[BUG] ADMIN_PASSWORD env var allows for invalid passwords

[solidDoWant]

Describe the issue
When seeing the database with admin credentials via ADMIN_PASSWORD, the seed job succeeds with any password value. If this doesn't meet the "at least 8 characters in length, contain an upper and lowercase letter, and contain at least one number" requirement, then users cannot log in.

Fixing this requires deleting the database and re-seeding, because the seed job will not update an existing admin user.

Environment

• SDK: N/A
• Engine: self-hosted v0.83.48

Expected behavior
The seed job should reject the password.

Ideally there would be a flag to force the seed job to update the admin user password as well, to aid in recovery.

Code to Reproduce, Logs, or Screenshots
Seed a new password with the env var ADMIN_PASSWORD=mypass and try to log in.

Additional context
N/A

[gregfurman]

Hi @solidDoWant. Thanks for the bug report!

This tracks since we don't actually validate the Seed config being passed in when we initialize the data-layer i.e

hatchet/cmd/hatchet-admin/cli/seed.go

Lines 51 to 53 in c4b30a6

	func runSeed(cf *loader.ConfigLoader) error {
	// load the config
	dc, err := cf.InitDataLayer()

hatchet/pkg/config/loader/loader.go

Lines 356 to 366 in c4b30a6

	return &database.Layer{
	Disconnect: func() error {
	ch.Stop()
	return cleanupV1()
	},
	Pool: pool,
	DDLPool: ddlPool,
	V1: v1,
	Seed: cf.Seed,
	}, nil

Also, when running the SeedDatabase function in the admin client, we can see no validations on the password. Instead, just call the v1.HashPassword util function instead of checking whether the password is valid:

hatchet/cmd/hatchet-admin/cli/seed/seed.go

Lines 15 to 21 in c4b30a6

	func SeedDatabase(dc *database.Layer) error {
	shouldSeedUser := dc.Seed.AdminEmail != "" && dc.Seed.AdminPassword != ""
	var userID uuid.UUID
	if shouldSeedUser {
	// seed an example user
	hashedPw, err := v1.HashPassword(dc.Seed.AdminPassword)

Couple of approaches to fixing this from what I can tell. Wonder if it'd be possible to include a hook in the DB such that whenever we insert a password, it automatically gets hashed instead of needing us to do this from the Go client -- but this is probably overkill 😅

[NathanDrake007]

Hey @gregfurman. Can I take this, or have you already started working on this?

[gregfurman]

Go for it! @NathanDrake007