gorb/backend
4
0
Fork 0
Code Issues 4 Pull requests 1 Projects Releases Packages 1 Wiki Activity Actions

feat: implement argon2id and expect passwords to be pre-hashed

Browse source
This commit is contained in:
Radical 2025-04-30 21:36:22 +02:00
parent 3461218025
commit 87edb9dd12
4 changed files with 86 additions and 49 deletions
Download patch file Download diff file Expand all files Collapse all files

94
src/api/v1/register.rs
View file

@ -3,6 +3,7 @@ use regex::Regex;
use serde::{Deserialize, Serialize};
use futures::StreamExt;
use uuid::Uuid;
use argon2::{password_hash::{rand_core::OsRng, SaltString}, PasswordHasher};
use crate::Data;
@ -21,6 +22,7 @@ struct ResponseError {
gorb_id_available: bool,
email_valid: bool,
email_available: bool,
password_hashed: bool,
password_minimum_length: bool,
password_special_characters: bool,
password_letters: bool,
@ -35,6 +37,7 @@ impl Default for ResponseError {
gorb_id_available: true,
email_valid: true,
email_available: true,
password_hashed: true,
password_minimum_length: true,
password_special_characters: true,
password_letters: true,
@ -64,7 +67,6 @@ pub async fn res(mut payload: web::Payload, data: web::Data<Data>) -> Result<Htt
}
body.extend_from_slice(&chunk);
}
let account_information = serde_json::from_slice::<AccountInformation>(&body)?;
let uuid = Uuid::now_v7();
@ -92,41 +94,59 @@ pub async fn res(mut payload: web::Payload, data: web::Data<Data>) -> Result<Htt
))
}
// TODO: Check security of this implementation
Ok(match sqlx::query(&format!("INSERT INTO users VALUES ( '{}', $1, NULL, $2, $3, false )", uuid))
.bind(account_information.identifier)
// FIXME: Password has no security currently, either from a client or server perspective
.bind(account_information.password)
.bind(account_information.email)
.execute(&data.pool)
.await {
Ok(_out) => {
HttpResponse::Ok().json(
Response {
access_token: "bogus".to_string(),
user_id: "bogus".to_string(),
expires_in: 1,
refresh_token: "bogus".to_string(),
// Password is expected to be hashed using SHA3-384
let password_regex = Regex::new(r"/[0-9a-f]{96}/i").unwrap();
if !password_regex.is_match(&account_information.password) {
return Ok(HttpResponse::Forbidden().json(
ResponseError {
password_hashed: false,
..Default::default()
}
))
}
let salt = SaltString::generate(&mut OsRng);
if let Ok(hashed_password) = data.argon2.hash_password(account_information.password.as_bytes(), &salt) {
// TODO: Check security of this implementation
return Ok(match sqlx::query(&format!("INSERT INTO users VALUES ( '{}', $1, NULL, $2, $3, false )", uuid))
.bind(account_information.identifier)
// FIXME: Password has no security currently, either from a client or server perspective
.bind(hashed_password.to_string())
.bind(account_information.email)
.execute(&data.pool)
.await {
Ok(_out) => {
HttpResponse::Ok().json(
Response {
access_token: "bogus".to_string(),
user_id: "bogus".to_string(),
expires_in: 1,
refresh_token: "bogus".to_string(),
}
)
},
Err(error) => {
let err_msg = error.as_database_error().unwrap().message();
match err_msg {
err_msg if err_msg.contains("unique") && err_msg.contains("username_key") => HttpResponse::Forbidden().json(ResponseError {
gorb_id_available: false,
..Default::default()
}),
err_msg if err_msg.contains("unique") && err_msg.contains("email_key") => HttpResponse::Forbidden().json(ResponseError {
email_available: false,
..Default::default()
}),
_ => {
eprintln!("{}", err_msg);
HttpResponse::InternalServerError().finish()
}
}
)
},
Err(error) => {
let err_msg = error.as_database_error().unwrap().message();
match err_msg {
err_msg if err_msg.contains("unique") && err_msg.contains("username_key") => HttpResponse::Forbidden().json(ResponseError {
gorb_id_available: false,
..Default::default()
}),
err_msg if err_msg.contains("unique") && err_msg.contains("email_key") => HttpResponse::Forbidden().json(ResponseError {
email_available: false,
..Default::default()
}),
_ => {
eprintln!("{}", err_msg);
HttpResponse::InternalServerError().finish()
}
}
},
})
},
})
}
Ok(HttpResponse::InternalServerError().finish())
}