From 37f81ad78aa4f9112c668c462825682073104056 Mon Sep 17 00:00:00 2001
From: Ariel Lahiany <ariell@linxsecurity.io>
Date: Sun, 23 Aug 2026 11:00:54 +0300
Subject: [PATCH] feat: render password_hash for users

users.toml supports password_hash, a PostgreSQL SCRAM verifier used to
validate client logins without storing the plaintext password. The chart
documents users as supporting all users.toml arguments in camelCase, but
the template had no branch for it, so passwordHash was silently dropped.

PgDog requires the backend connection to authenticate without a password
when password_hash is set (e.g. serverAuth: rds_iam), so this pairs with
serverUser/serverAuth rather than replacing serverPassword.

Rendered independently of password/passwords: PgDog accepts both and
prefers the hash, so the chart stays a faithful renderer of the config.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 templates/secrets.yaml         |  3 +++
 test/test.sh                   | 23 +++++++++++++++++++++++
 test/values-password-hash.yaml | 13 +++++++++++++
 values.yaml                    | 13 +++++++++++++
 4 files changed, 52 insertions(+)
 create mode 100644 test/values-password-hash.yaml

diff --git a/templates/secrets.yaml b/templates/secrets.yaml
index 80c48f0..e4f423c 100644
--- a/templates/secrets.yaml
+++ b/templates/secrets.yaml
@@ -8,6 +8,9 @@ passwords = [{{ range $i, $p := .passwords }}{{ if $i }}, {{ end }}{{ $p | quote
 {{- else if .password }}
 password = {{ .password | quote }}
 {{- end }}
+{{- if .passwordHash }}
+password_hash = {{ .passwordHash | quote }}
+{{- end }}
 {{- if .poolSize }}
 pool_size = {{ .poolSize }}
 {{- end }}
diff --git a/test/test.sh b/test/test.sh
index 5b7b938..c6e2381 100755
--- a/test/test.sh
+++ b/test/test.sh
@@ -37,5 +37,28 @@ else
   exit 1
 fi
 
+# Validate password hash renders valid TOML
+echo ""
+echo "==> Validating password hash TOML output..."
+users_toml=$(helm template test-release "$CHART_DIR" -f "$TEST_DIR/values-password-hash.yaml" \
+  | yq -r 'select(.kind == "Secret" and .metadata.name == "test-release-pgdog") | .data["users.toml"]' \
+  | base64 -d)
+
+if echo "$users_toml" | grep -q 'password_hash = "SCRAM-SHA-256\$4096:'; then
+  echo "  password hash rendered correctly"
+else
+  echo "  FAIL: password hash not rendered correctly"
+  echo "  Got: $users_toml"
+  exit 1
+fi
+
+if echo "$users_toml" | grep -q '^password = '; then
+  echo "  FAIL: plaintext password rendered for a hash-only user"
+  echo "  Got: $users_toml"
+  exit 1
+else
+  echo "  no plaintext password rendered"
+fi
+
 echo ""
 echo "==> All tests passed!"
diff --git a/test/values-password-hash.yaml b/test/values-password-hash.yaml
new file mode 100644
index 0000000..efdee5b
--- /dev/null
+++ b/test/values-password-hash.yaml
@@ -0,0 +1,13 @@
+# Test a SCRAM verifier in place of a plaintext password.
+# PgDog requires passwordless backend auth when password_hash is used.
+databases:
+  - name: primary
+    host: postgres-primary.example.com
+    port: 5432
+
+users:
+  - name: app_user
+    database: primary
+    passwordHash: "SCRAM-SHA-256$4096:b6lksqhYfkXiN2hDMl3zfA==$9Rh0FdfjsbECkf289/WO2yHGiUBnNOOb1uNHVtOCCDE=:V7jC7GHvIr4guRsI66S3u4aXNhHWj1Pz71ymRM7bLFU="
+    serverUser: app_role
+    serverAuth: rds_iam
diff --git a/values.yaml b/values.yaml
index f218531..b7738a9 100644
--- a/values.yaml
+++ b/values.yaml
@@ -233,6 +233,19 @@ databases: []
 # users contains the list of user entries in users.toml
 # Supports all arguments from users.toml. Arguments are named in
 # camelCase format.
+#
+# passwordHash accepts a PostgreSQL SCRAM verifier (the value stored in
+# pg_authid.rolpassword) instead of a plaintext password, so client logins can
+# be validated without keeping the password in users.toml. PgDog requires the
+# backend connection to authenticate without a password when it is used, e.g.
+# serverAuth: rds_iam.
+#
+#   users:
+#     - name: app_user
+#       database: primary
+#       passwordHash: "SCRAM-SHA-256$4096:<salt>$<StoredKey>:<ServerKey>"
+#       serverUser: app_role
+#       serverAuth: rds_iam
 users: []
 
 # mirrors contains a list of databases to replicate traffic from/to.