feat: Add username field to platform config for SSH auth enforcement

- Add Username field to transcript.Platform and fakedevices.FakeDevice
- InitGeneric populates Username from platform config
- PasswordHandler enforces username when set (any username accepted if empty)
- Update Junos platform entry with username: admin
- Add TestGenericListener_UsernameEnforcement
- Document username field in configuration.md and transcripts.md

Closes #89

Author: lykinsbd

docs/configuration.md

@@ -44,6 +44,18 @@ The device vendor (e.g., `cisco`, `arista`, `juniper`).
 
 The hostname displayed in the CLI prompt. Supports Go template variables (see [Transcripts](transcripts.md)).
 
+#### username
+
+Optional. The SSH username required to authenticate. When set, cisshgo enforces both username and password — connections with a different username are rejected. When omitted, any username is accepted (only the password is checked).
+
+```yaml
+junos:
+  username: "admin"   # only "admin" can connect
+  password: "admin"
+```
+
+Also available as `{{.Username}}` in transcript templates.
+
 #### password
 
 SSH password for authentication.

docs/transcripts.md

@@ -46,6 +46,7 @@ type FakeDevice struct {
     Vendor            string            // Device vendor (e.g., "cisco")
     Platform          string            // Platform identifier (e.g., "csr1000v")
     Hostname          string            // Device hostname
+    Username          string            // SSH username (from platform config)
     Password          string            // SSH password
     SupportedCommands SupportedCommands // Available commands
     ContextSearch     map[string]string // CLI contexts
@@ -241,7 +242,7 @@ The file should be empty or contain only whitespace.
 If you see errors like `template: ...: executing ... at <.InvalidField>: can't evaluate field`:
 
 - Check that the field name matches exactly (case-sensitive)
-- Available fields: `Vendor`, `Platform`, `Hostname`, `Password`
+- Available fields: `Vendor`, `Platform`, `Hostname`, `Username`, `Password`
 - Use `{{.Hostname}}` not `{{.hostname}}`
 
 ### Command Not Found

fakedevices/genericFakeDevice.go

@@ -19,6 +19,7 @@ type FakeDevice struct {
 	Platform          string            // Platform of this fake device
 	Hostname          string            // Hostname of the fake device
 	DefaultHostname   string            // Default Hostname of the fake device (for resetting)
+	Username          string            // Expected SSH username (empty = any username accepted)
 	Password          string            // Password of the fake device
 	SupportedCommands SupportedCommands // What commands this fake device supports
 	ContextSearch     map[string]string // The available CLI prompt/contexts on this fake device
@@ -102,6 +103,7 @@ func InitGeneric(platform string, myTranscriptMap transcript.Map, baseDir string
 		Platform:          platform,
 		Hostname:          p.Hostname,
 		DefaultHostname:   p.Hostname,
+		Username:          p.Username,
 		Password:          p.Password,
 		SupportedCommands: supportedCommands,
 		ContextSearch:     p.ContextSearch,

ssh_server/sshlisteners/sshlisteners.go

@@ -42,6 +42,9 @@ func listen(ctx context.Context, myFakeDevice *fakedevices.FakeDevice, portNumbe
 		Addr:    portString,
 		Handler: handler,
 		PasswordHandler: func(sshCtx ssh.Context, pass string) bool {
+			if myFakeDevice.Username != "" && sshCtx.User() != myFakeDevice.Username {
+				return false
+			}
 			return pass == myFakeDevice.Password
 		},
 	}

ssh_server/sshlisteners/sshlisteners_test.go

@@ -104,3 +104,57 @@ func TestGenericListener_PortInUse(t *testing.T) {
 		t.Error("expected error when port is already in use")
 	}
 }
+
+func TestGenericListener_UsernameEnforcement(t *testing.T) {
+	fd := &fakedevices.FakeDevice{
+		Hostname:          "testhost",
+		DefaultHostname:   "testhost",
+		Username:          "admin",
+		Password:          "admin",
+		SupportedCommands: fakedevices.SupportedCommands{},
+		ContextSearch:     map[string]string{"base": ">"},
+		ContextHierarchy:  map[string]string{">": "exit"},
+	}
+
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	port := ln.Addr().(*net.TCPAddr).Port
+	addr := ln.Addr().String()
+	ln.Close()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	go func() { GenericListener(ctx, fd, port, handlers.GenericCiscoHandler) }()
+
+	for i := 0; i < 20; i++ {
+		conn, dialErr := net.DialTimeout("tcp", addr, 100*time.Millisecond)
+		if dialErr == nil {
+			conn.Close()
+			break
+		}
+		time.Sleep(50 * time.Millisecond)
+	}
+
+	cfg := &gossh.ClientConfig{
+		HostKeyCallback: gossh.InsecureIgnoreHostKey(),
+		Timeout:         2 * time.Second,
+	}
+
+	// Correct username + password — should succeed
+	cfg.User = "admin"
+	cfg.Auth = []gossh.AuthMethod{gossh.Password("admin")}
+	client, err := gossh.Dial("tcp", addr, cfg)
+	if err != nil {
+		t.Fatalf("expected success with correct credentials: %v", err)
+	}
+	client.Close()
+
+	// Wrong username — should fail
+	cfg.User = "wronguser"
+	_, err = gossh.Dial("tcp", addr, cfg)
+	if err == nil {
+		t.Error("expected auth failure with wrong username")
+	}
+}

transcript/transcript.go

@@ -27,6 +27,7 @@ type Scenario struct {
 type Platform struct {
 	Vendor             string            `yaml:"vendor" json:"vendor"`
 	Hostname           string            `yaml:"hostname" json:"hostname"`
+	Username           string            `yaml:"username" json:"username"`
 	Password           string            `yaml:"password" json:"password"`
 	CommandTranscripts map[string]string `yaml:"command_transcripts" json:"command_transcripts"`
 	ContextSearch      map[string]string `yaml:"context_search" json:"context_search"`

transcripts/transcript_map.yaml

@@ -101,6 +101,7 @@ platforms:
   junos:
     vendor: "juniper"
     hostname: "cisshgo-junos"
+    username: "admin"
     password: "admin"
     command_transcripts:
       "show version": "transcripts/juniper/junos/show_version.txt"