I have a pass entry "akib@disroot.org", containing the password of this
mail address.  I can find it with the following:

(auth-source-search :host "disroot.org" :user "akib")
=> (#<secret>)

When I don't specify the :user, there's no result:

(auth-source-search :host "disroot.org")
=> nil

After hunting for the root, I found that the bug originates from
the let-binding lines of "suffixes" and "matching-entries" in the
"auth-source-pass--find-match-unambiguous" function.

I think the idea of searching with suffixes is entirely flawed.  IMHO,
every entry should be matched with "hostname", "user", "port"
individually.

I have fixed it by the putting the following in the init file (actually,
I added the advices with Leaf).  This works for me, and the second
example find the entry with this, and it also seems to respect
auth-source-pass-port-separator.

--8<---------------cut here---------------start------------->8---
(defun *auth-source-pass--generate-entry-suffixes--advice
    (hostname user port)
  "Return ((HOSTNAME USER PORT))."
  `((,hostname ,user ,(if (consp port) port (list port)))))

(defun *auth-source-pass--entries-matching-suffix--advice
    (query entries)
  "Return elements of ENTRIES matching QUERY."
  (let* ((hostname (pop query))
         (user (pop query))
         (port (pop query))
         (match (lambda (u h p)
                  (and h (or (equal h hostname)
                             (string-match-p
                              (format "\\.%s$" (regexp-quote h))
                              hostname))
                       (or (not u)
                           (not user)
                           (equal u user))
                       (or (not p)
                           (not port)
                           (member p port))))))
    (cl-remove-if-not
     (lambda (entry)
       (or
        ;; HOST:PORT/USER
        (pcase-let
            (((rx
               (or string-start ?/)
               (and (let h (zero-or-more (not (any ?: ?/))))
                    (zero-or-one
                     (literal auth-source-pass-port-separator)
                     (let p (one-or-more
                             (any (?0 . ?9)))))
                    ?/ (let u (one-or-more
                               (not (any ?@ ?/)))))
               string-end)
              entry))
          (funcall match u h p))
        ;; USER@HOST:PORT
        (pcase-let
            (((rx
               (or string-start ?/)
               (and (zero-or-one (let u (one-or-more
                                         (not (any ?@ ?/))))
                                 ?@)
                    (let h (zero-or-more (not (any ?: ?/))))
                    (zero-or-one
                     (literal auth-source-pass-port-separator)
                     (let p (one-or-more
                             (any (?0 . ?9))))))
               string-end)
              entry))
          (funcall match u h p))))
     (or entries (auth-source-pass-entries)))))

(advice-add #'auth-source-pass--generate-entry-suffixes :override
            #'*auth-source-pass--generate-entry-suffixes--advice)
(advice-add #'auth-source-pass--entries-matching-suffix :override
            #'*auth-source-pass--entries-matching-suffix--advice)
--8<---------------cut here---------------end--------------->8---

-- 
Akib Azmain Turja

Find me on Mastodon at @akib@hostux.social, and on Codeberg (user
"akib").

This message is signed by me with my GnuPG key.  Its fingerprint is:

    7001 8CE5 819F 17A3 BBA6  66AF E74F 0EFA 922A E7F5