[auth] Validate usernames upfront

auth/auth/auth.py

@@ -128,7 +128,7 @@ async def check_valid_new_user(tx: Transaction, username, login_id, is_developer
         raise MultipleUserTypes(username)
     if not is_service_account and not login_id:
         raise EmptyLoginID(username)
-    if not username or not all(c for c in username if c.isalnum()):
+    if not username or not (username.isalnum() and username.islower()):
         raise InvalidUsername(username)
 
     existing_users = await users_with_username_or_login_id(tx, username, login_id)
@@ -151,6 +151,18 @@ async def check_valid_new_user(tx: Transaction, username, login_id, is_developer
     return None
 
 
+def validate_credentials_secret_name_input(secret_name: Optional[str]):
+    if secret_name is None:
+        return
+
+    regex = re.compile(r'^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$')
+    if not regex.match(secret_name):
+        raise AuthUserError(
+            f'invalid credentials_secret_name {secret_name}. Must match RFC1123 (lowercase alphanumeric plus "." and "-", start and end with alphanumeric)',
+            'error',
+        )
+
+
 async def insert_new_user(
     db: Database,
     username: str,
@@ -183,6 +195,7 @@ async def _insert(tx):
             ),
         )
 
+    validate_credentials_secret_name_input(hail_credentials_secret_name)
     await _insert()
     return True
 

auth/auth/exceptions.py

@@ -28,7 +28,7 @@ def __init__(self, username, login_id):
 
 class InvalidUsername(AuthUserError):
     def __init__(self, username):
-        super().__init__(f"Invalid username '{username}'. Must be a non-empty alphanumeric string.", 'error')
+        super().__init__(f"Invalid username '{username}'. Must be a non-empty lowercase alphanumeric string.", 'error')
 
 
 class InvalidType(AuthUserError):