Added optional credential enforcement to the TDS endpoint via a server-scope CREATE/ALTER/DROP LOGIN registry.

Author: RyanLamansky

CLAUDE.md

@@ -153,7 +153,7 @@ Per-feature deep-dives live under `docs/claude/`. Each entry below is a trigger:
 - **Locking, MVCC, SNAPSHOT/RCSI, deadlock/timeout, lock-related DMVs** → [`locking.md`](docs/claude/locking.md).
 - **Application locks** (`sp_getapplock` / `sp_releaseapplock` / `APPLOCK_MODE` / `APPLOCK_TEST`, return-code-vs-raised-error asymmetry, EF 9/10 `Database.Migrate()`'s `__EFMigrationsLock`) → [`app-locks.md`](docs/claude/app-locks.md).
 - **`hierarchyid` type** (incl. deferred byte-identical CAST research notes) → [`hierarchyid.md`](docs/claude/hierarchyid.md).
-- **`GRANT` / `REVOKE` / `DENY`, principal DDL, fixed-principal seed, principal scalars** (`USER_NAME` / `SUSER_SNAME` / `DATABASE_PRINCIPAL_ID` / `CURRENT_USER` / `SESSION_USER` / `ORIGINAL_LOGIN` / `HAS_PERMS_BY_NAME` / `IS_MEMBER`) → [`permissions.md`](docs/claude/permissions.md).
+- **`GRANT` / `REVOKE` / `DENY`, principal DDL (incl. server logins: `CREATE/ALTER/DROP LOGIN`), fixed-principal seed, principal scalars** (`USER_NAME` / `SUSER_SNAME` / `DATABASE_PRINCIPAL_ID` / `CURRENT_USER` / `SESSION_USER` / `ORIGINAL_LOGIN` / `HAS_PERMS_BY_NAME` / `IS_MEMBER`) → [`permissions.md`](docs/claude/permissions.md).
 - **`CREATE FULLTEXT CATALOG`/`INDEX`, `CONTAINS`/`FREETEXT` rejection** → [`full-text.md`](docs/claude/full-text.md).
 - **`xml` type, XML schema collections, XML methods (`.value()` / `.nodes()` / `.query()` / `.exist()` via an XQuery-subset evaluator; `.modify()` XML-DML skip-with-diagnostic), XML indexes** → [`xml.md`](docs/claude/xml.md).
 - **`geography` / `geometry` types, spatial methods, spatial indexes** → [`spatial.md`](docs/claude/spatial.md).
@@ -162,7 +162,7 @@ Per-feature deep-dives live under `docs/claude/`. Each entry below is a trigger:
 - **New top-level statement parser or dispatch-loop separator rules** → [`grammar.md`](docs/claude/grammar.md) + [`control-flow.md`](docs/claude/control-flow.md).
 - **BACPAC import** (`Simulation.ImportBacpac` — multi-database via repeated calls, `BacpacImportOptions`, `ModelXmlReader` dispatcher, BCP wire format, `BacpacBuilder` test harness) → [`bacpac-loader.md`](docs/claude/bacpac-loader.md).
 - **Linked servers** (`Simulation.AddRemoteSimulation`, `sp_addlinkedserver` / `sp_dropserver`, four-part FROM routing through the remote's ADO.NET pipeline, `OPENQUERY(server,'query')` ad-hoc pass-through + compile-time schema discovery, `sys.servers`) → [`linked-servers.md`](docs/claude/linked-servers.md).
-- **TDS network endpoint** (`Simulation.ListenAsync` → `SimulatedNetworkListener`; real SqlClient over loopback TCP+TLS; SQLBatch/RPC/TM, no bulk; EF via plain `UseSqlServer`; oracle = `*.Tests.SqlClient`) → [`tds-endpoint.md`](docs/claude/tds-endpoint.md).
+- **TDS network endpoint** (`Simulation.ListenAsync` → `SimulatedNetworkListener`; real SqlClient over loopback TCP+TLS; SQLBatch/RPC/TM, no bulk; credential enforcement via the `CREATE LOGIN` registry, Msg 18456 on mismatch; EF via plain `UseSqlServer`; oracle = `*.Tests.SqlClient`) → [`tds-endpoint.md`](docs/claude/tds-endpoint.md).
 
 ## Not modeled
 

SqlServerSimulator.Tests.SqlClient/AuthenticationTests.cs

@@ -0,0 +1,146 @@
+using Microsoft.Data.SqlClient;
+using static Microsoft.VisualStudio.TestTools.UnitTesting.Assert;
+
+namespace SqlServerSimulator;
+
+/// <summary>
+/// Credential enforcement at the wire endpoint: an empty
+/// <c>CREATE LOGIN</c> registry accepts any credentials (the
+/// zero-configuration default every other test in this project relies on);
+/// once a login exists, the LOGIN7 username/password must match or the
+/// connection fails with the probe-confirmed Msg 18456 severity 14 state 1
+/// shape and closes.
+/// </summary>
+[TestClass]
+public sealed class AuthenticationTests
+{
+    public TestContext TestContext { get; set; } = null!;
+
+    private static string CredentialConnectionString(SimulatedNetworkListener listener, string user, string password) =>
+        $"Server=127.0.0.1,{listener.Port};User ID={user};Password='{password.Replace("'", "''", StringComparison.Ordinal)}';TrustServerCertificate=True;Pooling=False;Connect Timeout=15";
+
+    private static async Task<SqlException> AssertLoginFails(SimulatedNetworkListener listener, string user, string password, CancellationToken cancellationToken)
+    {
+        var ex = await Assert.ThrowsAsync<SqlException>(async () =>
+        {
+            await using var connection = new SqlConnection(CredentialConnectionString(listener, user, password));
+            await connection.OpenAsync(cancellationToken);
+        });
+
+        AreEqual(18456, ex.Number);
+        AreEqual(14, ex.Class);
+        AreEqual(1, ex.State);
+        AreEqual($"Login failed for user '{user}'.", ex.Message);
+        return ex;
+    }
+
+    private static async Task AssertLoginSucceeds(SimulatedNetworkListener listener, string user, string password, CancellationToken cancellationToken)
+    {
+        await using var connection = new SqlConnection(CredentialConnectionString(listener, user, password));
+        await connection.OpenAsync(cancellationToken);
+        await using var command = new SqlCommand("select 1", connection);
+        AreEqual(1, await command.ExecuteScalarAsync(cancellationToken));
+    }
+
+    [TestMethod]
+    public async Task EmptyRegistry_AcceptsAnyCredentials()
+    {
+        var simulation = new Simulation();
+        await using var listener = await simulation.ListenAsync(0, TestContext.CancellationToken);
+        await AssertLoginSucceeds(listener, "whoever", "whatever", TestContext.CancellationToken);
+    }
+
+    [TestMethod]
+    public async Task CorrectPassword_Connects()
+    {
+        var simulation = new Simulation();
+        Wire.ExecInProc(simulation, "CREATE LOGIN app WITH PASSWORD = 'S3cret!Pass'");
+        await using var listener = await simulation.ListenAsync(0, TestContext.CancellationToken);
+        await AssertLoginSucceeds(listener, "app", "S3cret!Pass", TestContext.CancellationToken);
+    }
+
+    [TestMethod]
+    public async Task WrongPassword_Fails18456()
+    {
+        var simulation = new Simulation();
+        Wire.ExecInProc(simulation, "CREATE LOGIN app WITH PASSWORD = 'S3cret!Pass'");
+        await using var listener = await simulation.ListenAsync(0, TestContext.CancellationToken);
+        _ = await AssertLoginFails(listener, "app", "wrong", TestContext.CancellationToken);
+    }
+
+    [TestMethod]
+    public async Task UnknownUser_Fails18456()
+    {
+        var simulation = new Simulation();
+        Wire.ExecInProc(simulation, "CREATE LOGIN app WITH PASSWORD = 'S3cret!Pass'");
+        await using var listener = await simulation.ListenAsync(0, TestContext.CancellationToken);
+        _ = await AssertLoginFails(listener, "nosuchuser", "S3cret!Pass", TestContext.CancellationToken);
+    }
+
+    [TestMethod]
+    public async Task EmptyPassword_Fails18456()
+    {
+        var simulation = new Simulation();
+        Wire.ExecInProc(simulation, "CREATE LOGIN app WITH PASSWORD = 'S3cret!Pass'");
+        await using var listener = await simulation.ListenAsync(0, TestContext.CancellationToken);
+        _ = await AssertLoginFails(listener, "app", "", TestContext.CancellationToken);
+    }
+
+    [TestMethod]
+    public async Task NonAsciiPassword_RoundTripsObfuscation()
+    {
+        // Non-ASCII UTF-16 units (including a surrogate pair) exercise the
+        // LOGIN7 nibble-swap/XOR de-obfuscation and the char-counted length.
+        var simulation = new Simulation();
+        Wire.ExecInProc(simulation, "CREATE LOGIN app WITH PASSWORD = N'p䣀🙂ß'");
+        await using var listener = await simulation.ListenAsync(0, TestContext.CancellationToken);
+        await AssertLoginSucceeds(listener, "app", "p䣀🙂ß", TestContext.CancellationToken);
+        _ = await AssertLoginFails(listener, "app", "p䣀ß", TestContext.CancellationToken);
+    }
+
+    [TestMethod]
+    public async Task UserNameLookup_IsCaseInsensitive()
+    {
+        var simulation = new Simulation();
+        Wire.ExecInProc(simulation, "CREATE LOGIN app WITH PASSWORD = 'S3cret!Pass'");
+        await using var listener = await simulation.ListenAsync(0, TestContext.CancellationToken);
+        await AssertLoginSucceeds(listener, "APP", "S3cret!Pass", TestContext.CancellationToken);
+    }
+
+    [TestMethod]
+    public async Task AlterLogin_ChangesEnforcedPassword()
+    {
+        var simulation = new Simulation();
+        Wire.ExecInProc(simulation, "CREATE LOGIN app WITH PASSWORD = 'OldPass1!'");
+        await using var listener = await simulation.ListenAsync(0, TestContext.CancellationToken);
+        await AssertLoginSucceeds(listener, "app", "OldPass1!", TestContext.CancellationToken);
+
+        Wire.ExecInProc(simulation, "ALTER LOGIN app WITH PASSWORD = 'NewPass2!'");
+        _ = await AssertLoginFails(listener, "app", "OldPass1!", TestContext.CancellationToken);
+        await AssertLoginSucceeds(listener, "app", "NewPass2!", TestContext.CancellationToken);
+    }
+
+    [TestMethod]
+    public async Task DropLastLogin_RevertsToAcceptAnything()
+    {
+        var simulation = new Simulation();
+        Wire.ExecInProc(simulation, "CREATE LOGIN app WITH PASSWORD = 'S3cret!Pass'");
+        await using var listener = await simulation.ListenAsync(0, TestContext.CancellationToken);
+        _ = await AssertLoginFails(listener, "other", "whatever", TestContext.CancellationToken);
+
+        Wire.ExecInProc(simulation, "DROP LOGIN app");
+        await AssertLoginSucceeds(listener, "other", "whatever", TestContext.CancellationToken);
+    }
+
+    [TestMethod]
+    public async Task SecondLogin_BothEnforced()
+    {
+        var simulation = new Simulation();
+        Wire.ExecInProc(simulation, "CREATE LOGIN app1 WITH PASSWORD = 'Pass!One1'");
+        Wire.ExecInProc(simulation, "CREATE LOGIN app2 WITH PASSWORD = 'Pass!Two2'");
+        await using var listener = await simulation.ListenAsync(0, TestContext.CancellationToken);
+        await AssertLoginSucceeds(listener, "app1", "Pass!One1", TestContext.CancellationToken);
+        await AssertLoginSucceeds(listener, "app2", "Pass!Two2", TestContext.CancellationToken);
+        _ = await AssertLoginFails(listener, "app1", "Pass!Two2", TestContext.CancellationToken);
+    }
+}

SqlServerSimulator.Tests/FormatMessageAndLoginScalarTests.cs

@@ -238,6 +238,32 @@ public void PwdCompare_ThirdVersionArgumentAcceptedAndIgnored()
         AreEqual(1, Scalar("select pwdcompare('abc', pwdencrypt('abc'), 1)"));
     }
 
+    // SQL Server caps password-machinery input at 128 characters
+    // (probe-confirmed at exactly the 128/129 boundary, 2026-07-14).
+
+    [TestMethod]
+    public void PwdEncrypt_128Chars_Succeeds()
+        => AreEqual(70, Scalar("select datalength(pwdencrypt(replicate('a', 128)))"));
+
+    [TestMethod]
+    public void PwdEncrypt_129Chars_Raises6607()
+    {
+        var ex = new Simulation().AssertSqlError("select pwdencrypt(replicate('a', 129))", 6607);
+        AreEqual("Password Encryption: The value supplied for parameter number 1 is invalid.", ex.Message);
+        AreEqual((byte)16, ex.Class);
+        AreEqual((byte)5, ex.State);
+    }
+
+    [TestMethod]
+    public void PwdCompare_128CharClear_RoundTrips()
+        => AreEqual(1, Scalar("select pwdcompare(replicate('a', 128), pwdencrypt(replicate('a', 128)))"));
+
+    // An oversized clear compares in full rather than truncating — real
+    // returns 0 for a 129-char clear against its own 128-char prefix's hash.
+    [TestMethod]
+    public void PwdCompare_OversizedClear_ReturnsZeroWithoutTruncating()
+        => AreEqual(0, Scalar("select pwdcompare(replicate('a', 129), pwdencrypt(replicate('a', 128)))"));
+
     /// <summary>
     /// Cross-engine fidelity: a <c>0x0300</c> hash generated by the live
     /// SQL Server 2025 reference for password <c>'abc'</c> verifies inside the

SqlServerSimulator.Tests/LoginDdlTests.cs

@@ -0,0 +1,163 @@
+using static Microsoft.VisualStudio.TestTools.UnitTesting.Assert;
+
+namespace SqlServerSimulator;
+
+/// <summary>
+/// Behavioral tests for the server-scope login DDL
+/// (<c>CREATE LOGIN</c> / <c>ALTER LOGIN</c> / <c>DROP LOGIN</c>) and the
+/// <c>LOGINPROPERTY</c> wiring that reads the resulting registry. The registry
+/// (<c>Simulation.Logins</c>) is enforced only by the TDS network endpoint —
+/// covered by the SqlClient oracle, not here; these tests exercise the parse /
+/// registry-maintenance / error-shape surface reachable through plain ADO.NET.
+/// </summary>
+[TestClass]
+public sealed class LoginDdlTests
+{
+    [TestMethod]
+    public void CreateThenDropLogin_Succeeds()
+        => new Simulation().ExecuteBatches(
+            "create login app with password = 'Xy!12345'",
+            "drop login app");
+
+    [TestMethod]
+    public void CreateLogin_Duplicate_Raises15025()
+    {
+        var sim = new Simulation();
+        _ = sim.ExecuteNonQuery("create login app with password = 'Xy!12345'");
+        var ex = sim.AssertSqlError("create login app with password = 'Zz!98765'", 15025);
+        AreEqual((byte)16, ex.Class);
+        AreEqual((byte)1, ex.State);
+        AreEqual("The server principal 'app' already exists.", ex.Message);
+    }
+
+    [TestMethod]
+    public void AlterLogin_Missing_Raises15151_AlterWording()
+    {
+        var ex = new Simulation().AssertSqlError("alter login nosuch with password = 'Xy!12345'", 15151);
+        AreEqual((byte)16, ex.Class);
+        AreEqual((byte)1, ex.State);
+        AreEqual("Cannot alter the login 'nosuch', because it does not exist or you do not have permission.", ex.Message);
+    }
+
+    [TestMethod]
+    public void DropLogin_Missing_Raises15151_DropWording()
+    {
+        var ex = new Simulation().AssertSqlError("drop login nosuch", 15151);
+        AreEqual((byte)16, ex.Class);
+        AreEqual((byte)1, ex.State);
+        AreEqual("Cannot drop the login 'nosuch', because it does not exist or you do not have permission.", ex.Message);
+    }
+
+    // Real SQL Server has no IF EXISTS clause on DROP LOGIN — probe-confirmed
+    // Msg 156, the keyword-flavored syntax error, near 'IF'.
+    [TestMethod]
+    public void DropLogin_IfExists_Raises156()
+        => new Simulation().AssertSqlError("drop login if exists app", 156, "Incorrect syntax near the keyword 'if'.");
+
+    [TestMethod]
+    public void CreateLogin_FromWindows_NotSupported()
+    {
+        var ex = Throws<NotSupportedException>(
+            () => new Simulation().ExecuteNonQuery("create login w from windows"));
+        Assert.Contains("SQL-authentication", ex.Message);
+    }
+
+    [TestMethod]
+    public void CreateLogin_HashedPassword_NotSupported()
+    {
+        var ex = Throws<NotSupportedException>(
+            () => new Simulation().ExecuteNonQuery("create login h with password = 0x1234 hashed"));
+        Assert.Contains("hashed-password", ex.Message);
+    }
+
+    // Real documents the 128-char password cap; its exact CREATE LOGIN
+    // rejection shape is unverifiable from the reference instance (the probe
+    // login hits the Msg 15247 permission wall first), so the simulator
+    // reuses the password-machinery Msg 6607 that PWDENCRYPT's cap raises.
+    [TestMethod]
+    public void CreateLogin_PasswordOver128Chars_Raises6607()
+    {
+        var password = new string('a', 129);
+        _ = new Simulation().AssertSqlError($"create login app with password = '{password}'", 6607);
+    }
+
+    [TestMethod]
+    public void AlterLogin_PasswordOver128Chars_Raises6607()
+    {
+        var sim = new Simulation();
+        _ = sim.ExecuteNonQuery("create login app with password = 'Xy!12345'");
+        var password = new string('a', 129);
+        _ = sim.AssertSqlError($"alter login app with password = '{password}'", 6607);
+    }
+
+    [TestMethod]
+    public void CreateLogin_128CharPassword_Succeeds()
+        => new Simulation().ExecuteBatches($"create login app with password = '{new string('a', 128)}'");
+
+    [TestMethod]
+    public void CreateLogin_WithOptionTail_Parses()
+        => new Simulation().ExecuteBatches(
+            "create login t with password = 'Xy!12345', check_policy = off, check_expiration = off, default_database = master");
+
+    [TestMethod]
+    public void AlterLogin_Disable_ExistingLogin_Succeeds()
+    {
+        var sim = new Simulation();
+        _ = sim.ExecuteNonQuery("create login t with password = 'Xy!12345'");
+        _ = sim.ExecuteNonQuery("alter login t disable");
+    }
+
+    [TestMethod]
+    public void AlterLogin_WithDefaultDatabase_ExistingLogin_Succeeds()
+    {
+        var sim = new Simulation();
+        _ = sim.ExecuteNonQuery("create login t with password = 'Xy!12345'");
+        _ = sim.ExecuteNonQuery("alter login t with default_database = master");
+    }
+
+    [TestMethod]
+    public void AlterLogin_Disable_Missing_Raises15151_AlterWording()
+        => new Simulation().AssertSqlError(
+            "alter login nosuch disable",
+            15151,
+            "Cannot alter the login 'nosuch', because it does not exist or you do not have permission.");
+
+    [TestMethod]
+    public void LoginProperty_IsLocked_CreatedLogin_ReturnsZero()
+    {
+        var sim = new Simulation();
+        _ = sim.ExecuteNonQuery("create login t with password = 'Xy!12345'");
+        AreEqual("0", sim.ExecuteScalar("select loginproperty('t', 'IsLocked')"));
+    }
+
+    [TestMethod]
+    public void LoginProperty_IsLocked_MissingLogin_ReturnsNull()
+        => AreEqual(DBNull.Value, new Simulation().ExecuteScalar("select loginproperty('nosuch_xyz', 'IsLocked')"));
+
+    [TestMethod]
+    public void LoginProperty_PasswordLastSetTime_CreatedLogin_NonNull()
+    {
+        var sim = new Simulation();
+        _ = sim.ExecuteNonQuery("create login t with password = 'Xy!12345'");
+        var result = sim.ExecuteScalar("select loginproperty('t', 'PasswordLastSetTime')");
+        Assert.IsNotNull(result);
+        AreNotEqual(DBNull.Value, result);
+    }
+
+    [TestMethod]
+    public void CreateLogin_InSkippedBranch_DoesNotCreate()
+    {
+        var sim = new Simulation();
+        _ = sim.ExecuteNonQuery("if 1 = 0 create login skipme with password = 'Xy!12345'");
+        // Never created, so the follow-up ALTER hits the missing-login path.
+        _ = sim.AssertSqlError("alter login skipme with password = 'Zz!98765'", 15151);
+    }
+
+    [TestMethod]
+    public void CreateLogin_RegistryIsCaseInsensitive_Raises15025()
+    {
+        var sim = new Simulation();
+        _ = sim.ExecuteNonQuery("create login App with password = 'Xy!12345'");
+        _ = sim.AssertSqlError("create login APP with password = 'Zz!98765'", 15025);
+    }
+}

SqlServerSimulator/Errors/SimulatedSqlException.QueryErrors.cs

@@ -124,6 +124,20 @@ internal static SimulatedSqlException FetchMustBeGreaterThanZero() =>
     internal static SimulatedSqlException FunctionRequiresNArguments(string functionLowerName, int argumentCount) =>
         new($"The {functionLowerName} function requires {argumentCount} argument(s).", 174, 15, 1);
 
+    /// <summary>
+    /// Mimics SQL Server error 6607: the password-encryption machinery
+    /// rejected an input — fired by <c>PWDENCRYPT</c> for a clear text over
+    /// 128 characters (probe-confirmed at exactly the 128/129 boundary, same
+    /// shape for varchar and nvarchar input). Also raised for a
+    /// <c>CREATE/ALTER LOGIN</c> password over the same documented 128-char
+    /// cap, where real's rejection shape is unverifiable from the reference
+    /// instance (its login hits the Msg 15247 permission wall before password
+    /// validation) — an approximation flagged in
+    /// <c>docs/claude/permissions.md</c>.
+    /// </summary>
+    internal static SimulatedSqlException PasswordEncryptionInvalidValue() =>
+        new("Password Encryption: The value supplied for parameter number 1 is invalid.", 6607, 16, 5);
+
     /// <summary>
     /// Mimics SQL Server error 155: the first argument to <c>DATEPART</c> /
     /// <c>DATEADD</c> / <c>DATEDIFF</c> / etc. wasn't a recognized datepart