From 93d28ce0b166b07925796c76bc80d654f635ca8e Mon Sep 17 00:00:00 2001
From: atlas <atlas@pr1ma.darkest.space>
Date: Fri, 5 Jun 2026 00:44:42 +0200
Subject: [PATCH] fix: strip code-span backticks from extracted matrix password
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

mara observed the tuwunel reply renders the new password as a code span,
so the plain message body carries literal backticks:

  Successfully reset password for @user:server to: `<password>`

The previous extraction stopped at the first whitespace, capturing the
surrounding backticks ("`<password>`") and producing a login string that
doesn't match the password the bot actually set — recovery would still
fail after parsing.

Strip a leading backtick after the marker and stop the token at the first
whitespace OR closing backtick. Generated passwords contain neither, so a
real password is never truncated mid-token. Two regression tests cover the
backtick-wrapped form, including trailing prose after the closing backtick.
---
 hive-c0re/src/matrix.rs | 25 ++++++++++++++++++++++---
 1 file changed, 22 insertions(+), 3 deletions(-)

diff --git a/hive-c0re/src/matrix.rs b/hive-c0re/src/matrix.rs
index 30a40165..4fd5e1c9 100644
--- a/hive-c0re/src/matrix.rs
+++ b/hive-c0re/src/matrix.rs
@@ -395,10 +395,15 @@ fn extract_new_password(bot_message: &str) -> Option<String> {
     ] {
         if let Some(pos) = lower.find(marker) {
             let rest = &bot_message[pos + marker.len()..];
-            let rest = rest.trim_start();
-            // Stop at first whitespace or newline; password must be non-empty.
+            // Strip leading whitespace, then a leading code-span backtick:
+            // tuwunel renders the password as a code span, so the plain
+            // `body` carries literal backticks ("… to: `<pw>`").
+            let rest = rest.trim_start().trim_start_matches('`');
+            // The password ends at the first whitespace OR the closing
+            // backtick. Generated passwords contain neither, so this never
+            // truncates a real password mid-token.
             let end = rest
-                .find(char::is_whitespace)
+                .find(|c: char| c.is_whitespace() || c == '`')
                 .unwrap_or(rest.len());
             let pw = rest[..end].trim();
             if !pw.is_empty() {
@@ -484,6 +489,20 @@ mod extract_new_password_tests {
         assert_eq!(extract_new_password(msg).as_deref(), Some("abc123XYZ"));
     }
 
+    #[test]
+    fn backtick_wrapped_password() {
+        // tuwunel renders the password as a code span; the plain body
+        // carries literal backticks. Strip them, don't capture them.
+        let msg = "Successfully reset password for @atlas:pr1ma.darkest.space to: `N3wP@ssw0rd`";
+        assert_eq!(extract_new_password(msg).as_deref(), Some("N3wP@ssw0rd"));
+    }
+
+    #[test]
+    fn backtick_wrapped_with_trailing_text() {
+        let msg = "Done. New password is: `hunter2` (store it now)";
+        assert_eq!(extract_new_password(msg).as_deref(), Some("hunter2"));
+    }
+
     #[test]
     fn bare_new_password_colon() {
         let msg = "New password: P@ssword1";