fix(cli): say so when a rescue password is redirected out of the terminal

CodeQL alert #10 flagged the rescue command printing a freshly generated password as
clear-text logging. It is a false positive and was dismissed as one: the value reaches no
log sink — it is created by auth.RandomPassword, goes to exactly one fmt.Printf, and the
audit row keeps only the action and the login — and printing it to the operator who ran
the command is the command's entire purpose.

That justification has one hole, and this closes it. Redirect stdout and the password
lands in a file or a pipe, where it outlives the moment it was needed and the operator
has no reason to suspect a copy exists. When stdout is not a terminal the output now says
so and tells them to delete it. The credentials are still printed: refusing would break
the escape hatch this command exists to be.

Mutation-checked — removing the warning fails the test.

Author: AppsGanin

cmd/rospanel/cli.go

@@ -751,17 +751,38 @@ func rescueAudit(st *store.Store, action, login string, twoFACleared bool) {
 }
 
 // printRescueCredentials shows the new credentials once, with the must-change note.
+//
+// Printing a freshly minted password is the whole point of the rescue command, and it
+// goes to the operator's own terminal — not a log sink, and not the audit row, which
+// keeps only the action and the login. The one case where that stops being true is a
+// caller who redirects stdout, because then the password lands in whatever caught it and
+// outlives the moment it was needed. Say so when stdout is not a terminal: the operator
+// can still use the credentials, but they now know there is a copy to go and delete.
 func printRescueCredentials(login, password string, unlocked bool) {
 	bar := strings.Repeat("=", 56)
 	extra := ""
 	if unlocked {
 		extra = "\n Two-factor : removed"
 	}
+	if !stdoutIsTerminal() {
+		extra += "\n WARNING    : stdout is not a terminal — this password has been written\n" +
+			"              to a file or a pipe. Delete it once you have signed in."
+	}
 	fmt.Printf("\n%s\n RESCUE CREDENTIALS (shown once — sign in and change them)\n%s\n"+
 		" Login      : %s\n Password   : %s%s\n%s\n",
 		bar, bar, login, password, extra, bar)
 }
 
+// stdoutIsTerminal reports whether stdout is an interactive terminal rather than a file
+// or a pipe. Used to warn that a one-time secret just outlived its moment.
+func stdoutIsTerminal() bool {
+	fi, err := os.Stdout.Stat()
+	if err != nil {
+		return false // unknown is treated as "not a terminal": warning costs nothing
+	}
+	return fi.Mode()&os.ModeCharDevice != 0
+}
+
 // checkRestoreArchive refuses an archive that cannot be restored into THIS binary.
 //
 // Staged inside the data directory, not $TMPDIR: /tmp is a small tmpfs on plenty of

cmd/rospanel/rescue_tty_test.go

@@ -0,0 +1,32 @@
+package main
+
+import (
+	"os"
+	"os/exec"
+	"strings"
+	"testing"
+)
+
+// The rescue command prints a one-time password to the operator's terminal, which is the
+// justification for it not being "clear-text logging". That justification stops holding
+// the moment stdout is redirected: the password then lands in a file or a pipe and
+// outlives the moment it was needed. Warn, so the operator knows there is a copy.
+func TestRescueWarnsWhenStdoutIsRedirected(t *testing.T) {
+	if os.Getenv("RESCUE_PRINT_CHILD") == "1" {
+		printRescueCredentials("admin", "s3cret-example", false)
+		return
+	}
+	cmd := exec.Command(os.Args[0], "-test.run=TestRescueWarnsWhenStdoutIsRedirected")
+	cmd.Env = append(os.Environ(), "RESCUE_PRINT_CHILD=1")
+	out, err := cmd.Output() // a pipe, i.e. not a terminal
+	if err != nil {
+		t.Fatalf("child: %v", err)
+	}
+	if !strings.Contains(string(out), "WARNING") {
+		t.Errorf("no warning when stdout is a pipe — the operator is not told the "+
+			"password was captured somewhere:\n%s", out)
+	}
+	if !strings.Contains(string(out), "s3cret-example") {
+		t.Error("the credentials themselves stopped being printed — the command is now useless")
+	}
+}