Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(auth): SASL SCRAM-SHA-256 support #1

Merged
merged 43 commits into from
Aug 8, 2024

Conversation

jgoux
Copy link

@jgoux jgoux commented Aug 6, 2024

What kind of change does this PR introduce?

feature

What is the current behavior?

pg-gateway doesn't support SASL authentication

What is the new behavior?

add support for SASL SCRAM-SHA-256 authentication method

packages/pg-gateway/src/auth/sasl/scram-sha-256.ts Outdated Show resolved Hide resolved
packages/pg-gateway/src/connection.ts Outdated Show resolved Hide resolved
packages/pg-gateway/src/connection.ts Outdated Show resolved Hide resolved
@jgoux jgoux marked this pull request as ready for review August 8, 2024 11:41
@jgoux
Copy link
Author

jgoux commented Aug 8, 2024

Sorry it took me so long and I refactored a lot of code. 😓

Basically I wanted the message flow to be clearer, so I used explicit steps and a few switches in the PostgresConnection class to route the messages to their appropriate handlers.

Here are the main changes:

  • Formatting and linting is setup with Biome
  • New scram-sha-256 auth flow support
  • All the authentication flows are contained in their own class, implementing the same interface AuthFlow.
  • The message buffering logic is now contained in its own class.
  • The TLS upgrade logic is contained in its own class
  • pglite example is turned into a pglite-auth example, where each auth flow is showcased.
  • The auth.mode option is now named auth.method, and each method is named after what can be put in pg_hba.conf
  • The validateCredentials option is now optional, we provide a default validation function, but it can be override if the user specifies the option.
  • Most auth flows require the user to define a callback to obtain the relevant password/hash/auth data:
    • password: getStoredPassword
    • md5: getPreHashedPassword
    • scram-sha-256: getScramSha256Data
    • trust: trustMeBro (ok this one is a joke and is not included 😂)

@jgoux jgoux requested a review from gregnr August 8, 2024 11:57
Copy link
Contributor

@gregnr gregnr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice work

examples/pglite-auth/package.json Outdated Show resolved Hide resolved
examples/pglite-auth/cert.ts Show resolved Hide resolved
packages/pg-gateway/src/auth/password.ts Outdated Show resolved Hide resolved
examples/pglite-auth/scram-sha-256.ts Show resolved Hide resolved
examples/pglite-auth/scram-sha-256.ts Outdated Show resolved Hide resolved
packages/pg-gateway/src/auth/index.ts Outdated Show resolved Hide resolved
packages/pg-gateway/src/auth/md5.ts Show resolved Hide resolved
packages/pg-gateway/src/auth/md5.ts Outdated Show resolved Hide resolved
jgoux and others added 9 commits August 8, 2024 20:52
Co-authored-by: Greg Richardson <greg.nmr@gmail.com>
Co-authored-by: Greg Richardson <greg.nmr@gmail.com>
Co-authored-by: Greg Richardson <greg.nmr@gmail.com>
Co-authored-by: Greg Richardson <greg.nmr@gmail.com>
Co-authored-by: Greg Richardson <greg.nmr@gmail.com>
@jgoux jgoux requested a review from gregnr August 8, 2024 19:18
@gregnr gregnr changed the base branch from main to next August 8, 2024 19:37
@gregnr gregnr merged commit 11c0833 into supabase-community:next Aug 8, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants