phorge-phorge/resources/sql/autopatches/20180121.auth.02.passsalt.sql

ALTER TABLE {$NAMESPACE}_auth.auth_password
  ADD passwordSalt VARCHAR(64) NOT NULL COLLATE {$COLLATE_TEXT};
Prepare the new AuthPassword infrastructure for storing account passwords Summary: Ref T13043. In D18898 I moved VCS passwords to the new shared infrastructure. Before account passwords can move, we need to make two changes: - For legacy reasons, VCS passwords and Account passwords have different "digest" algorithms. Both are more complicated than they should be, but we can't easily fix it without breaking existing passwords. Add a `PasswordHashInterface` so that objects which can have passwords hashes can implement custom digest logic for each password type. - Account passwords have a dedicated external salt (`PhabricatorUser->passwordSalt`). This is a generally reasonable thing to support (since not all hashers are self-salting) and we need to keep it around so existing passwords still work. Add salt support to `AuthPassword` and make it generate/regenerate when passwords are updated. Then add a nice story about password digestion. Test Plan: Ran migrations. Used an existing VCS password; changed VCS password. Tried to use a revoked password. Unit tests still pass. Grepped for callers to legacy `PhabricatorHash::digestPassword()`, found none. Reviewers: amckinley Reviewed By: amckinley Maniphest Tasks: T13043 Differential Revision: https://secure.phabricator.com/D18900 2018-01-21 23:58:46 +01:00			`ALTER TABLE {$NAMESPACE}_auth.auth_password`
			`ADD passwordSalt VARCHAR(64) NOT NULL COLLATE {$COLLATE_TEXT};`