diff --git a/migrations/2023-08-26-071607_accounts/up.sql b/migrations/2023-08-26-071607_accounts/up.sql index f17d4e9..a0be4b2 100644 --- a/migrations/2023-08-26-071607_accounts/up.sql +++ b/migrations/2023-08-26-071607_accounts/up.sql @@ -9,6 +9,7 @@ CREATE TABLE accounts ( username VARCHAR(20) NOT NULL COLLATE case_insensitive UNIQUE, gjp2 TEXT NOT NULL, -- argon2 hashed (rubrub uses bcrypt but oh well) + password TEXT NOT NULL, -- argon2 hashed (rubrub uses bcrypt but oh well) email VARCHAR(254) NOT NULL, -- todo: swap to proper rank system diff --git a/src/db/models.rs b/src/db/models.rs index f7452c1..0dd7f17 100644 --- a/src/db/models.rs +++ b/src/db/models.rs @@ -7,6 +7,7 @@ pub struct Account { pub id: i32, pub username: String, + pub password: String, pub gjp2: String, pub email: String, @@ -29,7 +30,8 @@ pub struct Account { pub struct NewAccount { pub username: String, pub gjp2: String, - pub email: String + pub password: String, + pub email: String, } #[derive(Queryable, Serialize)] diff --git a/src/db/schema.rs b/src/db/schema.rs index ab0d3dc..1a25502 100644 --- a/src/db/schema.rs +++ b/src/db/schema.rs @@ -6,6 +6,7 @@ diesel::table! { #[max_length = 20] username -> Varchar, gjp2 -> Text, + password -> Text, #[max_length = 254] email -> Varchar, is_admin -> Int4, diff --git a/src/endpoints/accounts/login_account.rs b/src/endpoints/accounts/login_account.rs index affb5c5..f84fa50 100644 --- a/src/endpoints/accounts/login_account.rs +++ b/src/endpoints/accounts/login_account.rs @@ -34,18 +34,18 @@ pub fn login_account(input: Form) -> status::Custom<&'static s { use crate::schema::accounts::dsl::*; - let account_id_gjp2_result = accounts - .select((id, gjp2)) + let account_id_password_result = accounts + .select((id, password)) .filter(username.eq(input.userName.clone())) .get_result::<(i32, String)>(connection); - match account_id_gjp2_result { - Ok(account_id_gjp2) => { - let user_id = helpers::accounts::get_user_id_from_account_id(account_id_gjp2.0); + match account_id_password_result { + Ok(account_id_password) => { + let user_id = helpers::accounts::get_user_id_from_account_id(account_id_password.0); - match verify_password(helpers::encryption::get_gjp2(input.password.clone()).as_bytes(), account_id_gjp2.1.as_str()) { + match verify_password(input.password.clone().as_bytes(), account_id_password.1.as_str()) { Ok(_) => return status::Custom(Status::Ok, - Box::leak(format!("{},{}", account_id_gjp2.0, user_id).into_boxed_str()) + Box::leak(format!("{},{}", account_id_password.0, user_id).into_boxed_str()) ), Err(_) => return status::Custom(Status::Ok, "-11") }; diff --git a/src/endpoints/accounts/register_account.rs b/src/endpoints/accounts/register_account.rs index c00b70a..c754a52 100644 --- a/src/endpoints/accounts/register_account.rs +++ b/src/endpoints/accounts/register_account.rs @@ -5,6 +5,8 @@ use rocket::response::status; use diesel::prelude::*; use diesel::result::Error; +use password_auth::generate_hash; + use crate::CONFIG; use crate::helpers; use crate::db; @@ -60,7 +62,8 @@ pub fn register_account(input: Form) -> status::Custom<&'st let new_account = NewAccount { username: input.userName.clone(), - gjp2: helpers::encryption::get_gjp2_hashed(input.password.clone()), + password: generate_hash(input.password.clone()), + gjp2: generate_hash(helpers::encryption::get_gjp2(input.password.clone())), email: input.email.clone() }; inserted_account = diesel::insert_into(accounts) diff --git a/src/helpers/encryption.rs b/src/helpers/encryption.rs index 018b0e9..fb3f088 100644 --- a/src/helpers/encryption.rs +++ b/src/helpers/encryption.rs @@ -14,15 +14,11 @@ pub fn cyclic_xor_string(string: &str, key: &str) -> String { let data = string.as_bytes(); let key_bytes = key.as_bytes(); let result_bytes = cyclic_xor(data, key_bytes); - let result_str = String::from_utf8(result_bytes).expect("invalid UTF-8 sequence (L)"); + let result_str = String::from_utf8(result_bytes).expect("invalid UTF-8 sequence (how did this happen?)"); return String::from(result_str); } pub fn get_gjp2(password: String) -> String { return Sha1::default().digest(String::from(password + "mI29fmAnxgTs").as_bytes()).to_hex(); -} - -pub fn get_gjp2_hashed(password: String) -> String { - return generate_hash(get_gjp2(password)) } \ No newline at end of file