CLI command for generating hash

[simonw]

Safer alternative to /-/password-tool using this new plugin hook: https://docs.datasette.io/en/stable/plugin_hooks.html#register-commands-cli

[simonw]

Most basic implementation of this:

@hookimpl
def register_commands(cli):
    @cli.command(name="hash-password")
    @click.password_option()
    def _hash_password(password):
        "Return hash for provided password"
        click.echo(hash_password(password))

This runs like so:

% datasette hash-password
Password: 
Repeat for confirmation: 
Error: the two entered values do not match
Password: 
Repeat for confirmation: 
pbkdf2_sha256$260...

This works well as an interactive tool, but what about if people want to use it in a scripted way?

[simonw]

For the scripted version, having an option for just reading the password a single time from stdin would be enough I think.

I want to avoid passing the password itself as a command-line argument because I don't want it accidentally ending up in bash history or /proc listings or similar.

[simonw]

Maybe this:

echo 'my new password' | datasette hash-password --no-confirm

I think I need an "eager option" to implement this, in order to bypass the default @password_option() behaviour: https://click.palletsprojects.com/en/8.0.x/options/#callbacks-and-eager-options

[simonw]

Documentation: https://github.com/simonw/datasette-auth-passwords/blob/dd79ca40d6f5b98c6833ccf4142a0f1075a9e7ae/README.md#datasette-hash-password