feat(AclFamily): add AUTH for acl members

src/server/acl/acl_family.cc

@@ -124,16 +124,17 @@ std::variant<User::UpdateRequest, ErrorReply> ParseAclSetUser(CmdArgList args) {
   User::UpdateRequest req;
 
   for (auto arg : args) {
-    ToUpper(&arg);
-    const auto command = facade::ToSV(arg);
-    if (auto pass = MaybeParsePassword(command); pass) {
+    if (auto pass = MaybeParsePassword(facade::ToSV(arg)); pass) {
       if (req.password) {
         return ErrorReply("Only one password is allowed");
       }
       req.password = std::move(pass);
       continue;
     }
 
+    ToUpper(&arg);
+    const auto command = facade::ToSV(arg);
+
     if (auto status = MaybeParseStatus(command); status) {
       if (req.is_active) {
         return ErrorReply("Multiple ON/OFF are not allowed");
@@ -144,7 +145,7 @@ std::variant<User::UpdateRequest, ErrorReply> ParseAclSetUser(CmdArgList args) {
 
     auto [cat, add] = MaybeParseAclCategory(command);
     if (!cat) {
-      return ErrorReply(absl::StrCat("Unrecognized paramter", command));
+      return ErrorReply(absl::StrCat("Unrecognized parameter", command));
     }
 
     auto* acl_field = add ? &req.plus_acl_categories : &req.minus_acl_categories;

src/server/acl/user_registry.cc

@@ -5,6 +5,7 @@
 #include "server/acl/user_registry.h"
 
 #include "core/fibers.h"
+#include "facade/facade_types.h"
 #include "server/acl/acl_commands_def.h"
 
 namespace dfly::acl {
@@ -51,7 +52,7 @@ bool UserRegistry::AuthUser(std::string_view username, std::string_view password
     return false;
   }
 
-  return user->second.HasPassword(password);
+  return user->second.IsActive() && user->second.HasPassword(password);
 }
 
 UserRegistry::RegistryViewWithLock::RegistryViewWithLock(std::shared_lock<util::SharedMutex> mu,

src/server/acl/user_registry.h

@@ -50,7 +50,6 @@ class UserRegistry {
   bool IsUserActive(std::string_view username) const;
 
   // Acquires a read lock
-  // Used by Auth
   bool AuthUser(std::string_view username, std::string_view password) const;
 
   // Helper class for accessing the registry with a ReadLock outside the scope of UserRegistry

src/server/acl/user_registry_test.cc

@@ -23,10 +23,10 @@ TEST_F(UserRegistryTest, BasicOp) {
   const std::string username = "kostas";
   const std::string pass = "mypass";
 
-  User::UpdateRequest req{pass, {}, {}, {}};
+  User::UpdateRequest req{pass, {}, {}, true};
   registry.MaybeAddAndUpdate(username, std::move(req));
   CHECK_EQ(registry.AuthUser(username, pass), true);
-  CHECK_EQ(registry.IsUserActive(username), false);
+  CHECK_EQ(registry.IsUserActive(username), true);
 
   CHECK_EQ(registry.GetCredentials(username).acl_categories, NONE);
 

src/server/conn_context.h

@@ -196,6 +196,8 @@ class ConnectionContext : public facade::ConnectionContext {
   // Reference to a FlowInfo for this connection if from a master to a replica.
   FlowInfo* replication_flow;
 
+  std::optional<std::string> authed_username;
+
  private:
   void EnableMonitoring(bool enable) {
     subscriptions++;  // required to support the monitoring

src/server/server_family.cc

@@ -1514,8 +1514,16 @@ void ServerFamily::Auth(CmdArgList args, ConnectionContext* cntx) {
     return (*cntx)->SendError(kSyntaxErr);
   }
 
-  if (args.size() == 3) {
-    return (*cntx)->SendError("ACL is not supported yet");
+  if (args.size() == 2) {
+    const auto* registry = ServerState::tlocal()->user_registry;
+    std::string_view username = facade::ToSV(args[0]);
+    std::string_view password = facade::ToSV(args[1]);
+    auto is_authorized = registry->AuthUser(username, password);
+    if (is_authorized) {
+      cntx->authed_username = username;
+      return (*cntx)->SendOk();
+    }
+    return (*cntx)->SendError(absl::StrCat("Could not authorize user: ", username));
   }
 
   if (!cntx->req_auth) {

tests/dragonfly/acl_family_test.py

@@ -55,3 +55,25 @@ async def test_acl_setuser(async_client):
     await async_client.execute_command("ACL SETUSER kostas +@all")
     result = await async_client.execute_command("ACL LIST")
     assert "user kostas on nopass +@ALL" in result
+
+
+@pytest.mark.asyncio
+async def test_acl_auth(async_client):
+    await async_client.execute_command("ACL SETUSER kostas >mypass")
+
+    with pytest.raises(redis.exceptions.ResponseError):
+        await async_client.execute_command("AUTH kostas wrong_pass")
+
+    # This should fail because user is inactive
+    with pytest.raises(redis.exceptions.ResponseError):
+        await async_client.execute_command("AUTH kostas mypass")
+
+    # Activate user
+    await async_client.execute_command("ACL SETUSER kostas ON")
+
+    result = await async_client.execute_command("AUTH kostas mypass")
+    result == "ok"
+
+    # Let's also try default
+    result = await async_client.execute_command("AUTH default nopass")
+    result == "ok"