Skip to main content

authenticate_connect

powdb_server::handler

Function authenticate_connect 

Source 
pub fn authenticate_connect(
    users: &UserStore,
    expected_password: Option<&str>,
    username: Option<&str>,
    password: Option<&str>,
) -> AuthOutcome
Expand description

Pure, exhaustively-testable authentication decision for a CONNECT handshake.

Policy:

  • If users has at least one user, multi-user auth is in force: a username is required and users.authenticate(username, password) must succeed. Unknown user, wrong password, or a missing username all reject with an indistinguishable Rejected (no user-vs-password leak).
  • If users is empty, fall back verbatim to the legacy behavior: when expected_password is Some, the candidate must match it (constant time); when None, no auth is required (open). The username is ignored here so that a new client talking to a shared-password server still connects.