evan/AnthoLume
evan/AnthoLume
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix(settings): auth hash accidentally overridden
Some checks reported errors
continuous-integration/drone/push Build encountered an error
Details

Browse Source
This commit is contained in:
Evan Reichard 2024-01-28 22:17:58 -05:00
parent a86e2520ef
commit 31c71bda74
4 changed files with 19 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
api/auth.go
View File

@ -44,12 +44,12 @@ func (api *API) authorizeCredentials(username string, password string) (auth *au
} }
// Update Auth Cache // Update Auth Cache
api.userAuthCache[user.ID] = user.AuthHash api.userAuthCache[user.ID] = *user.AuthHash
return &authData{ return &authData{
UserName: user.ID, UserName: user.ID,
IsAdmin: user.Admin, IsAdmin: user.Admin,
AuthHash: user.AuthHash, AuthHash: *user.AuthHash,
} }
} }
@ -215,10 +215,11 @@ func (api *API) appAuthRegister(c *gin.Context) {
} }
// Create User in DB // Create User in DB
authHash := fmt.Sprintf("%x", rawAuthHash)
rows, err := api.db.Queries.CreateUser(api.db.Ctx, database.CreateUserParams{ rows, err := api.db.Queries.CreateUser(api.db.Ctx, database.CreateUserParams{
ID: username, ID: username,
Pass: &hashedPassword, Pass: &hashedPassword,
AuthHash: fmt.Sprintf("%x", rawAuthHash), AuthHash: &authHash,
}) })
// SQL Error // SQL Error
@ -250,7 +251,7 @@ func (api *API) appAuthRegister(c *gin.Context) {
auth := authData{ auth := authData{
UserName: user.ID, UserName: user.ID,
IsAdmin: user.Admin, IsAdmin: user.Admin,
AuthHash: user.AuthHash, AuthHash: *user.AuthHash,
} }
session := sessions.Default(c) session := sessions.Default(c)
if err := api.setSession(session, auth); err != nil { if err := api.setSession(session, auth); err != nil {
@ -303,10 +304,11 @@ func (api *API) koAuthRegister(c *gin.Context) {
return return
} }
authHash := fmt.Sprintf("%x", rawAuthHash)
rows, err := api.db.Queries.CreateUser(api.db.Ctx, database.CreateUserParams{ rows, err := api.db.Queries.CreateUser(api.db.Ctx, database.CreateUserParams{
ID: rUser.Username, ID: rUser.Username,
Pass: &hashedPassword, Pass: &hashedPassword,
AuthHash: fmt.Sprintf("%x", rawAuthHash), AuthHash: &authHash,
}) })
if err != nil { if err != nil {
log.Error("CreateUser DB Error:", err) log.Error("CreateUser DB Error:", err)
@ -383,7 +385,7 @@ func (api *API) getUserAuthHash(username string) (string, error) {
} }
// Update Cache // Update Cache
api.userAuthCache[username] = user.AuthHash api.userAuthCache[username] = *user.AuthHash
return api.userAuthCache[username], nil return api.userAuthCache[username], nil
} }
@ -397,9 +399,10 @@ func (api *API) rotateUserAuthHash(username string) error {
} }
// Update User // Update User
authHash := fmt.Sprintf("%x", rawAuthHash)
if _, err = api.db.Queries.UpdateUser(api.db.Ctx, database.UpdateUserParams{ if _, err = api.db.Queries.UpdateUser(api.db.Ctx, database.UpdateUserParams{
UserID: username, UserID: username,
AuthHash: fmt.Sprintf("%x", rawAuthHash), AuthHash: &authHash,
}); err != nil { }); err != nil {
log.Error("UpdateUser DB Error: ", err) log.Error("UpdateUser DB Error: ", err)
return err return err
@ -437,9 +440,10 @@ func (api *API) rotateAllAuthHashes() error {
} }
// Update User // Update User
authHash := fmt.Sprintf("%x", rawAuthHash)
if _, err = qtx.UpdateUser(api.db.Ctx, database.UpdateUserParams{ if _, err = qtx.UpdateUser(api.db.Ctx, database.UpdateUserParams{
UserID: user.ID, UserID: user.ID,
AuthHash: fmt.Sprintf("%x", rawAuthHash), AuthHash: &authHash,
}); err != nil { }); err != nil {
return err return err
} }

2
database/models.go
View File

@ -96,7 +96,7 @@ type Metadatum struct {
type User struct { type User struct {
ID string `json:"id"` ID string `json:"id"`
Pass *string `json:"-"` Pass *string `json:"-"`
AuthHash string `json:"auth_hash"` AuthHash *string `json:"auth_hash"`
Admin bool `json:"-"` Admin bool `json:"-"`
TimeOffset *string `json:"time_offset"` TimeOffset *string `json:"time_offset"`
CreatedAt string `json:"created_at"` CreatedAt string `json:"created_at"`

4
database/query.sql.go
View File

@ -121,7 +121,7 @@ ON CONFLICT DO NOTHING
type CreateUserParams struct { type CreateUserParams struct {
ID string `json:"id"` ID string `json:"id"`
Pass *string `json:"-"` Pass *string `json:"-"`
AuthHash string `json:"auth_hash"` AuthHash *string `json:"auth_hash"`
} }
func (q *Queries) CreateUser(ctx context.Context, arg CreateUserParams) (int64, error) { func (q *Queries) CreateUser(ctx context.Context, arg CreateUserParams) (int64, error) {
@ -1225,7 +1225,7 @@ RETURNING id, pass, auth_hash, admin, time_offset, created_at
type UpdateUserParams struct { type UpdateUserParams struct {
Password *string `json:"-"` Password *string `json:"-"`
AuthHash string `json:"auth_hash"` AuthHash *string `json:"auth_hash"`
TimeOffset *string `json:"time_offset"` TimeOffset *string `json:"time_offset"`
UserID string `json:"user_id"` UserID string `json:"user_id"`
} }

4
sqlc.yaml
View File

@ -123,6 +123,10 @@ sql:
go_type: go_type:
type: "string" type: "string"
pointer: true pointer: true
- column: "users.auth_hash"
go_type:
type: "string"
pointer: true
# Override Time # Override Time
- db_type: "DATETIME" - db_type: "DATETIME"