From 748e735e5d5795b14852d6a6278fbfb4f2e24d6e Mon Sep 17 00:00:00 2001
From: zaphod-black <cade@zbware.com>
Date: Sat, 1 Nov 2025 18:08:18 -0500
Subject: [PATCH] Fix critical password newline bug causing backup
 authentication failure
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CRITICAL BUG FIX: The prompt_password() function was capturing a newline
character along with the password/token, causing the config file to have
malformed multi-line password values.

The Problem:
- prompt_password() used `echo` to print a newline after password input
- This echo was captured by command substitution: PBS_PASSWORD=$(prompt_password ...)
- Config file ended up with:
  PBS_PASSWORD="
  actual-token-here"
- PBS client couldn't authenticate with the malformed password
- Error: "authentication failed - invalid credentials"

The Fix:
- Changed `echo` to `echo >&2` (output to stderr)
- Stderr is not captured by command substitution
- Only the actual password is captured and stored
- Config file now correctly has: PBS_PASSWORD="actual-token-here"

File Changed: pbs-client-installer.sh
- Line 54: echo >&2  # Output newline to stderr so it doesn't get captured

CHANGELOG.md Updated:
- Documented as CRITICAL fix
- Explains the authentication failure in backup service
- Notes config file formatting fix

Impact:
- Connection test passed but backup service failed with auth error
- This affected both password and API token authentication
- Backups would fail silently on scheduled runs
- Now fixed: backups will authenticate correctly

Testing:
User should run installer again and the backup service will now work.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 CHANGELOG.md            | 4 ++++
 pbs-client-installer.sh | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d809f5e..d2a21dc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -45,6 +45,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **CRITICAL**: SSL fingerprint prompt no longer causes authentication timeout
   - Script now automatically accepts SSL fingerprints by piping 'y' to login
   - This was the root cause of "authentication hanging" issues
+- **CRITICAL**: Password/token capture no longer includes newline character
+  - `prompt_password()` function now outputs formatting to stderr
+  - Fixes "authentication failed - invalid credentials" in backup service
+  - Config file now has properly formatted single-line passwords
 - Script no longer hangs indefinitely when PBS server is unreachable
 - Block device auto-detection now correctly handles btrfs subvolumes
 - Invalid device paths like `/dev/mapper/root[/@]` are now properly cleaned
diff --git a/pbs-client-installer.sh b/pbs-client-installer.sh
index 64d3492..b047886 100755
--- a/pbs-client-installer.sh
+++ b/pbs-client-installer.sh
@@ -51,7 +51,7 @@ prompt_password() {
     local prompt_text="$1"
     local user_input
     read -sp "$(echo -e ${BLUE}${prompt_text}${NC}: )" user_input
-    echo
+    echo >&2  # Output newline to stderr so it doesn't get captured
     echo "$user_input"
 }