Skip to content

Added validation for seed password #3783

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
NathanDrake007 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Added validation for seed password #3783

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions cmd/hatchet-admin/cli/seed/seed.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,13 +10,19 @@ import (

"github.com/hatchet-dev/hatchet/pkg/config/database"
v1 "github.com/hatchet-dev/hatchet/pkg/repository"
"github.com/hatchet-dev/hatchet/pkg/validator"
)

func SeedDatabase(dc *database.Layer) error {
shouldSeedUser := dc.Seed.AdminEmail != "" && dc.Seed.AdminPassword != ""
var userID uuid.UUID

if shouldSeedUser {
// validate the password meets complexity requirements before hashing
if !validator.ValidatePassword(dc.Seed.AdminPassword) {
return fmt.Errorf("ADMIN_PASSWORD does not meet requirements: must be between 8 and 64 characters and contain at least one uppercase letter, one lowercase letter, and one number")
}
Comment on lines +22 to +24
Copy link
Copy Markdown
Collaborator

@gregfurman gregfurman May 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

While this is technically valid, I'm thinking that we should rather just return a DefaultValidator and pass in an anonymous struct with a password field i.e

validator := validator.NewDefaultValidator()
opts := struct{Password string `json:"password"`}{dc.Seed.AdminPassword}
// Or maybe even just use the already existing CreateUserOpts 👇 
// opts := repository.CreateUserOpts{Password: dc.Seed.AdminPassword} 
err := validator.Validate(opts)
// ...

That way we don't have to expose this function publicly and can just rely on our normal validation mechanism for this check.


// seed an example user
hashedPw, err := v1.HashPassword(dc.Seed.AdminPassword)

Expand Down
7 changes: 5 additions & 2 deletions pkg/validator/validator.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ func newValidator() *validator.Validate {
})

_ = validate.RegisterValidation("password", func(fl validator.FieldLevel) bool {
return passwordValidation(fl.Field().String())
return ValidatePassword(fl.Field().String())
})

_ = validate.RegisterValidation("uuid", func(fl validator.FieldLevel) bool {
Expand Down Expand Up @@ -89,7 +89,10 @@ func newValidator() *validator.Validate {
return validate
}

func passwordValidation(pw string) bool {
// ValidatePassword returns true if the password meets complexity requirements:
// between 8 and 64 characters, with at least one uppercase letter, one lowercase
// letter, and one number.
func ValidatePassword(pw string) bool {
pwLen := len(pw)
var hasNumber, hasUpper, hasLower bool

Expand Down
Loading