fix(shacrypt): return none for unknown identifiers

[james-d-elliott]

NewVariant returned VariantSHA512 for any identifier it did not recognise, so the VariantNone checks relying on it could never fail. As a result Decode accepted digests from other algorithms, such as md5crypt ($1$) or bcrypt ($2b$), and treated them as SHA512 digests, and WithVariantName silently selected SHA512 for invalid names instead of returning an error.

NewVariant now returns VariantNone for unknown identifiers, so Decode rejects them with ErrEncodedHashInvalidIdentifier and WithVariantName returns ErrParameterInvalid, consistent with the other algorithms. Decoding through crypt.Decoder is unaffected as only the 5 and 6 identifiers are registered.

Summary by CodeRabbit

• Bug Fixes
  • Unsupported hash identifiers, including MD5 crypt and bcrypt, are now rejected instead of being treated as SHA-512.
  • Unknown variant names now return a validation error.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 12f67171-6cfb-4e6f-b720-63b049d58daa

📥 Commits

Reviewing files that changed from the base of the PR and between 5266c5b and 1eb9a6c.

📒 Files selected for processing (2)

• algorithm/shacrypt/shacrypt_test.go
• algorithm/shacrypt/variant.go

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

NewVariant now returns VariantNone for unsupported identifiers instead of defaulting to VariantSHA512. Tests cover variant selection, validation, and decoding unsupported hash identifiers.

Changes

SHA crypt variant validation

Layer / File(s)	Summary
Handle unsupported variant identifiers algorithm/shacrypt/variant.go, algorithm/shacrypt/shacrypt_test.go	NewVariant returns VariantNone for unrecognized identifiers. Tests cover unknown, empty, and MD5 identifiers, validation errors for unknown names, and decode errors for unsupported hash identifiers.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 1eb9a

Unsupported SHA-crypt identifiers are rejected instead of being treated as SHA-512. The supplied caller summaries and regression cases support the intended behavior, with no concrete merge risk identified.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: returning VariantNone for unknown shacrypt identifiers.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

Warning

Some tools did not complete. Review the errors below.

🔧 golangci-lint (2.13.2)

Error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions
The command is terminated due to an error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 82.82%. Comparing base (6b59085) to head (1eb9a6c).
⚠️ Report is 5 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #352      +/-   ##
==========================================
+ Coverage   82.28%   82.82%   +0.53%     
==========================================
  Files          49       49              
  Lines        1716     1723       +7     
==========================================
+ Hits         1412     1427      +15     
+ Misses        304      296       -8     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[james-d-elliott]

@coderabbitai full review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 42 minutes.

[james-d-elliott]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.