feat: support function as password for dynamic credentials (#122)

* feat: support function as password for dynamic credentials

Accept fun(() -> iodata()) as the password config value. The function
is evaluated on each new connection, enabling rotating credentials
like AWS IAM auth tokens. When stored in pool config, the fun prints
as #Fun<...> in logs, preventing accidental password disclosure.

Closes #56
Closes #117

* fix: remove duplicated lines from merge conflict resolution

Author: Taure

src/pgo.erl

@@ -60,7 +60,7 @@
 -type pool_config() :: #{host => string(),
                          port => integer(),
                          user => string(),
-                         password => string(),
+                         password => string() | fun(() -> iodata()),
                          database => string(),
 
                          %% pool specific settings

src/pgo_handler.erl

@@ -18,6 +18,12 @@
 -define(DEFAULT_USER, "postgres").
 -define(DEFAULT_PASSWORD, "").
 
+resolve_password(Options) ->
+    case maps:get(password, Options, ?DEFAULT_PASSWORD) of
+        Fun when is_function(Fun, 0) -> Fun();
+        Password -> Password
+    end.
+
 % driver options.
 %% -type open_option() ::
 %%         {host, inet:ip_address() | inet:hostname()} % default: ?DEFAULT_HOST
@@ -229,7 +235,7 @@ setup_startup(Conn=#conn{socket_module=SocketModule,
     end.
 
 setup_authenticate_cleartext_password(Conn, Options) ->
-    Password = maps:get(password, Options, ?DEFAULT_PASSWORD),
+    Password = resolve_password(Options),
     setup_authenticate_password(Conn, Password).
 
 setup_authenticate_sasl_password(Conn, MethodsBinary, Options) ->
@@ -291,7 +297,7 @@ scram_client_final(Nonce, ServerFirst, #conn{socket_module=SocketModule,
                                              pool=Pool}, Options) ->
     User = maps:get(user, Options, ?DEFAULT_USER),
     ServerFirstParts = pgo_scram:parse_server_first(ServerFirst, Nonce),
-    Password = maps:get(password, Options, ?DEFAULT_PASSWORD),
+    Password = resolve_password(Options),
     {ClientFinalMessage, ServerProof} = pgo_scram:get_client_final(ServerFirstParts, Nonce, User, Password),
     case SocketModule:send(Socket, pgo_protocol:encode_scram_response_message(ClientFinalMessage)) of
         ok ->
@@ -302,7 +308,7 @@ scram_client_final(Nonce, ServerFirst, #conn{socket_module=SocketModule,
 
 setup_authenticate_md5_password(Conn, Salt, Options) ->
     User = maps:get(user, Options, ?DEFAULT_USER),
-    Password = maps:get(password, Options, ?DEFAULT_PASSWORD),
+    Password = resolve_password(Options),
     % concat('md5', md5(concat(md5(concat(password, username)), random-salt)))
     <<MD51Int:128>> = crypto:hash(md5, [Password, User]),
     MD51Hex = io_lib:format("~32.16.0b", [MD51Int]),

test/pgo_SUITE.erl

@@ -16,14 +16,24 @@
 
 all() -> [checkout_checkin, checkout_break, recheckout, kill_socket, kill_pid,
           checkout_kill, checkout_disconnect, checkout_query_crash,
-          query_timeout].
+          password_as_function, query_timeout].
 
 init_per_suite(Config) ->
     Config.
 
 end_per_suite(_Config) ->
     ok.
 
+init_per_testcase(password_as_function, Config) ->
+    Pool = pool_password_as_function,
+    application:ensure_all_started(pgo),
+    pgo_sup:start_child(Pool, #{pool_size => 1,
+                                database => ?DATABASE,
+                                user => ?USER,
+                                password => fun() -> ?PASSWORD end}),
+    Tid = pgo_pool:tid(Pool),
+    ?UNTIL((catch ets:info(Tid, size)) =:= 1),
+    [{pool_name, Pool} | Config];
 init_per_testcase(T, Config) when T =:= checkout_break ;
                                   T =:= checkout_query_crash ;
                                   T =:= recheckout ;
@@ -225,6 +235,11 @@ checkout_disconnect(Config) ->
 
     ok.
 
+password_as_function(Config) ->
+    Name = ?config(pool_name, Config),
+    ?assertMatch(#{rows := [{1}]}, pgo:query("select 1", [], #{pool => Name})),
+    ok.
+
 %% regression test. this would fail with `unexpected message` response to the create query
 checkout_query_crash(Config) ->
     Name = ?config(pool_name, Config),