gorb/backend
4
0
Fork 0
Code Issues 4 Pull requests 1 Projects Releases Packages 1 Wiki Activity Actions

feat: integrate token authentication

Browse source
This commit is contained in:
Radical 2025-05-01 05:01:25 +02:00
parent 1d0f8ecd00
commit 725a16d1f5
6 changed files with 154 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

32
src/api/v1/auth/register.rs
View file

@ -7,7 +7,7 @@ use futures::StreamExt;
use uuid::Uuid;
use argon2::{password_hash::{rand_core::OsRng, SaltString}, PasswordHasher};
use crate::Data;
use crate::{crypto::{generate_access_token, generate_refresh_token}, Data};
#[derive(Deserialize)]
struct AccountInformation {
@ -95,7 +95,7 @@ pub async fn res(mut payload: web::Payload, data: web::Data<Data>) -> Result<Htt
}
// Password is expected to be hashed using SHA3-384
let password_regex = Regex::new(r"/[0-9a-f]{96}/i").unwrap();
let password_regex = Regex::new(r"[0-9a-f]{96}").unwrap();
if !password_regex.is_match(&account_information.password) {
return Ok(HttpResponse::Forbidden().json(
@ -110,7 +110,7 @@ pub async fn res(mut payload: web::Payload, data: web::Data<Data>) -> Result<Htt
if let Ok(hashed_password) = data.argon2.hash_password(account_information.password.as_bytes(), &salt) {
// TODO: Check security of this implementation
return Ok(match sqlx::query(&format!("INSERT INTO users (uuid, username, password, email,) VALUES ( '{}', $1, $2, $3 )", uuid))
return Ok(match sqlx::query(&format!("INSERT INTO users (uuid, username, password, email) VALUES ( '{}', $1, $2, $3 )", uuid))
.bind(account_information.identifier)
// FIXME: Password has no security currently, either from a client or server perspective
.bind(hashed_password.to_string())
@ -118,13 +118,27 @@ pub async fn res(mut payload: web::Payload, data: web::Data<Data>) -> Result<Htt
.execute(&data.pool)
.await {
Ok(_out) => {
let refresh_token = todo!();
let access_token = todo!();
let refresh_token = generate_refresh_token();
let access_token = generate_access_token();
if refresh_token.is_err() {
eprintln!("{}", refresh_token.unwrap_err());
return Ok(HttpResponse::InternalServerError().finish())
}
let refresh_token = refresh_token.unwrap();
if access_token.is_err() {
eprintln!("{}", access_token.unwrap_err());
return Ok(HttpResponse::InternalServerError().finish())
}
let access_token = access_token.unwrap();
let current_time = SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs() as i64;
if let Err(error) = sqlx::query(&format!("INSERT INTO refresh_tokens (token, uuid, created) VALUES ($1, '{}', $2 )", uuid))
.bind(refresh_token)
.bind(&refresh_token)
.bind(current_time)
.execute(&data.pool)
.await {
@ -132,9 +146,9 @@ pub async fn res(mut payload: web::Payload, data: web::Data<Data>) -> Result<Htt
return Ok(HttpResponse::InternalServerError().finish())
}
if let Err(error) = sqlx::query(&format!("INSERT INTO refresh_tokens (token, refresh_token, uuid, created) VALUES ($1, $2, '{}', $3 )", uuid))
.bind(access_token)
.bind(refresh_token)
if let Err(error) = sqlx::query(&format!("INSERT INTO access_tokens (token, refresh_token, uuid, created) VALUES ($1, $2, '{}', $3 )", uuid))
.bind(&access_token)
.bind(&refresh_token)
.bind(current_time)
.execute(&data.pool)
.await {