Function handle_auth

nodedb/src/control/server/resp/handler.rs:103–150

AUTH [username] password Redis supports two forms: - `AUTH password` — authenticates with default username "nodedb" - `AUTH username password` — authenticates with explicit username On success, updates `session.tenant_id` from the authenticated identity.

(cmd: &RespCommand, session: &mut RespSession, state: &SharedState)

///
/// On success, updates `session.tenant_id` from the authenticated identity.
fn handle_auth(cmd: &RespCommand, session: &mut RespSession, state: &SharedState) -> RespValue {
    let (username, password) = match cmd.argc() {
        1 => ("nodedb", cmd.arg_str(0).unwrap_or("")),
        2 => (
            cmd.arg_str(0).unwrap_or("nodedb"),
            cmd.arg_str(1).unwrap_or(""),
        ),
        _ => return RespValue::err("ERR wrong number of arguments for 'auth' command"),
    };

    // Validate credentials using the same path as native/pgwire auth.
    state.credentials.check_lockout(username).ok();

    match state
        .credentials
        .verify_password_with_status(username, password)
    {
        PasswordVerification::Verified(_) => {}
        PasswordVerification::Rejected(reason) => {
            // Only a genuine credential failure counts toward the lockout
            // counter. A policy rejection (expired / must-change password,
            // inactive account) or an internal error must not.
            if reason == AuthRejection::BadCredential {
                let emitter = ArcAuditEmitter(std::sync::Arc::clone(&state.audit));
                state
                    .credentials
                    .record_login_failure(username, None, &emitter);
            }
            state.auth_metrics.record_auth_failure("resp_password");
            return RespValue::err("WRONGPASS invalid username-password pair");
        }
    }

    state.credentials.record_login_success(username);

    // Resolve identity to get tenant_id.
    match state.credentials.to_identity(
        username,
        crate::control::security::identity::AuthMethod::CleartextPassword,
    ) {
        Some(identity) => {
            session.tenant_id = identity.tenant_id;
            state.auth_metrics.record_auth_success("resp_password");
            RespValue::ok()
        }
        None => RespValue::err("ERR user not found after authentication"),
    }
}

// ---------------------------------------------------------------------------
// TTL commands