Hashed test passwords that still log in (bcrypt, with pgcrypto's $2a$ prefix)

[YauhenBichel]

Problem

RandomPassword writes random plaintext into the column. Most applications store a password hash there, so after masking every login fails: the stored value is not a hash the application can verify, and nobody knows a password that works. A test environment usually wants the opposite: every account logs in with one known test password.

Replace with a precomputed hash gets close, but it hides a trap I hit in practice. The application checked passwords inside PostgreSQL with pgcrypto's crypt(), which accepts bcrypt only with the $2a$ prefix. htpasswd and several libraries write $2y$ or $2b$, so the hash looked right and every login still failed. A search of the repository finds no mention of bcrypt, so there is no guidance on this either.

Proposal

A transformer, or a mode of RandomPassword, that writes a hash of a known password:

- name: "HashedPassword"
  params:
    column: "password"
    password_env: "TEST_PASSWORD"   # read from the environment, never from the file
    algorithm: "bcrypt"
    bcrypt_variant: "2a"            # 2a | 2b | 2y; 2a for pgcrypto's crypt()
    cost: 10
    per_row_salt: false             # one shared hash by default: bcrypt is slow by design

Plus a short note in the docs on bcrypt variants and pgcrypto.

Go's golang.org/x/crypto/bcrypt already produces $2a$; 2b and 2y are the same algorithm with a different prefix. I would be glad to contribute this with tests if the shape suits you.

_{Drafted with an AI assistant; the pitfall is from my own test environment.}