golang.org/x/crypto v0.0.0-20201203163018-be400aefbc4c: bcrypt.InvalidCostError

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify golang.org/x/crypto/bcrypt.InvalidCostError in pkg:golang/golang.org/x/crypto@v0.0.0-20201203163018-be400aefbc4c
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/golang.org/x/crypto@v0.0.0-20201203163018-be400aefbc4c
Demonstrate these symbols/APIs:
  - golang.org/x/crypto/bcrypt.InvalidCostError

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:964727fec5c6236aa1c40c5fdd75e578958023b29900bb154db4ed8bcd54a6c3","contract":["bcrypt.InvalidCostError is an int error type representing a cost outside [bcrypt.MinCost, bcrypt.MaxCost]","bcrypt.InvalidCostError.Error formats the invalid cost and allowed range (MinCost,MaxCost)","bcrypt.GenerateFromPassword returns bcrypt.InvalidCostError when cost exceeds bcrypt.MaxCost","bcrypt.Cost returns bcrypt.InvalidCostError when parsing a hash with cost below bcrypt.MinCost","bcrypt.Cost returns bcrypt.InvalidCostError when parsing a hash with cost above bcrypt.MaxCost","bcrypt.CompareHashAndPassword returns bcrypt.InvalidCostError when given a hash with an out-of-range cost"],"goal":"verify golang.org/x/crypto/bcrypt.InvalidCostError in pkg:golang/golang.org/x/crypto@v0.0.0-20201203163018-be400aefbc4c","kind":"HOW","packages":["pkg:golang/golang.org/x/crypto@v0.0.0-20201203163018-be400aefbc4c"],"schemaVersion":1,"symbols":["golang.org/x/crypto/bcrypt.InvalidCostError"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/golang.org/x/crypto@v0.0.0-20201203163018-be400aefbc4c"],"schemaVersion":1,"subject":"pkg:golang/golang.org/x/crypto@v0.0.0-20201203163018-be400aefbc4c","symbols":["golang.org/x/crypto/bcrypt.InvalidCostError"],"verifierAdapter":"golang@1"}

module example.com/sample

go 1.24

require golang.org/x/crypto v0.0.0-20201203163018-be400aefbc4c

golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
golang.org/x/crypto v0.0.0-20201203163018-be400aefbc4c h1:9HhBz5L/UjnK9XLtiZhYAdue5BVKep3PMmS2LuPDt8k=
golang.org/x/crypto v0.0.0-20201203163018-be400aefbc4c/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=

package main

import (
	"errors"
	"fmt"

	"golang.org/x/crypto/bcrypt"
)

func main() {
	// Hashing with a cost above bcrypt.MaxCost triggers bcrypt.InvalidCostError
	secret := []byte("sample-passphrase-for-bcrypt")
	_, err := bcrypt.GenerateFromPassword(secret, bcrypt.MaxCost+1)
	var costErr bcrypt.InvalidCostError
	if errors.As(err, &costErr) {
		fmt.Printf("GenerateFromPassword rejected cost %d: %v\n", int(costErr), costErr.Error())
	}

	// Inspecting a bcrypt hash with a cost below bcrypt.MinCost triggers bcrypt.InvalidCostError
	underMinHash := []byte("$2a$03$usesomesillystringfore2uDLvp1AK2Q68Lp7FI0d5BOmvnoZZGW")
	_, err = bcrypt.Cost(underMinHash)
	if errors.As(err, &costErr) {
		fmt.Printf("Cost rejected hash cost %d: %v\n", int(costErr), costErr.Error())
	}
}

{
  "schemaVersion": 1,
  "goal": "verify golang.org/x/crypto/bcrypt.InvalidCostError in pkg:golang/golang.org/x/crypto@v0.0.0-20201203163018-be400aefbc4c",
  "kind": "HOW",
  "packages": [
    "pkg:golang/golang.org/x/crypto@v0.0.0-20201203163018-be400aefbc4c"
  ],
  "symbols": [
    "golang.org/x/crypto/bcrypt.InvalidCostError"
  ]
}

package main

import (
	"errors"
	"fmt"
	"os"

	"golang.org/x/crypto/bcrypt"
)

func main() {
	// 1. bcrypt.InvalidCostError represents an int cost value outside the valid range [MinCost, MaxCost]
	directErr := bcrypt.InvalidCostError(2)
	if int(directErr) != 2 {
		fmt.Fprintf(os.Stderr, "contract 1 failed: expected int(directErr) == 2, got %d\n", int(directErr))
		os.Exit(1)
	}

	// 2. bcrypt.InvalidCostError.Error() formats the message with the invalid cost and allowed range
	expectedMsg := fmt.Sprintf("crypto/bcrypt: cost 35 is outside allowed range (%d,%d)", bcrypt.MinCost, bcrypt.MaxCost)
	if got := bcrypt.InvalidCostError(35).Error(); got != expectedMsg {
		fmt.Fprintf(os.Stderr, "contract 2 failed: expected %q, got %q\n", expectedMsg, got)
		os.Exit(1)
	}

	// 3. bcrypt.GenerateFromPassword returns InvalidCostError when given cost > bcrypt.MaxCost
	passphrase := []byte("contract-test-passphrase")
	_, err := bcrypt.GenerateFromPassword(passphrase, bcrypt.MaxCost+1)
	var costErr bcrypt.InvalidCostError
	if !errors.As(err, &costErr) || int(costErr) != bcrypt.MaxCost+1 {
		fmt.Fprintf(os.Stderr, "contract 3 failed: expected InvalidCostError(%d), got %v\n", bcrypt.MaxCost+1, err)
		os.Exit(1)
	}

	// 4. bcrypt.Cost returns InvalidCostError when parsing a hash with cost < bcrypt.MinCost
	lowCostHash := []byte("$2a$03$usesomesillystringfore2uDLvp1AK2Q68Lp7FI0d5BOmvnoZZGW")
	_, err = bcrypt.Cost(lowCostHash)
	if !errors.As(err, &costErr) || int(costErr) != 3 {
		fmt.Fprintf(os.Stderr, "contract 4 failed: expected InvalidCostError(3), got %v\n", err)
		os.Exit(1)
	}

	// 5. bcrypt.Cost returns InvalidCostError when parsing a hash with cost > bcrypt.MaxCost
	highCostHash := []byte("$2a$32$usesomesillystringfore2uDLvp1AK2Q68Lp7FI0d5BOmvnoZZGW")
	_, err = bcrypt.Cost(highCostHash)
	if !errors.As(err, &costErr) || int(costErr) != 32 {
		fmt.Fprintf(os.Stderr, "contract 5 failed: expected InvalidCostError(32), got %v\n", err)
		os.Exit(1)
	}

	// 6. bcrypt.CompareHashAndPassword returns InvalidCostError when hashedPassword has an invalid cost
	err = bcrypt.CompareHashAndPassword(lowCostHash, passphrase)
	if !errors.As(err, &costErr) || int(costErr) != 3 {
		fmt.Fprintf(os.Stderr, "contract 6 failed: expected InvalidCostError(3) from CompareHashAndPassword, got %v\n", err)
		os.Exit(1)
	}

	fmt.Println("contract ok")
}