Add BATS tests to cover caching_sha2_password use with mysql client

integration-tests/bats/caching_sha2_password.bats

@@ -0,0 +1,152 @@
+#!/usr/bin/env bats
+load $BATS_TEST_DIRNAME/helper/common.bash
+load $BATS_TEST_DIRNAME/helper/query-server-common.bash
+
+setup() {
+    skiponwindows "sql-server tests are missing dependencies on Windows"
+    if [ "$SQL_ENGINE" = "remote-engine" ]; then
+      skip "This test tests remote connections directly, SQL_ENGINE is not needed."
+    fi
+
+    BATS_TEST_DIR=$PWD
+    PROJECT_ROOT=$BATS_TEST_DIR/../..
+    CERTS_DIR=$PROJECT_ROOT/go/libraries/doltcore/servercfg/testdata
+    setup_no_dolt_init
+    dolt init
+    cp $CERTS_DIR/chain_cert.pem $CERTS_DIR/chain_key.pem .
+}
+
+teardown() {
+    stop_sql_server 1 && sleep 0.5
+    rm -rf $BATS_TMPDIR/sql-server-test$$
+    teardown_common
+}
+
+start_sql_server() {
+    PORT=$( definePORT )
+    cat >config.yml <<EOF
+log_level: debug
+behavior:
+  disable_client_multi_statements: true
+user:
+  name: dolt
+listener:
+  host: "0.0.0.0"
+  port: $PORT
+  tls_cert:  chain_cert.pem
+  tls_key: chain_key.pem
+  require_secure_transport: true
+EOF
+
+    dolt sql -q "CREATE USER userWithPassword@localhost IDENTIFIED WITH caching_sha2_password BY 'pass3';"
+    dolt sql -q "CREATE USER userWithNoPassword@localhost IDENTIFIED WITH caching_sha2_password;"
+
+    dolt sql-server --config ./config.yml --socket "dolt.$PORT.sock" &
+    SERVER_PID=$!
+    sleep 1
+}
+
+# The mysql command line client is not available in Lambda
+# bats test_tags=no_lambda
+@test "caching_sha2_password: user does not exist" {
+    start_sql_server
+
+    # Invalid account
+    run mysql -uinvalid --port $PORT --protocol TCP --default-auth=caching_sha2_password -pwrong
+    [ "$status" -ne 0 ]
+    [[ "$output" =~ "No authentication methods available for authentication" ]] || false
+}
+
+# The mysql command line client is not available in Lambda
+# bats test_tags=no_lambda
+@test "caching_sha2_password: password account, no auth renegotiation" {
+    start_sql_server
+
+    # Account with password, no auth method renegotiation, wrong password
+    run mysql -uuserWithPassword --port $PORT --protocol TCP --default-auth=caching_sha2_password -pwrong
+    [ "$status" -ne 0 ]
+    [[ "$output" =~ "Access denied for user 'userWithPassword'" ]] || false
+
+    # Account with password, no auth method renegotiation, right password
+    run mysql -uuserWithPassword --port $PORT --protocol TCP --default-auth=caching_sha2_password -ppass3 -e "SELECT 'SUCCESS';"
+    [ "$status" -eq 0 ]
+    [[ "$output" =~ "SUCCESS" ]] || false
+
+    # Account with password, no auth method renegotiation, no password
+    run mysql -uuserWithPassword --port $PORT --protocol TCP --default-auth=caching_sha2_password
+    [ "$status" -ne 0 ]
+    [[ "$output" =~ "Access denied for user 'userWithPassword'" ]] || false
+
+    # Account with password, no auth method renegotiation, empty password
+    run mysql -uuserWithPassword --port $PORT --protocol TCP --default-auth=caching_sha2_password --password=
+    [ "$status" -ne 0 ]
+    [[ "$output" =~ "Access denied for user 'userWithPassword'" ]] || false
+}
+
+# The mysql command line client is not available in Lambda
+# bats test_tags=no_lambda
+@test "caching_sha2_password: password account, with auth renegotiation" {
+    start_sql_server
+
+    # Account with password, auth method renegotiation, wrong password
+    run mysql -uuserWithPassword --port $PORT --protocol TCP --default-auth=mysql_native_password -pwrong
+    [ "$status" -ne 0 ]
+    [[ "$output" =~ "Access denied for user 'userWithPassword'" ]] || false
+
+    # Account with password, auth method renegotiation, right password
+    run mysql -uuserWithPassword --port $PORT --protocol TCP --default-auth=mysql_native_password -ppass3 -e "SELECT 'SUCCESS';"
+    [ "$status" -eq 0 ]
+    [[ "$output" =~ "SUCCESS" ]] || false
+
+    # Account with password, auth method renegotiation, no password
+    run mysql -uuserWithPassword --port $PORT --protocol TCP --default-auth=mysql_native_password
+    [ "$status" -ne 0 ]
+    [[ "$output" =~ "Access denied for user 'userWithPassword'" ]] || false
+
+    # Account with password, auth method renegotiation, empty password
+    run mysql -uuserWithPassword --port $PORT --protocol TCP --default-auth=mysql_native_password --password=
+    [ "$status" -ne 0 ]
+    [[ "$output" =~ "Access denied for user 'userWithPassword'" ]] || false
+}
+
+# The mysql command line client is not available in Lambda
+# bats test_tags=no_lambda
+@test "caching_sha2_password: passwordless account, no auth renegotiation" {
+    start_sql_server
+
+    # Account without password, no auth method renegotiation, wrong password
+    run mysql -uuserWithNoPassword --port $PORT --protocol TCP --default-auth=caching_sha2_password -pwrong
+    [ "$status" -ne 0 ]
+    [[ "$output" =~ "Access denied for user 'userWithNoPassword'" ]] || false
+
+    # Account without password, no auth method renegotiation, correct (empty) password specified
+    run mysql -uuserWithNoPassword --port $PORT --protocol TCP --default-auth=caching_sha2_password -e "SELECT 'SUCCESS';" --password=
+    [ "$status" -eq 0 ]
+    [[ "$output" =~ "SUCCESS" ]] || false
+
+    # Account without password, no auth method renegotiation, no password
+    run mysql -uuserWithNoPassword --port $PORT --protocol TCP --default-auth=caching_sha2_password -e "SELECT 'SUCCESS';"
+    [ "$status" -eq 0 ]
+    [[ "$output" =~ "SUCCESS" ]] || false
+}
+
+# The mysql command line client is not available in Lambda
+# bats test_tags=no_lambda
+@test "caching_sha2_password: passwordless account, with auth renegotiation" {
+    start_sql_server
+
+    # Account without password, auth method renegotiation, wrong password
+    run mysql -uuserWithNoPassword --port $PORT --protocol TCP --default-auth=mysql_native_password -pwrong
+    [ "$status" -ne 0 ]
+    [[ "$output" =~ "Access denied for user 'userWithNoPassword'" ]] || false
+
+    # Account without password, auth method renegotiation, right password
+    run mysql -uuserWithNoPassword --port $PORT --protocol TCP --default-auth=mysql_native_password -e "SELECT 'SUCCESS';" --password=
+    [ "$status" -eq 0 ]
+    [[ "$output" =~ "SUCCESS" ]] || false
+
+    # Account without password, auth method renegotiation, no password
+    run mysql -uuserWithNoPassword --port $PORT --protocol TCP --default-auth=mysql_native_password -e "SELECT 'SUCCESS';"
+    [ "$status" -eq 0 ]
+    [[ "$output" =~ "SUCCESS" ]] || false
+}