feat(d5-daemon-auth): password auth, --password-file, --early-input

src/shared/config.c

@@ -1,5 +1,6 @@
 #include "config.h"
 #include "chmod.h"
+#include "credentials.h"
 #include "daemon_conf.h"
 #include "delay_updates.h"
 #include "delta.h"
@@ -38,6 +39,9 @@ static void config_set_defaults(Config* config) {
   config->transport = TRANSPORT_TCP;
   config->ssh_destination = NULL;
   config->module = NULL;
+  config->auth_user = NULL;
+  config->auth_password_hash = NULL;
+  config->password_file = NULL;
   config->fastsync_server_path = NULL;
   config->exclude_patterns = NULL;
   config->exclude_count = 0;
@@ -508,13 +512,15 @@ int config_parse_daemon_dest(Config* config) {
     return 0;
 
   const char* colon = strchr(dest, ':');
-  /* user@host::module names a daemon auth user, which this daemon version
-   * cannot verify: reject it rather than silently ignoring the user (auth is
-   * Wave B). */
+  /* user@host::module names a daemon auth user.  FastSync takes the username
+   * from the --password-file (its first user:password line) so there is a
+   * single source of truth; an @user that could contradict it is rejected
+   * with a pointer to the supported form. */
   if (memchr(dest, '@', (size_t)(colon - dest)) != NULL)
-    return daemon_dest_parse_error("daemon destination user@host::module is not supported: user "
-                                   "authentication is not implemented by this daemon version",
-                                   dest);
+    return daemon_dest_parse_error(
+        "daemon destination user@host::module is not supported: supply the username with "
+        "--password-file (first line: user:password)",
+        dest);
   const char* host_start = dest;
 
   const char* module_and_path = colon + 2;
@@ -609,6 +615,9 @@ void config_delete(Config* config) {
   free(config->receive_root_directory);
   free(config->ssh_destination);
   free(config->module);
+  free(config->auth_user);
+  free(config->auth_password_hash);
+  free(config->password_file);
   free(config->fastsync_server_path);
   for (int i = 0; i < config->exclude_count; i++)
     free(config->exclude_patterns[i]);
@@ -1088,6 +1097,48 @@ static bool receive_daemon_module(int fd, Config* c) {
   return true;
 }
 
+/* Daemon password credentials (Wave B, within protocol 2.15.0 -- see the
+ * PROTOCOL_VERSION note in config.h: this rides the Wave A trailing-string
+ * area, symmetric sender+receiver in every 2.15.0 build, so it is not a frame
+ * layout that needs its own bump).  A single presence int is followed, when
+ * set, by the username and the SHA-256 hex digest of the password.  The
+ * literal password never crosses the wire. */
+static bool send_daemon_auth(int fd, const Config* c) {
+  bool present = c->auth_user != NULL && c->auth_password_hash != NULL && c->auth_user[0] != '\0' &&
+                 c->auth_password_hash[0] != '\0';
+  if (!send_int(fd, present ? 1 : 0))
+    return false;
+  if (!present)
+    return true;
+  return send_str(fd, c->auth_user) && send_str(fd, c->auth_password_hash);
+}
+
+static bool receive_daemon_auth(int fd, Config* c) {
+  int present;
+  if (!receive_int(fd, &present) || !valid_wire_bool(present))
+    return false;
+  if (!present)
+    return true;
+  char* user = receive_str(fd);
+  char* hash = receive_str(fd);
+  if (!user || !hash) {
+    free(user);
+    free(hash);
+    return false;
+  }
+  size_t user_len = strlen(user);
+  bool valid = user_len > 0 && user_len <= CREDENTIAL_MAX_USER_LEN && credentials_hash_valid(hash);
+  if (!valid) {
+    free(user);
+    free(hash);
+    log_message(LOG_LEVEL_WARNING, "Daemon client sent malformed auth credentials");
+    return false;
+  }
+  c->auth_user = user;
+  c->auth_password_hash = hash;
+  return true;
+}
+
 bool config_send(int file_descriptor, const Config* config) {
   protocol_session_set_max_alloc(NULL, config->max_alloc);
   if (!send_core_fields(file_descriptor, config) || !send_delta_fields(file_descriptor, config) ||
@@ -1100,7 +1151,7 @@ bool config_send(int file_descriptor, const Config* config) {
       !send_metadata_times_options(file_descriptor, config) ||
       !send_symlink_trust_options(file_descriptor, config) ||
       !send_phase4_xattr_options(file_descriptor, config) ||
-      !send_daemon_module(file_descriptor, config))
+      !send_daemon_module(file_descriptor, config) || !send_daemon_auth(file_descriptor, config))
     return false;
   Status status;
   if (!receive_status(file_descriptor, &status))
@@ -1141,7 +1192,8 @@ Config* config_receive_with_validate(int file_descriptor, ConfigValidateFunc val
       !receive_metadata_times_options(file_descriptor, config) ||
       !receive_symlink_trust_options(file_descriptor, config) ||
       !receive_phase4_xattr_options(file_descriptor, config) ||
-      !receive_daemon_module(file_descriptor, config))
+      !receive_daemon_module(file_descriptor, config) ||
+      !receive_daemon_auth(file_descriptor, config))
     goto error;
   if (config->compress_choice[0] != '\0' && strcmp(config->compress_choice, "zstd") != 0 &&
       strcmp(config->compress_choice, "none") != 0) {

src/shared/config.h

@@ -95,6 +95,20 @@ typedef struct Config {
    * string so the daemon can look the module up in its own config and confine
    * the connection to the module's root (never a client-chosen root). */
   char* module;
+  /* Daemon password authentication (Wave B, protocol 2.15.0, WITHIN the Wave A
+   * frame layout -- see the PROTOCOL_VERSION note below for why this is not a
+   * bump).  Client-composed from a --password-file whose first meaningful line
+   * is `user:password`: the client sends ONLY the username and a SHA-256 hex
+   * digest of the password (auth_user + auth_password_hash), never the literal
+   * password.  Both are NULL when the client has no credentials to present; a
+   * module WITHOUT `auth users` stays open and the server ignores any
+   * credentials that do arrive (the client sends them opportunistically and
+   * the server decides). */
+  char* auth_user;
+  char* auth_password_hash;
+  /* Client-only path of --password-file (never crosses the wire; it is read to
+   * populate auth_user/auth_password_hash before connecting). */
+  char* password_file;
   char* fastsync_server_path;
   char** exclude_patterns;
   int exclude_count;
@@ -458,7 +472,14 @@ typedef struct Config {
  * is what keeps a 2.15 client and a 2.14 server from ever reaching that state.
  *
  * NOTE: daemon module-selection bump owned by Wave A (2.15.0); later daemon
- * waves (auth, motd) must not bump PROTOCOL_VERSION. */
+ * waves (auth, motd) must not bump PROTOCOL_VERSION.  Wave B (auth) adds the
+ * credential fields (auth_user/auth_password_hash) as further trailing
+ * config-frame strings AFTER the Wave A module string, with a presence int
+ * prefix.  This is not a new frame version: sender and receiver of a 2.15.0
+ * build always read and write the same full layout (the strict same-version
+ * handshake rejects any other version before a byte of the frame is parsed),
+ * so a peer can never desynchronize on the added tail.  The 2.15.0 release
+ * ships Wave A + Wave B together; the bump stays owned by Wave A. */
 #define PROTOCOL_VERSION "2.15.0"
 #define DEFAULT_CHUNK_SIZE (10 * 1024 * 1024)
 /* Upper bound on total basis-dir entries (rsync caps --link-dest at 20). */

src/shared/credentials.c

@@ -0,0 +1,440 @@
+#include "credentials.h"
+#include "utils.h"
+#include <ctype.h>
+#include <errno.h>
+#include <openssl/evp.h>
+#include <stdarg.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+/* One store entry: a username and its password's SHA-256 hex digest.  The
+ * plaintext password never appears here (and never on the daemon host). */
+typedef struct CredentialEntry {
+  char* user;
+  char* password_hex; /* CREDENTIAL_HASH_HEX_LEN lowercase hex chars */
+} CredentialEntry;
+
+struct CredentialStore {
+  CredentialEntry* entries;
+  int count;
+  int capacity;
+};
+
+static void set_error(char* err, size_t err_size, const char* fmt, ...) {
+  if (!err || err_size == 0)
+    return;
+  va_list args;
+  va_start(args, fmt);
+  vsnprintf(err, err_size, fmt, args);
+  va_end(args);
+}
+
+static bool is_comment_char(char c) {
+  return c == '#' || c == ';';
+}
+
+/* Trim leading/trailing ASCII space and tab in place; returns the new start. */
+static char* trim_space(char* s) {
+  while (*s == ' ' || *s == '\t')
+    s++;
+  size_t len = strlen(s);
+  while (len > 0 && (s[len - 1] == ' ' || s[len - 1] == '\t'))
+    s[--len] = '\0';
+  return s;
+}
+
+/* A username is a single token: non-empty, bounded, and free of whitespace and
+ * control characters.  The same rule is applied to store users, client-file
+ * users and the module `auth users` gate so an exact strcmp can never be
+ * confused by invisible characters. */
+static bool username_wellformed(const char* user) {
+  if (!user || *user == '\0')
+    return false;
+  size_t len = strlen(user);
+  if (len > CREDENTIAL_MAX_USER_LEN)
+    return false;
+  for (size_t i = 0; i < len; i++) {
+    unsigned char c = (unsigned char)user[i];
+    if (c <= 0x20 || c == 0x7f)
+      return false;
+  }
+  return true;
+}
+
+static int hex_value(char c) {
+  if (c >= '0' && c <= '9')
+    return c - '0';
+  if (c >= 'a' && c <= 'f')
+    return c - 'a' + 10;
+  return -1;
+}
+
+bool credentials_hash_valid(const char* hash_hex) {
+  if (!hash_hex)
+    return false;
+  for (int i = 0; i < CREDENTIAL_HASH_HEX_LEN; i++) {
+    if (hex_value(hash_hex[i]) < 0)
+      return false;
+  }
+  return hash_hex[CREDENTIAL_HASH_HEX_LEN] == '\0';
+}
+
+static bool append_entry(CredentialStore* store, const char* user, const char* password_hex) {
+  if (store->count == store->capacity) {
+    int new_capacity = store->capacity == 0 ? 8 : store->capacity * 2;
+    CredentialEntry* grown =
+        realloc(store->entries, (size_t)new_capacity * sizeof(CredentialEntry));
+    if (!grown)
+      return false;
+    store->entries = grown;
+    store->capacity = new_capacity;
+  }
+  store->entries[store->count].user = str_dup(user);
+  store->entries[store->count].password_hex = str_dup(password_hex);
+  if (!store->entries[store->count].user || !store->entries[store->count].password_hex) {
+    free(store->entries[store->count].user);
+    free(store->entries[store->count].password_hex);
+    store->entries[store->count].user = NULL;
+    store->entries[store->count].password_hex = NULL;
+    return false;
+  }
+  store->count++;
+  return true;
+}
+
+static int find_user(const CredentialStore* store, const char* user) {
+  for (int i = 0; i < store->count; i++) {
+    if (strcmp(store->entries[i].user, user) == 0)
+      return i;
+  }
+  return -1;
+}
+
+/* Parse one credential store file (user:SHA256HEX per line) into a fresh
+ * store.  Duplicate usernames WITHIN one file are an error (ambiguous).  A
+ * NULL path yields an empty store. */
+static CredentialStore* load_store_file(const char* path, char* err, size_t err_size) {
+  CredentialStore* store = calloc(1, sizeof(CredentialStore));
+  if (!store) {
+    set_error(err, err_size, "out of memory allocating credential store");
+    return NULL;
+  }
+  if (!path)
+    return store;
+
+  FILE* fp = fopen(path, "r");
+  if (!fp) {
+    set_error(err, err_size, "cannot open credential file '%s': %s", path, strerror(errno));
+    credentials_free(store);
+    return NULL;
+  }
+
+  int line_no = 0;
+  char line[CREDENTIAL_MAX_LINE + 2];
+  bool ok = true;
+
+  while (fgets(line, sizeof(line), fp)) {
+    line_no++;
+    size_t len = strlen(line);
+    if (len == CREDENTIAL_MAX_LINE + 1 && line[len - 1] != '\n' && !feof(fp)) {
+      set_error(err, err_size, "credential file '%s' line %d exceeds the %d-byte limit", path,
+                line_no, CREDENTIAL_MAX_LINE);
+      ok = false;
+      break;
+    }
+    if (len > 0 && line[len - 1] == '\n')
+      line[--len] = '\0';
+    if (len > 0 && line[len - 1] == '\r')
+      line[--len] = '\0';
+
+    char* cursor = line;
+    while (*cursor == ' ' || *cursor == '\t')
+      cursor++;
+    if (*cursor == '\0' || is_comment_char(*cursor))
+      continue; /* blank or comment */
+
+    char* colon = strchr(cursor, ':');
+    if (!colon) {
+      set_error(err, err_size,
+                "credential file '%s' line %d: expected 'user:SHA256HEX' (no ':' found)", path,
+                line_no);
+      ok = false;
+      break;
+    }
+    *colon = '\0';
+    const char* user = trim_space(cursor);
+    const char* secret = trim_space(colon + 1);
+    if (!username_wellformed(user)) {
+      set_error(err, err_size,
+                "credential file '%s' line %d: invalid username (must be 1-%d "
+                "non-whitespace characters)",
+                path, line_no, CREDENTIAL_MAX_USER_LEN);
+      ok = false;
+      break;
+    }
+    if (!credentials_hash_valid(secret)) {
+      set_error(err, err_size,
+                "credential file '%s' line %d: secret for user '%s' must be %d "
+                "lowercase hex characters (the SHA-256 of the password)",
+                path, line_no, user, CREDENTIAL_HASH_HEX_LEN);
+      ok = false;
+      break;
+    }
+    if (find_user(store, user) >= 0) {
+      set_error(err, err_size, "credential file '%s' line %d: duplicate entry for user '%.*s'",
+                path, line_no, (int)strlen(user), user);
+      ok = false;
+      break;
+    }
+    if (!append_entry(store, user, secret)) {
+      set_error(err, err_size, "out of memory reading credential file '%s'", path);
+      ok = false;
+      break;
+    }
+  }
+
+  if (ok && ferror(fp)) {
+    set_error(err, err_size, "error reading credential file '%s': %s", path, strerror(errno));
+    ok = false;
+  }
+  fclose(fp);
+  if (!ok) {
+    credentials_free(store);
+    return NULL;
+  }
+  return store;
+}
+
+CredentialStore* credentials_load(const char* password_file, const char* early_input_file,
+                                  char* err, size_t err_size) {
+  if (err && err_size)
+    err[0] = '\0';
+  CredentialStore* store = load_store_file(password_file, err, err_size);
+  if (!store)
+    return NULL;
+  if (!early_input_file)
+    return store;
+
+  CredentialStore* early = load_store_file(early_input_file, err, err_size);
+  if (!early) {
+    credentials_free(store);
+    return NULL;
+  }
+  /* Layer early input over the password file: same secret dedupes, a differing
+   * secret for the same user is ambiguous and fails closed. */
+  for (int i = 0; i < early->count; i++) {
+    int existing = find_user(store, early->entries[i].user);
+    if (existing >= 0) {
+      if (strcmp(store->entries[existing].password_hex, early->entries[i].password_hex) != 0) {
+        set_error(err, err_size,
+                  "credential file '%s' and early-input file '%s' disagree on the secret for "
+                  "user '%s'",
+                  password_file, early_input_file, early->entries[i].user);
+        credentials_free(early);
+        credentials_free(store);
+        return NULL;
+      }
+      continue; /* identical; nothing to merge */
+    }
+    if (!append_entry(store, early->entries[i].user, early->entries[i].password_hex)) {
+      set_error(err, err_size, "out of memory merging early-input credentials");
+      credentials_free(early);
+      credentials_free(store);
+      return NULL;
+    }
+  }
+  credentials_free(early);
+  return store;
+}
+
+void credentials_free(CredentialStore* store) {
+  if (!store)
+    return;
+  for (int i = 0; i < store->count; i++) {
+    free(store->entries[i].user);
+    free(store->entries[i].password_hex);
+  }
+  free(store->entries);
+  free(store);
+}
+
+int credentials_store_size(const CredentialStore* store) {
+  return store ? store->count : 0;
+}
+
+bool credentials_store_has(const CredentialStore* store, const char* user) {
+  return store && find_user(store, user) >= 0;
+}
+
+bool credentials_secure_equal(const char* a, const char* b, size_t len) {
+  unsigned char diff = 0;
+  for (size_t i = 0; i < len; i++)
+    diff |= (unsigned char)a[i] ^ (unsigned char)b[i];
+  return diff == 0;
+}
+
+bool credentials_hash_password(const char* password, char* out_hex) {
+  if (!password || !out_hex)
+    return false;
+  uint8_t digest[EVP_MAX_MD_SIZE];
+  unsigned int digest_len = 0;
+  if (EVP_Digest(password, strlen(password), digest, &digest_len, EVP_sha256(), NULL) != 1)
+    return false;
+  if (digest_len != 32)
+    return false;
+  static const char hex[] = "0123456789abcdef";
+  for (unsigned int i = 0; i < digest_len; i++) {
+    out_hex[2 * i] = hex[digest[i] >> 4];
+    out_hex[2 * i + 1] = hex[digest[i] & 0x0f];
+  }
+  out_hex[2 * digest_len] = '\0';
+  return true;
+}
+
+int credentials_read_secret_file(const char* path, char** user_out, char** password_out, char* err,
+                                 size_t err_size) {
+  if (user_out)
+    *user_out = NULL;
+  if (password_out)
+    *password_out = NULL;
+  if (err && err_size)
+    err[0] = '\0';
+  if (!path) {
+    set_error(err, err_size, "no --password-file path");
+    return -1;
+  }
+  FILE* fp = fopen(path, "r");
+  if (!fp) {
+    set_error(err, err_size, "cannot open password file '%s': %s", path, strerror(errno));
+    return -1;
+  }
+
+  int line_no = 0;
+  char line[CREDENTIAL_MAX_LINE + 2];
+  int result = -1;
+
+  while (fgets(line, sizeof(line), fp)) {
+    line_no++;
+    size_t len = strlen(line);
+    if (len == CREDENTIAL_MAX_LINE + 1 && line[len - 1] != '\n' && !feof(fp)) {
+      set_error(err, err_size, "password file '%s' line %d exceeds the %d-byte limit", path,
+                line_no, CREDENTIAL_MAX_LINE);
+      goto done;
+    }
+    if (len > 0 && line[len - 1] == '\n')
+      line[--len] = '\0';
+    if (len > 0 && line[len - 1] == '\r')
+      line[--len] = '\0';
+
+    char* cursor = line;
+    while (*cursor == ' ' || *cursor == '\t')
+      cursor++;
+    if (*cursor == '\0' || is_comment_char(*cursor))
+      continue; /* skip blank/comment lines; the first real line is the secret */
+
+    char* colon = strchr(cursor, ':');
+    if (!colon) {
+      set_error(err, err_size,
+                "password file '%s' line %d: expected 'user:password' (no ':' found)", path,
+                line_no);
+      goto done;
+    }
+    *colon = '\0';
+    const char* user = trim_space(cursor);
+    const char* password = trim_space(colon + 1);
+    if (!username_wellformed(user)) {
+      set_error(err, err_size,
+                "password file '%s' line %d: invalid username (must be 1-%d "
+                "non-whitespace characters)",
+                path, line_no, CREDENTIAL_MAX_USER_LEN);
+      goto done;
+    }
+    if (*password == '\0') {
+      set_error(err, err_size, "password file '%s' line %d: empty password", path, line_no);
+      goto done;
+    }
+    if (strlen(password) > CREDENTIAL_MAX_PASSWORD_LEN) {
+      set_error(err, err_size, "password file '%s' line %d: password exceeds %d characters", path,
+                line_no, CREDENTIAL_MAX_PASSWORD_LEN);
+      goto done;
+    }
+    char* user_dup = str_dup(user);
+    char* password_dup = str_dup(password);
+    if (!user_dup || !password_dup) {
+      free(user_dup);
+      free(password_dup);
+      set_error(err, err_size, "out of memory reading password file '%s'", path);
+      goto done;
+    }
+    if (user_out)
+      *user_out = user_dup;
+    else
+      free(user_dup);
+    if (password_out)
+      *password_out = password_dup;
+    else
+      free(password_dup);
+    result = 0;
+    goto done;
+  }
+
+  if (ferror(fp)) {
+    set_error(err, err_size, "error reading password file '%s': %s", path, strerror(errno));
+    goto done;
+  }
+  /* Reached end of file with no meaningful line: the file is empty (or only
+   * comments), which the client policy rejects. */
+  set_error(err, err_size, "password file '%s' contains no 'user:password' line", path);
+
+done:
+  fclose(fp);
+  return result;
+}
+
+void credentials_burn(char* secret, size_t len) {
+  if (!secret)
+    return;
+  volatile char* p = (volatile char*)secret;
+  for (size_t i = 0; i < len; i++)
+    p[i] = '\0';
+}
+
+/* Fixed 64-lowercase-hex dummy used for a constant-time digest comparison when
+ * the presented user is unknown, so the verify path takes the same time for an
+ * unknown user and a wrong password.  Value chosen arbitrarily; it can never
+ * authenticate because a real store entry is preferred when it exists. */
+static const char k_dummy_hash[CREDENTIAL_HASH_HEX_LEN + 1] =
+    "0000000000000000000000000000000000000000000000000000000000000000";
+
+bool credentials_verify(const CredentialStore* store, const char* user,
+                        const char* presented_hash_hex) {
+  if (!store || !user || !presented_hash_hex || !credentials_hash_valid(presented_hash_hex))
+    return false;
+  const char* stored = k_dummy_hash;
+  for (int i = 0; i < store->count; i++) {
+    if (strcmp(store->entries[i].user, user) == 0)
+      stored = store->entries[i].password_hex;
+  }
+  return credentials_secure_equal(presented_hash_hex, stored, CREDENTIAL_HASH_HEX_LEN);
+}
+
+bool credentials_gate_allows(const CredentialStore* store, const char* const* module_users,
+                             int module_user_count, const char* presented_user,
+                             const char* presented_hash_hex) {
+  if (!store || module_user_count < 0)
+    return false; /* fail closed: an auth-required module without a store refuses */
+  if (!presented_user || !presented_hash_hex)
+    return false; /* no credentials presented */
+  bool on_module_list = false;
+  for (int i = 0; i < module_user_count; i++) {
+    if (module_users[i] && strcmp(module_users[i], presented_user) == 0) {
+      on_module_list = true;
+      break;
+    }
+  }
+  if (!on_module_list)
+    return false;
+  return credentials_verify(store, presented_user, presented_hash_hex);
+}

src/shared/credentials.h

@@ -0,0 +1,117 @@
+#ifndef CREDENTIALS_H
+#define CREDENTIALS_H
+
+#include <stdbool.h>
+#include <stddef.h>
+
+/* Daemon password authentication (Wave B).
+ *
+ * FastSync authenticates a daemon connection with a username plus a SHA-256
+ * hex digest of that username's password.  The digest is what crosses the
+ * wire: a challenge-less credential exchange, so the literal password is never
+ * transmitted (and never stored on the daemon host).  A module that declares
+ * `auth users` demands that the presented username is on its list AND that the
+ * presented digest matches the credential store's entry for that username.
+ * The digest comparison is constant-time; a module with `auth users` whose
+ * store is missing/misconfigured fails CLOSED (never falls open).
+ *
+ * Credential store format (server --password-file and --early-input): one
+ * `user:SHA256HEX` entry per line.  SHA256HEX is the lowercase hex SHA-256 of
+ * the user's password -- the exact value a FastSync client transmits.  Blank
+ * lines and lines whose first non-space character is '#' or ';' are comments.
+ * The parser is STRICT: a malformed line (no ':', an empty/whitespace user, a
+ * secret that is not 64 lowercase hex chars, a line longer than
+ * CREDENTIAL_MAX_LINE) fails the whole load so a typo can never silently
+ * change who may log in.
+ *
+ * Client --password-file format: the FIRST meaningful (non-comment, non-blank)
+ * line is `user:password`, holding the literal password.  The client hashes it
+ * and sends only the digest; the file should be mode 0600 and readable only by
+ * its owner.
+ */
+
+/* Lowercase hex length of a SHA-256 digest (what travels on the wire and what
+ * the server store holds). */
+#define CREDENTIAL_HASH_HEX_LEN 64
+/* Longest accepted credential-file line (excluding the trailing newline). */
+#define CREDENTIAL_MAX_LINE 4096
+/* Upper bound on a username in a credential file and on the wire.  Kept well
+ * below MAX_STRING_SIZE so a wire username can never exhaust anything. */
+#define CREDENTIAL_MAX_USER_LEN 256
+/* Upper bound on a client-file password (before hashing). */
+#define CREDENTIAL_MAX_PASSWORD_LEN 1024
+
+typedef struct CredentialStore CredentialStore;
+
+/* Load the daemon credential store.
+ *
+ * password_file and early_input_file are both NULL-or-path, matching the
+ * server's --password-file and --early-input options.  A file that cannot be
+ * opened or that fails the strict grammar is a hard error (err filled, NULL
+ * returned) -- the daemon fails CLOSED rather than serving an auth-required
+ * module with a partial store.  Both files may be NULL, which yields an empty
+ * store (every auth-required module then refuses connections).  When both are
+ * given, the --early-input file is layered over --password-file: a duplicate
+ * username whose secret matches is deduplicated; one whose secret differs is
+ * an error (the two sources disagree), never a silent pick.
+ *
+ * The returned store is heap-owned; free it with credentials_free. */
+CredentialStore* credentials_load(const char* password_file, const char* early_input_file,
+                                  char* err, size_t err_size);
+
+void credentials_free(CredentialStore* store);
+
+/* True when `hash_hex` is exactly CREDENTIAL_HASH_HEX_LEN lowercase hex digits
+ * (the wire/store digest form).  Used to reject a malformed presented digest
+ * before it reaches the comparison. */
+bool credentials_hash_valid(const char* hash_hex);
+
+/* Compute the lowercase hex SHA-256 of `password` into out_hex, which must
+ * hold at least CREDENTIAL_HASH_HEX_LEN + 1 bytes.  Returns false on a NULL
+ * password or a hashing failure.  The output is NUL-terminated. */
+bool credentials_hash_password(const char* password, char* out_hex);
+
+/* Read the CLIENT-side secret file: the first meaningful line is
+ * `user:password` (the literal password).  *user_out and *password_out are
+ * freshly allocated on success (password is plaintext -- the caller hashes it
+ * and then burns/frees it); both are NULL on error.  Returns 0 on success, -1
+ * on failure (err filled: the path is named, never the credential itself). */
+int credentials_read_secret_file(const char* path, char** user_out, char** password_out, char* err,
+                                 size_t err_size);
+
+/* Constant-time equality over exactly len bytes.  Returns true when the two
+ * buffers match.  No early exit: the whole length is always scanned, so a
+ * timing side-channel cannot reveal how many leading bytes matched. */
+bool credentials_secure_equal(const char* a, const char* b, size_t len);
+
+/* Overwrite secret[0..len) with zeros (best-effort wipe of a plaintext
+ * password that is about to be freed). */
+void credentials_burn(char* secret, size_t len);
+
+/* Verify a presented (user, digest) against the store.  Returns true only when
+ * the store holds an entry for `user` whose stored digest equals the presented
+ * one.  A NULL store, NULL user/digest, unknown user and wrong digest all
+ * return false.  The digest comparison runs over a fixed dummy whenever the
+ * user is absent, so "unknown user" and "wrong password" take the same time
+ * (no user-enumeration oracle in the comparison path). */
+bool credentials_verify(const CredentialStore* store, const char* user,
+                        const char* presented_hash_hex);
+
+/* The daemon's per-module auth decision, in one pure, unit-testable function.
+ * `module_users`/`module_user_count` are the module's `auth users` list; a
+ * module that declares auth users requires the presented user to be ON that
+ * list AND to verify against the store.  Returns false (fail closed) when the
+ * store is NULL, when no credential was presented, when the user is not on the
+ * module's list, or when verification fails.  This is the single decision the
+ * server_module_gate seam applies to an auth-required module. */
+bool credentials_gate_allows(const CredentialStore* store, const char* const* module_users,
+                             int module_user_count, const char* presented_user,
+                             const char* presented_hash_hex);
+
+/* Number of entries currently in the store (tests/introspection). */
+int credentials_store_size(const CredentialStore* store);
+
+/* Whether the store contains an entry for `user` (tests/introspection). */
+bool credentials_store_has(const CredentialStore* store, const char* user);
+
+#endif

src/shared/daemon_conf.h

@@ -26,11 +26,12 @@
  * per-module).  There is never any client-chosen root and no --super /
  * --copy-as: a module path always stays confined.
  *
- * `auth_users` is parsed and stored now (Wave A) for Wave B to honor, but the
- * presence of auth users is already enforced with a SAFE default this wave:
- * because FastSync cannot yet authenticate a claimed user, a module that
- * declares auth users refuses every connection (see server.c).  Auth is never
- * bypassed by ignoring the list. */
+ * `auth_users` is honored by Wave B daemon authentication: a module that
+ * declares auth users accepts a connection only when the presented username is
+ * on this list AND verifies against the daemon's credential store
+ * (--password-file / --early-input).  An auth-required module with no usable
+ * store refuses (fail closed) rather than falling open; see server.c.  Auth is
+ * never bypassed by ignoring the list. */
 typedef struct DaemonModule {
   char* name;        /* module name, as the client requests it */
   char* path;        /* module root (daemon-side authorized root) */