{
  "schema": 1,
  "sqlstate": "28P01",
  "condition_name": "invalid_password",
  "runner": "scripts/verify_cases.py",
  "targets": {
    "latest": {
      "binary": "Homebrew PostgreSQL 18.6",
      "required": true
    },
    "pg10": {
      "image": "postgres:10",
      "required": true
    }
  },
  "cases": [
    {
      "id": "wrong_password_authentication",
      "versions": [
        "10",
        "18"
      ],
      "preconditions": [
        "A disposable login role with a known password",
        "A temporary first pg_hba.conf rule uses md5 and is reloaded"
      ],
      "trigger": "Connect with a wrong password and retain the server's authentication diagnostic.",
      "assertions": [
        "The connection attempt receives SQLSTATE 28P01",
        "The server does not open a transaction for the rejected connection",
        "The known password opens a new session while the temporary rule is active",
        "A fresh management connection succeeds after the original configuration is restored"
      ],
      "repair": "Use the intended secret and authentication method, verify a new connection, then restore or rotate credentials without logging passwords.",
      "cleanup": "Restore pg_hba.conf and drop the role and schema."
    }
  ],
  "evidence_status": "authored",
  "snippets": [
    {
      "id": "wrong_password_authentication",
      "case_id": "wrong_password_authentication",
      "language": "sql",
      "statements": {
        "password_setup": "ALTER ROLE known_user PASSWORD 'example-known-secret'",
        "known_probe": "SELECT 1",
        "restored_probe": "SELECT 1"
      }
    }
  ],
  "runtime": [
    {
      "cases": [
        "wrong_password_authentication"
      ],
      "id": "runtime.28P01-registry-final-20260909.latest",
      "observed": {
        "collector_message": "password authentication failed for user <generated-role>",
        "collector_severity": "FATAL",
        "collector_source": "auth.c:320",
        "collector_sqlstate": "28P01",
        "driver_sqlstate": null,
        "driver_text": "FATAL: password authentication failed for user <generated-role>",
        "hba_reload": {
          "enabled": true,
          "restored": true
        },
        "known_password_probe": 1,
        "restored_management_probe": 1,
        "transaction": "none opened for rejected startup",
        "collector_detail": "Connection matched file \"<pg_hba.conf path>\" line 1: \"host all all 0.0.0.0/0 md5\""
      },
      "raw_sha256": "97bcf605a806511aff3f0f4eeaa3615c159bf54e7d6f35b7bfbb45940d3d86d2",
      "run_id": "28P01-registry-final-20260909",
      "server_version": "18.6 (Homebrew)",
      "server_version_num": 180006,
      "snippet_registry": {
        "sha256": "9b2ca3d14cb093415043cb1cb8291eee2020df052f8067c4952ce2cd4597d395"
      },
      "status": "passed",
      "summary_sha256": "0f58bf277fdd33be8d39ed8f05dc6de5555b8aa89db344b1a4cdfb3eb425bcbf",
      "target": "latest",
      "result": {
        "status": "passed",
        "environment": {
          "TimeZone": "Asia/Shanghai",
          "backend_pid": 29246,
          "binary": {
            "bindir": "/opt/homebrew/Cellar/postgresql@18/18.6/bin",
            "pg_config": "/opt/homebrew/bin/pg_config",
            "pg_config_version": "PostgreSQL 18.6 (Homebrew)",
            "postgres": "/opt/homebrew/Cellar/postgresql@18/18.6/bin/postgres"
          },
          "connection_scope": "runner-owned localhost port",
          "current_user": "runner",
          "docker": {},
          "lc_messages": "C",
          "libpq_version": "18.6",
          "locale": "en_US.UTF-8",
          "log_destination": "csvlog,jsonlog",
          "log_error_verbosity": "verbose",
          "log_min_error_statement": "error",
          "log_min_messages": "error",
          "logging_collector": "on",
          "machine": "arm64",
          "max_connections": "100",
          "platform": "macOS-26.6.2-arm64-arm-64bit-Mach-O",
          "psycopg_version": "3.3.5",
          "python_version": "3.14.6 (main, Jun 10 2026, 10:03:53) [Clang 21.0.0 (clang-2100.0.123.102)]",
          "server_encoding": "UTF8",
          "server_version": "18.6 (Homebrew)",
          "server_version_num": "180006",
          "target_kind": "latest",
          "wal_level": "logical"
        },
        "cases": [
          {
            "assertions": [
              {
                "expected": "28P01",
                "name": "invalid-password sqlstate",
                "observed": {
                  "collector": "28P01",
                  "driver": null
                },
                "passed": true
              },
              {
                "expected": "connection rejected before transaction",
                "name": "authentication failure has no open transaction",
                "observed": {
                  "collector": "28P01",
                  "driver": null
                },
                "passed": true
              },
              {
                "expected": "new role connection and SELECT 1",
                "name": "known password authenticates while temporary rule is active",
                "observed": {
                  "connected": true,
                  "query": 1
                },
                "passed": true
              },
              {
                "expected": "both reloads succeed",
                "name": "host authentication restored",
                "observed": {
                  "enabled": {
                    "enabled": true,
                    "method": "latest",
                    "reloaded": true
                  },
                  "restored": {
                    "enabled": false,
                    "method": "latest",
                    "reloaded": true
                  }
                },
                "passed": true
              },
              {
                "expected": "new owner connection and SELECT 1",
                "name": "fresh management connection works after restore",
                "observed": {
                  "connected": true,
                  "query": 1
                },
                "passed": true
              }
            ],
            "case_id": "wrong_password_authentication",
            "cleanup": {
              "errors": [],
              "passed": true
            },
            "elapsed_seconds": 0.027,
            "observed": {
              "collector": {
                "csv": {
                  "application_name": "",
                  "backend_type": "client backend",
                  "command_tag": "authentication",
                  "connection_from": "127.0.0.1:58131",
                  "context": "",
                  "database_name": "postgres",
                  "detail": "Connection matched file \"<local runtime artifact>\" line 1: \"host all all 0.0.0.0/0 md5\"",
                  "error_severity": "FATAL",
                  "hint": "",
                  "internal_query": "",
                  "internal_query_pos": "",
                  "leader_pid": "",
                  "location": "auth_failed, auth.c:320",
                  "log_time": "2026-09-09 17:05:19.418 CST",
                  "message": "password authentication failed for user \"u28p01_889318d3e4\"",
                  "process_id": "29252",
                  "query": "",
                  "query_id": "0",
                  "query_pos": "",
                  "session_id": "6aa1214f.7244",
                  "session_line_num": "1",
                  "session_start_time": "2026-09-09 17:05:19 CST",
                  "sql_state_code": "28P01",
                  "transaction_id": "0",
                  "user_name": "u28p01_889318d3e4",
                  "virtual_transaction_id": "6/1"
                },
                "json": {
                  "backend_type": "client backend",
                  "dbname": "postgres",
                  "detail": "Connection matched file \"<local runtime artifact>\" line 1: \"host all all 0.0.0.0/0 md5\"",
                  "error_severity": "FATAL",
                  "file_line_num": 320,
                  "file_name": "auth.c",
                  "func_name": "auth_failed",
                  "line_num": 1,
                  "message": "password authentication failed for user \"u28p01_889318d3e4\"",
                  "pid": 29252,
                  "ps": "authentication",
                  "query_id": 0,
                  "remote_host": "127.0.0.1",
                  "remote_port": 58131,
                  "session_id": "6aa1214f.7244",
                  "session_start": "2026-09-09 17:05:19 CST",
                  "state_code": "28P01",
                  "timestamp": "2026-09-09 17:05:19.418 CST",
                  "txid": 0,
                  "user": "u28p01_889318d3e4",
                  "vxid": "6/1"
                }
              },
              "correct_password_probe": {
                "connected": true,
                "query": 1
              },
              "diagnostic": {
                "column_name": null,
                "constraint_name": null,
                "context": null,
                "datatype_name": null,
                "exception_type": "OperationalError",
                "internal_position": null,
                "internal_query": null,
                "message_detail": null,
                "message_hint": null,
                "message_primary": null,
                "schema_name": null,
                "severity": null,
                "severity_nonlocalized": null,
                "source_file": null,
                "source_function": null,
                "source_line": null,
                "sqlstate": null,
                "statement_position": null,
                "table_name": null,
                "text": "connection failed: connection to server at \"127.0.0.1\", port 58121 failed: FATAL:  password authentication failed for user \"u28p01_889318d3e4\""
              },
              "hba": {
                "enabled": {
                  "enabled": true,
                  "method": "latest",
                  "reloaded": true
                },
                "restored": {
                  "enabled": false,
                  "method": "latest",
                  "reloaded": true
                }
              },
              "restored_probe": {
                "connected": true,
                "query": 1
              },
              "role": "u28p01_889318d3e4"
            },
            "schema": "c28p01_wrong_password_authentication",
            "status": "passed"
          }
        ]
      }
    },
    {
      "cases": [
        "wrong_password_authentication"
      ],
      "id": "runtime.28P01-registry-final-20260909.pg10",
      "image": "postgres@sha256:b2baf8998630663d21370da06387c950e587071bdd307ee34e661cdcc7442bcc",
      "observed": {
        "collector_message": "password authentication failed for user <generated-role>",
        "collector_severity": "FATAL",
        "collector_source": "auth.c:329",
        "collector_sqlstate": "28P01",
        "driver_sqlstate": null,
        "driver_text": "FATAL: password authentication failed for user <generated-role>",
        "hba_reload": {
          "enabled": true,
          "restored": true
        },
        "known_password_probe": 1,
        "restored_management_probe": 1,
        "transaction": "none opened for rejected startup",
        "collector_detail": "Password does not match for user <generated-role>.\\nConnection matched pg_hba.conf line 1: \"host all all 0.0.0.0/0 md5\""
      },
      "raw_sha256": "6d67921dfd66d347593d1b5c348cb60402eee0aa8dfc2cb9c2dbba7872caefb8",
      "run_id": "28P01-registry-final-20260909",
      "server_version": "10.21 (Debian 10.21-1.pgdg90+1)",
      "server_version_num": 100021,
      "snippet_registry": {
        "sha256": "9b2ca3d14cb093415043cb1cb8291eee2020df052f8067c4952ce2cd4597d395"
      },
      "status": "passed",
      "summary_sha256": "c8b82b3c42519fe121d27a815f224a25a12b8d14fdffd111dedd23f7a8a0a334",
      "target": "pg10",
      "result": {
        "status": "passed",
        "environment": {
          "TimeZone": "Etc/UTC",
          "backend_pid": 79,
          "binary": {},
          "connection_scope": "runner-owned localhost port",
          "current_user": "postgres",
          "docker": {
            "architecture": "arm64",
            "command": "/usr/local/bin/docker",
            "id": "sha256:b2baf8998630663d21370da06387c950e587071bdd307ee34e661cdcc7442bcc",
            "image": "postgres:10",
            "image_created": "2022-06-23T09:11:18.374607054Z",
            "os": "linux",
            "repo_digests": [
              "postgres@sha256:b2baf8998630663d21370da06387c950e587071bdd307ee34e661cdcc7442bcc"
            ]
          },
          "lc_messages": "en_US.utf8",
          "libpq_version": "18.6",
          "locale": "en_US.UTF-8",
          "log_destination": "csvlog",
          "log_error_verbosity": "verbose",
          "log_min_error_statement": "error",
          "log_min_messages": "error",
          "logging_collector": "on",
          "machine": "arm64",
          "max_connections": "100",
          "platform": "macOS-26.6.2-arm64-arm-64bit-Mach-O",
          "psycopg_version": "3.3.5",
          "python_version": "3.14.6 (main, Jun 10 2026, 10:03:53) [Clang 21.0.0 (clang-2100.0.123.102)]",
          "server_encoding": "UTF8",
          "server_version": "10.21 (Debian 10.21-1.pgdg90+1)",
          "server_version_num": "100021",
          "target_kind": "pg10",
          "wal_level": "logical"
        },
        "cases": [
          {
            "assertions": [
              {
                "expected": "28P01",
                "name": "invalid-password sqlstate",
                "observed": {
                  "collector": "28P01",
                  "driver": null
                },
                "passed": true
              },
              {
                "expected": "connection rejected before transaction",
                "name": "authentication failure has no open transaction",
                "observed": {
                  "collector": "28P01",
                  "driver": null
                },
                "passed": true
              },
              {
                "expected": "new role connection and SELECT 1",
                "name": "known password authenticates while temporary rule is active",
                "observed": {
                  "connected": true,
                  "query": 1
                },
                "passed": true
              },
              {
                "expected": "both reloads succeed",
                "name": "host authentication restored",
                "observed": {
                  "enabled": {
                    "command": {
                      "argv": [
                        "/usr/local/bin/docker",
                        "exec",
                        "sqlstate28p01_P01registryfinal20260909_pg10",
                        "sed",
                        "-i",
                        "1ihost all all 0.0.0.0/0 md5",
                        "/var/lib/postgresql/data/pg_hba.conf"
                      ],
                      "elapsed_seconds": 0.066,
                      "returncode": 0,
                      "stderr": "",
                      "stdout": ""
                    },
                    "enabled": true,
                    "method": "pg10",
                    "reloaded": true
                  },
                  "restored": {
                    "command": {
                      "argv": [
                        "/usr/local/bin/docker",
                        "exec",
                        "sqlstate28p01_P01registryfinal20260909_pg10",
                        "sed",
                        "-i",
                        "1d",
                        "/var/lib/postgresql/data/pg_hba.conf"
                      ],
                      "elapsed_seconds": 0.061,
                      "returncode": 0,
                      "stderr": "",
                      "stdout": ""
                    },
                    "enabled": false,
                    "method": "pg10",
                    "reloaded": true
                  }
                },
                "passed": true
              },
              {
                "expected": "new owner connection and SELECT 1",
                "name": "fresh management connection works after restore",
                "observed": {
                  "connected": true,
                  "query": 1
                },
                "passed": true
              }
            ],
            "case_id": "wrong_password_authentication",
            "cleanup": {
              "errors": [],
              "passed": true
            },
            "elapsed_seconds": 0.208,
            "observed": {
              "collector": {
                "csv": {
                  "application_name": "",
                  "command_tag": "authentication",
                  "connection_from": "172.17.0.1:62084",
                  "context": "",
                  "database_name": "postgres",
                  "detail": "Password does not match for user \"u28p01_2bebc84166\".\nConnection matched pg_hba.conf line 1: \"host all all 0.0.0.0/0 md5\"",
                  "error_severity": "FATAL",
                  "hint": "",
                  "internal_query": "",
                  "internal_query_pos": "",
                  "location": "auth_failed, auth.c:329",
                  "log_time": "2026-09-09 09:05:20.797 UTC",
                  "message": "password authentication failed for user \"u28p01_2bebc84166\"",
                  "process_id": "89",
                  "query": "",
                  "query_pos": "",
                  "session_id": "6aa12150.59",
                  "session_line_num": "1",
                  "session_start_time": "2026-09-09 09:05:20 UTC",
                  "sql_state_code": "28P01",
                  "transaction_id": "0",
                  "user_name": "u28p01_2bebc84166",
                  "virtual_transaction_id": "4/1"
                },
                "json": null
              },
              "correct_password_probe": {
                "connected": true,
                "query": 1
              },
              "diagnostic": {
                "column_name": null,
                "constraint_name": null,
                "context": null,
                "datatype_name": null,
                "exception_type": "OperationalError",
                "internal_position": null,
                "internal_query": null,
                "message_detail": null,
                "message_hint": null,
                "message_primary": null,
                "schema_name": null,
                "severity": null,
                "severity_nonlocalized": null,
                "source_file": null,
                "source_function": null,
                "source_line": null,
                "sqlstate": null,
                "statement_position": null,
                "table_name": null,
                "text": "connection failed: connection to server at \"127.0.0.1\", port 58136 failed: FATAL:  password authentication failed for user \"u28p01_2bebc84166\""
              },
              "hba": {
                "enabled": {
                  "command": {
                    "argv": [
                      "/usr/local/bin/docker",
                      "exec",
                      "sqlstate28p01_P01registryfinal20260909_pg10",
                      "sed",
                      "-i",
                      "1ihost all all 0.0.0.0/0 md5",
                      "/var/lib/postgresql/data/pg_hba.conf"
                    ],
                    "elapsed_seconds": 0.066,
                    "returncode": 0,
                    "stderr": "",
                    "stdout": ""
                  },
                  "enabled": true,
                  "method": "pg10",
                  "reloaded": true
                },
                "restored": {
                  "command": {
                    "argv": [
                      "/usr/local/bin/docker",
                      "exec",
                      "sqlstate28p01_P01registryfinal20260909_pg10",
                      "sed",
                      "-i",
                      "1d",
                      "/var/lib/postgresql/data/pg_hba.conf"
                    ],
                    "elapsed_seconds": 0.061,
                    "returncode": 0,
                    "stderr": "",
                    "stdout": ""
                  },
                  "enabled": false,
                  "method": "pg10",
                  "reloaded": true
                }
              },
              "restored_probe": {
                "connected": true,
                "query": 1
              },
              "role": "u28p01_2bebc84166"
            },
            "schema": "c28p01_wrong_password_authentication",
            "status": "passed"
          }
        ]
      }
    }
  ]
}