From 6e8875b07c91c3cce5a2d6992c37f2d07855d6e8 Mon Sep 17 00:00:00 2001
From: Brandon Thomas <echelon@gmail.com>
Date: Tue, 31 Mar 2026 14:54:09 -0400
Subject: [PATCH] fix password issue

---
 crates/lib/password/src/bcrypt_confirm_password.rs | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/crates/lib/password/src/bcrypt_confirm_password.rs b/crates/lib/password/src/bcrypt_confirm_password.rs
index 46bfc9eaa7..4200635031 100644
--- a/crates/lib/password/src/bcrypt_confirm_password.rs
+++ b/crates/lib/password/src/bcrypt_confirm_password.rs
@@ -6,7 +6,9 @@ pub fn bcrypt_confirm_password(password: String, bcrypt_hash: &str) -> Result<bo
     return Err(PasswordConfirmError::HashNotProvided);
   }
 
-  if bcrypt_hash == PASSWORD_HASH_SENTINEL_VALUE {
+  // The database stores the sentinel "*" in a BINARY(60) column, which pads with null bytes.
+  // This reproduces the real-world value: "*" followed by 59 null bytes.
+  if bcrypt_hash.trim_end_matches('\0') == PASSWORD_HASH_SENTINEL_VALUE {
     return Err(PasswordConfirmError::HashIsSentinelValue);
   }
 
@@ -20,7 +22,7 @@ mod tests {
   use crate::errors::password_confirm_error::PasswordConfirmError;
 
   #[test]
-  fn test_confirmation() {
+  fn test_several_password_hash_pairs() {
     // NB: This is to make sure we don't migrate the algorithm to a state where it won't work anymore.
     // NB: Be mindful that these are expensive to compute and don't add too many test cases.
     let hash_to_passwords = [
@@ -52,11 +54,13 @@ mod tests {
   fn test_sentinel_value_with_null_bytes_returns_bcrypt_error() {
     // The database stores the sentinel "*" in a BINARY(60) column, which pads with null bytes.
     // This reproduces the real-world value: "*" followed by 59 null bytes.
+    // It's currently paging me (until I fix it):
+    // [2026-03-31T16:03:00Z WARN  storyteller_web::http_server::endpoints::users::login_handler] Login hash comparison error: BcryptVerifyError(InvalidHash("*\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"))
     let mut hash_with_nulls = String::from("*");
     for _ in 0..59 {
       hash_with_nulls.push('\0');
     }
     let result = bcrypt_confirm_password("password".to_string(), &hash_with_nulls);
-    assert!(matches!(result, Err(PasswordConfirmError::BcryptVerifyError(_))));
+    assert!(matches!(result, Err(PasswordConfirmError::HashIsSentinelValue)));
   }
 }