feat: render password_hash for users

templates/secrets.yaml

@@ -8,6 +8,9 @@ passwords = [{{ range $i, $p := .passwords }}{{ if $i }}, {{ end }}{{ $p | quote
 {{- else if .password }}
 password = {{ .password | quote }}
 {{- end }}
+{{- if .passwordHash }}
+password_hash = {{ .passwordHash | quote }}
+{{- end }}
 {{- if .poolSize }}
 pool_size = {{ .poolSize }}
 {{- end }}

test/test.sh

@@ -37,5 +37,28 @@ else
   exit 1
 fi
 
+# Validate password hash renders valid TOML
+echo ""
+echo "==> Validating password hash TOML output..."
+users_toml=$(helm template test-release "$CHART_DIR" -f "$TEST_DIR/values-password-hash.yaml" \
+  | yq -r 'select(.kind == "Secret" and .metadata.name == "test-release-pgdog") | .data["users.toml"]' \
+  | base64 -d)
+
+if echo "$users_toml" | grep -q 'password_hash = "SCRAM-SHA-256\$4096:'; then
+  echo "  password hash rendered correctly"
+else
+  echo "  FAIL: password hash not rendered correctly"
+  echo "  Got: $users_toml"
+  exit 1
+fi
+
+if echo "$users_toml" | grep -q '^password = '; then
+  echo "  FAIL: plaintext password rendered for a hash-only user"
+  echo "  Got: $users_toml"
+  exit 1
+else
+  echo "  no plaintext password rendered"
+fi
+
 echo ""
 echo "==> All tests passed!"

test/values-password-hash.yaml

@@ -0,0 +1,13 @@
+# Test a SCRAM verifier in place of a plaintext password.
+# PgDog requires passwordless backend auth when password_hash is used.
+databases:
+  - name: primary
+    host: postgres-primary.example.com
+    port: 5432
+
+users:
+  - name: app_user
+    database: primary
+    passwordHash: "SCRAM-SHA-256$4096:b6lksqhYfkXiN2hDMl3zfA==$9Rh0FdfjsbECkf289/WO2yHGiUBnNOOb1uNHVtOCCDE=:V7jC7GHvIr4guRsI66S3u4aXNhHWj1Pz71ymRM7bLFU="
+    serverUser: app_role
+    serverAuth: rds_iam

values.yaml

@@ -233,6 +233,19 @@ databases: []
 # users contains the list of user entries in users.toml
 # Supports all arguments from users.toml. Arguments are named in
 # camelCase format.
+#
+# passwordHash accepts a PostgreSQL SCRAM verifier (the value stored in
+# pg_authid.rolpassword) instead of a plaintext password, so client logins can
+# be validated without keeping the password in users.toml. PgDog requires the
+# backend connection to authenticate without a password when it is used, e.g.
+# serverAuth: rds_iam.
+#
+#   users:
+#     - name: app_user
+#       database: primary
+#       passwordHash: "SCRAM-SHA-256$4096:<salt>$<StoredKey>:<ServerKey>"
+#       serverUser: app_role
+#       serverAuth: rds_iam
 users: []
 
 # mirrors contains a list of databases to replicate traffic from/to.