feat(plugin-auth): reject breached passwords via HIBP (ADR-0069 D1, P1)#2361
Merged
Conversation
First slice of ADR-0069 (enterprise authentication hardening) and the enforcement-wired pattern template the rest of the ADR copies. Adds a `password_reject_breached` auth setting (default off) wired end-to-end to better-auth's native `haveibeenpwned` plugin — a k-anonymity range check on sign-up / change / reset; the plaintext password never leaves the process. - spec: `passwordRejectBreached` flag on AuthPluginConfigSchema. - service-settings: "Reject breached passwords" toggle in the auth manifest password-policy group (global scope, manage_platform_settings). - plugin-auth: bindAuthSettings maps the setting into plugin config; buildPluginList gates + mounts haveIBeenPwned (env OS_AUTH_PASSWORD_REJECT_BREACHED wins over config, mirroring twoFactor). - cli: surface the knob in the serve boot config. Default-off and additive (no upgrade behavior change). Per ADR-0049 the toggle ships with its enforcement — no false surface; no new identity fields (the [custom] D1 items land in follow-ups). Verified: 102 plugin-auth + 128 service-settings unit tests green; spec / service-settings / plugin-auth (incl. DTS) / cli build green; live dogfood — with the toggle ON the HIBP plugin intercepts /sign-up/email (fail-closed when the corpus is unreachable), with it OFF the same breached password is accepted. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
documentation
Contributor
📓 Docs Drift CheckThis PR changes 4 package(s): 98 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
This was referenced Jun 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements the first slice of ADR-0069 (enterprise authentication hardening) — tracking issue #2281 — and establishes the enforcement-wired pattern template the rest of the ADR copies.
What
Adds a
password_reject_breachedauth setting (default off) wired end-to-end to better-auth's nativehaveibeenpwnedplugin: a k-anonymity range check on sign-up / change-password / reset-password. The plaintext password never leaves the process (only the first 5 SHA-1 hex chars hitapi.pwnedpasswords.com).The trace — manifest setting →
bindAuthSettingspatch →applyConfigPatch→buildPluginListgate → live enforcement — is the seam every subsequent ADR-0069 item reuses.packages/spec/.../auth-config.zod.tspasswordRejectBreachedflag onAuthPluginConfigSchemapackages/services/service-settings/.../auth.manifest.tsglobal,manage_platform_settings)packages/plugins/plugin-auth/src/auth-plugin.tsbindAuthSettingsmaps the setting into plugin configpackages/plugins/plugin-auth/src/auth-manager.tsbuildPluginListgates + mountshaveIBeenPwned(envOS_AUTH_PASSWORD_REJECT_BREACHEDwins over config, mirroringOS_AUTH_TWO_FACTOR)packages/cli/src/commands/serve.tsserveboot config alongsidetwoFactorWhy this slice first
Per the issue's recommendation: HIBP is native (ships in better-auth 1.6.18, no new dep), stateless (no identity columns / migration / hot-path session logic), and its default check paths already match ADR-0069 D1. Lowest-risk, highest-value, and a clean template.
ADR-0049 compliance
The toggle ships with its enforcement — no false surface. Default-off and additive, so existing environments are unchanged on upgrade. No new identity fields are added (the
[custom]D1 items — complexity / expiry / history — land in follow-up PRs that actually read them).Verification
Password123!is intercepted by the HIBP plugin on/sign-up/email(fail-closed when the corpus is unreachable)Out of scope (follow-up ADR-0069 PRs)
D1
[custom]complexity / expiry / history; D2 lockout + rate-limit; D3 enforced MFA; D7 identity fields; P2 sessions / IP allowlist / OIDC trust-list; P3 SAML.🤖 Generated with Claude Code