Method PasswordMatches

internal/users/userrecord.go:102–125

(input string)

}

func (u *UserRecord) PasswordMatches(input string) bool {

	// Try bcrypt first (new format).
	if err := bcrypt.CompareHashAndPassword([]byte(u.Password), []byte(input)); err == nil {
		return true
	}

	// Migration: check if stored password is old unsalted SHA256 format.
	if u.Password == util.Hash(input) {
		// Re-hash with bcrypt so subsequent logins use the secure path.
		if hash, err := bcrypt.GenerateFromPassword([]byte(input), bcrypt.DefaultCost); err == nil {
			u.Password = string(hash)
		}
		return true
	}

	// Special case for new setups before things get reset
	if u.HasPlaintextPassword() && u.Password == input {
		return true
	}

	// No plaintext fallback. No hash-of-hash bypass.
	return false
}

func (u *UserRecord) AddCommandAlias(input string, output string) (addedAlias string, deletedAlias string) {