Add users and network settings tabs with admin protections.

List and delete accounts with last-admin and Administrators-group guards, and expose editable network settings via the configuration UI.

service/internal/auth/password_test.go

@@ -0,0 +1,70 @@
+package auth
+
+import (
+	"testing"
+
+	"codeberg.org/SquidSE/ClusterCanvas/service/internal/settings"
+)
+
+func TestValidatePasswordAcceptsLongRandom(t *testing.T) {
+	t.Parallel()
+	if err := ValidatePassword("Tr0ub4dor&3-extra!", "Admin"); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+}
+
+func TestValidatePasswordAcceptsPassphrase(t *testing.T) {
+	t.Parallel()
+	if err := ValidatePassword("apple banana cherry date elderberry", "Admin"); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+}
+
+func TestValidatePasswordRejectsShort(t *testing.T) {
+	t.Parallel()
+	if err := ValidatePassword("short-pass", "Admin"); err == nil {
+		t.Fatal("expected error")
+	}
+}
+
+func TestValidatePasswordRejectsUsername(t *testing.T) {
+	t.Parallel()
+	if err := ValidatePassword("AdminAdminAdmin!", "AdminAdminAdmin!"); err == nil {
+		t.Fatal("expected error")
+	}
+}
+
+func TestHashAndVerifyPassword(t *testing.T) {
+	t.Parallel()
+	hash, err := HashPassword("apple banana cherry date elderberry")
+	if err != nil {
+		t.Fatalf("HashPassword: %v", err)
+	}
+	ok, err := VerifyPassword("apple banana cherry date elderberry", hash)
+	if err != nil || !ok {
+		t.Fatalf("VerifyPassword failed: ok=%v err=%v", ok, err)
+	}
+	ok, err = VerifyPassword("wrong password here!!", hash)
+	if err != nil {
+		t.Fatalf("VerifyPassword error: %v", err)
+	}
+	if ok {
+		t.Fatal("expected mismatch")
+	}
+}
+
+func TestWouldLockOutWhitelist(t *testing.T) {
+	t.Parallel()
+	network := settings.NetworkSettings{
+		AccessMode: settings.AccessModeWhitelist,
+		Rules:      []string{"10.0.0.0/8"},
+	}
+	locked, _ := WouldLockOut("192.168.1.5", network)
+	if !locked {
+		t.Fatal("expected lock out")
+	}
+	locked, _ = WouldLockOut("10.1.2.3", network)
+	if locked {
+		t.Fatal("expected allow")
+	}
+}