feat: add resilient updates and access controls

internal/secure/secure_test.go

@@ -4,6 +4,7 @@ import (
 	"encoding/base64"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 )
 
@@ -81,7 +82,34 @@ func TestPasswordHash(t *testing.T) {
 	if VerifyPassword(hash, "wrong password") {
 		t.Fatal("wrong password verified")
 	}
-	if _, err := HashPassword("short"); err == nil {
+	if VerifyPassword(strings.Replace(hash, "m=65536", "m=4294967295", 1), "a secure password") {
+		t.Fatal("password hash with unsafe Argon2 parameters was accepted")
+	}
+	if _, err := HashPassword(strings.Repeat("a", PasswordMinLength-1)); err == nil {
 		t.Fatal("short password was accepted")
 	}
+	if _, err := HashPassword(strings.Repeat("a", PasswordMaxLength+1)); err == nil {
+		t.Fatal("overlong password was accepted")
+	}
+}
+
+func TestPasswordTimingHashMatchesCurrentArgonParameters(t *testing.T) {
+	t.Parallel()
+	if !VerifyPassword(PasswordTimingHash, "login timing normalization only") {
+		t.Fatal("precomputed login timing hash no longer matches the configured Argon2 parameters")
+	}
+}
+
+func TestProvisionedPasswordHasNoMinimumLengthBeyondNonEmpty(t *testing.T) {
+	t.Parallel()
+	hash, err := HashProvisionedPassword("x")
+	if err != nil || !VerifyPassword(hash, "x") {
+		t.Fatalf("short provisioned password was not hashed correctly: %v", err)
+	}
+	if _, err := HashProvisionedPassword(""); err == nil {
+		t.Fatal("empty provisioned password was accepted")
+	}
+	if _, err := HashProvisionedPassword(strings.Repeat("x", PasswordMaxLength+1)); err == nil {
+		t.Fatal("overlong provisioned password was accepted")
+	}
 }