fix: generate passwords for Gitea user creation

Author: wangeguo

.env.example

@@ -33,3 +33,6 @@ NAMESPACE=stackclass-local
 
 # Docker registry endpoint.
 DOCKER_REGISTRY_ENDPOINT=docker.stackclass.local
+
+# Secret used for hashing user passwords.
+AUTH_SECRET=JXQ2W8vY9zP1sR5tK7mN3bL6cV4dF0gH

Cargo.lock

@@ -7,7 +7,7 @@ resolver = "2"
 [package]
 name = "backend"
 description = "Backend API and services for StackClass"
-version = "0.31.1"
+version = "0.32.0"
 edition = "2024"
 
 default-run = "stackclass-server"
@@ -62,3 +62,4 @@ utoipa = { version = "5.4.0", features = ["axum_extras", "uuid", "chrono", "macr
 utoipa-swagger-ui = { version = "9.0.2", features = ["axum", "reqwest"] }
 uuid = { version = "1.18.0", features = ["serde", "v4", "fast-rng", "macro-diagnostics"] }
 walkdir = "2.5.0"
+bcrypt = "0.17.0"

Cargo.toml

@@ -51,6 +51,7 @@ Options:
   --git-committer-email       Git committer email
   --namespace                 Kubernetes namespace where StackClass is running
   --docker-registry-endpoint  Docker registry endpoint
+  --auth-secret               Secret used for hashing user passwords
   --help                      Print help
 ```
 

README.md

@@ -6,7 +6,7 @@
     "license": {
       "name": ""
     },
-    "version": "0.31.1"
+    "version": "0.32.0"
   },
   "paths": {
     "/v1/courses": {

openapi.json

@@ -81,4 +81,8 @@ pub struct Config {
     /// Docker registry endpoint.
     #[clap(long, env)]
     pub docker_registry_endpoint: String,
+
+    /// Secret used for hashing user passwords.
+    #[clap(long, env)]
+    pub auth_secret: String,
 }

src/config.rs

@@ -74,6 +74,9 @@ pub enum ApiError {
 
     #[error("Serialization Error: {0}")]
     SerializationError(#[source] serde_json::Error),
+
+    #[error("Bcrypt Error: {0}")]
+    BcryptError(#[from] bcrypt::BcryptError),
 }
 
 impl From<sqlx::Error> for ApiError {
@@ -105,6 +108,7 @@ impl From<&ApiError> for StatusCode {
             ApiError::GitError(_) => StatusCode::INTERNAL_SERVER_ERROR,
             ApiError::KubernetesError(_) => StatusCode::INTERNAL_SERVER_ERROR,
             ApiError::SerializationError(_) => StatusCode::INTERNAL_SERVER_ERROR,
+            ApiError::BcryptError(_) => StatusCode::INTERNAL_SERVER_ERROR,
         }
     }
 }

src/errors.rs

@@ -231,10 +231,17 @@ impl RepoService {
     }
 
     /// Gets a user by username, or creates the user if they don't exist.
-    async fn fetch_user(&self, username: &str, req: CreateUserRequest) -> Result<User> {
+    async fn fetch_user(&self, username: &str, mut req: CreateUserRequest) -> Result<User> {
         match self.ctx.git.get_user(username).await {
             Ok(user) => Ok(user),
-            Err(ClientError::NotFound) => Ok(self.ctx.git.create_user(req).await?),
+            Err(ClientError::NotFound) => {
+                // Generate a password using email + auth_secret
+                let password = format!("{}{}", req.email, self.ctx.config.auth_secret);
+                let hashed_password = bcrypt::hash(password, bcrypt::DEFAULT_COST)?;
+                req.password = Some(hashed_password);
+
+                Ok(self.ctx.git.create_user(req).await?)
+            }
             Err(e) => Err(e.into()),
         }
     }