same username - Proxy basic-auth compares via bcrypt; legacy plaintext rows still work until re-saved - GET list/detail/create/update responses redact password fields ## Why Admin API and DB previously exposed proxy basic-auth secrets in cleartext. ## Test - `go test ./internal/proxy/` - Create access list with item password via API; GET returns empty password; basic auth still succeeds against hashed store - Legacy plaintext item still authenticates until next save Related: https://git.s1d3sw1ped.com/s1d3sw1ped/helix-proxy/issues/17

blake added 1 commit

2026-09-14 13:32:32 +00:00

access-list: Hash basic-auth passwords and redact API reads

Format / gofmt (pull_request) Failing after 15s

Details

Format / gofmt (push) Failing after 15s

Details

CI / Build (push) Successful in 36s

Details

CI / Build (pull_request) Successful in 37s

Details

CI / Go Tests (pull_request) Successful in 1m20s

Details

CI / Go Tests (push) Failing after 1m20s

Details

61c7b5582c

Access-list item passwords were stored and returned in plaintext.
Hash on write with bcrypt, compare hashes in the proxy engine (with
legacy plaintext fallback), and omit passwords from admin GET JSON.

Ghost commented

2026-09-14 13:34:48 +00:00

Bouncing — CI not green.

Format / gofmt: failing on cmd/helix-proxy/api.go and internal/proxy/engine.go (import order / spacing; run gofmt -w on both).
CI / Go Tests (push): also failed on this head.

Security approach looks right (bcrypt + redact + legacy plaintext compare). Re-request review after gofmt + green CI.

Bouncing — CI not green. - Format / gofmt: failing on `cmd/helix-proxy/api.go` and `internal/proxy/engine.go` (import order / spacing; run `gofmt -w` on both). - CI / Go Tests (push): also failed on this head. Security approach looks right (bcrypt + redact + legacy plaintext compare). Re-request review after gofmt + green CI.

blake added 1 commit

2026-09-14 13:38:53 +00:00

format: gofmt api.go and engine.go

Format / gofmt (pull_request) Successful in 19s

Details

Format / gofmt (push) Successful in 20s

Details

CI / Build (push) Successful in 29s

Details

CI / Build (pull_request) Successful in 31s

Details

CI / Go Tests (push) Successful in 1m12s