feat(AclFamily): add AUTH for acl members

src/server/acl/acl_family.cc

@@ -123,16 +123,17 @@ std::variant<User::UpdateRequest, ErrorReply> ParseAclSetUser(CmdArgList args) {
   User::UpdateRequest req;
 
   for (auto arg : args) {
-    ToUpper(&arg);
-    const auto command = facade::ToSV(arg);
-    if (auto pass = MaybeParsePassword(command); pass) {
+    if (auto pass = MaybeParsePassword(facade::ToSV(arg)); pass) {
       if (req.password) {
         return ErrorReply("Only one password is allowed");
       }
       req.password = std::move(pass);
       continue;
     }
 
+    ToUpper(&arg);
+    const auto command = facade::ToSV(arg);
+
     if (auto status = MaybeParseStatus(command); status) {
       if (req.is_active) {
         return ErrorReply("Multiple ON/OFF are not allowed");
@@ -143,7 +144,7 @@ std::variant<User::UpdateRequest, ErrorReply> ParseAclSetUser(CmdArgList args) {
 
     auto [cat, add] = MaybeParseAclCategory(command);
     if (!cat) {
-      return ErrorReply(absl::StrCat("Unrecognized paramter", command));
+      return ErrorReply(absl::StrCat("Unrecognized parameter", command));
     }
 
     auto* acl_field = add ? &req.plus_acl_categories : &req.minus_acl_categories;

src/server/acl/user_registry.cc

@@ -5,6 +5,7 @@
 #include "server/acl/user_registry.h"
 
 #include "core/fibers.h"
+#include "facade/facade_types.h"
 #include "server/acl/acl_commands_def.h"
 
 namespace dfly::acl {
@@ -44,14 +45,15 @@ bool UserRegistry::IsUserActive(std::string_view username) const {
   return it->second.IsActive();
 }
 
-bool UserRegistry::AuthUser(std::string_view username, std::string_view password) const {
+std::pair<bool, const std::string_view> UserRegistry::AuthUser(std::string_view username,
+                                                               std::string_view password) const {
   std::shared_lock<util::SharedMutex> lock(mu_);
   const auto& user = registry_.find(username);
   if (user == registry_.end()) {
-    return false;
+    return {false, {}};
   }
 
-  return user->second.HasPassword(password);
+  return {user->second.IsActive() && user->second.HasPassword(password), user->first};
 }
 
 UserRegistry::RegistryViewWithLock::RegistryViewWithLock(std::shared_lock<util::SharedMutex> mu,

src/server/acl/user_registry.h

@@ -51,7 +51,8 @@ class UserRegistry {
 
   // Acquires a read lock
   // Used by Auth
-  bool AuthUser(std::string_view username, std::string_view password) const;
+  std::pair<bool, const std::string_view> AuthUser(std::string_view username,
+                                                   std::string_view password) const;
 
   // Helper class for accessing the registry with a ReadLock outside the scope of UserRegistry
   class RegistryViewWithLock {

src/server/conn_context.h

@@ -196,6 +196,8 @@ class ConnectionContext : public facade::ConnectionContext {
   // Reference to a FlowInfo for this connection if from a master to a replica.
   FlowInfo* replication_flow;
 
+  std::optional<std::string_view> authed_username;
+
  private:
   void EnableMonitoring(bool enable) {
     subscriptions++;  // required to support the monitoring

src/server/server_family.cc

@@ -1514,8 +1514,16 @@ void ServerFamily::Auth(CmdArgList args, ConnectionContext* cntx) {
     return (*cntx)->SendError(kSyntaxErr);
   }
 
-  if (args.size() == 3) {
-    return (*cntx)->SendError("ACL is not supported yet");
+  if (args.size() == 2) {
+    const auto* registry = ServerState::tlocal()->user_registry;
+    std::string_view username = facade::ToSV(args[0]);
+    std::string_view password = facade::ToSV(args[1]);
+    auto [is_authorized, user] = registry->AuthUser(username, password);
+    if (is_authorized) {
+      cntx->authed_username = user;
+      return (*cntx)->SendOk();
+    }
+    return (*cntx)->SendError(absl::StrCat("Could not authorize user: ", username));
   }
 
   if (!cntx->req_auth) {

tests/dragonfly/acl_family_test.py

@@ -55,3 +55,25 @@ async def test_acl_setuser(async_client):
     await async_client.execute_command("ACL SETUSER kostas +@all")
     result = await async_client.execute_command("ACL LIST")
     assert "user kostas on nopass +@ALL" in result
+
+
+@pytest.mark.asyncio
+async def test_acl_auth(async_client):
+    await async_client.execute_command("ACL SETUSER kostas >mypass")
+
+    with pytest.raises(redis.exceptions.ResponseError):
+        await async_client.execute_command("AUTH kostas wrong_pass")
+
+    # This should fail because user is inactive
+    with pytest.raises(redis.exceptions.ResponseError):
+        await async_client.execute_command("AUTH kostas mypass")
+
+    # Activate user
+    await async_client.execute_command("ACL SETUSER kostas ON")
+
+    result = await async_client.execute_command("AUTH kostas mypass")
+    result == "ok"
+
+    # Let's also try default
+    result = await async_client.execute_command("AUTH default nopass")
+    result == "ok"