Commit Graph

16 Commits

Author SHA1 Message Date
shockrah
ab12283507 + Computing encoding key once in a lazy_static
+ unit test verifying is extremely sus.jpg but it looks like it passes
! bs detectors on max rn so i'll keep this under close watch for now
2020-12-29 23:57:11 -08:00
shockrah
b7209c000c Changed token in user params to jwt since token was way too vague 2020-12-28 23:05:31 -08:00
shockrah
7263ae0980 Preventing outsiders from refreshing someone else's token
! Unless their id/secret combo is robbed in which case they're screwed anyway /shrug
2020-12-28 22:16:55 -08:00
shockrah
5366ba9690 * Refactored secret_value generation to be behind an easy to use helper
* Refactored serde facing puller functions to be more clear
- Removing incorrect commentary
* Changed login handler to start using mysql based api
! Further refactoring in the previous to be more readable
2020-12-28 22:00:59 -08:00
shockrah
11251fe6d3 1. adding hmac_secret as a private lazy_static variable
This is only initialized once and is read only after the fact so it should be fine

2. Adding a Claim struct that all JWT's will use for their structure. A helpful .new() function is provided

3. AuthReason::ServerIssue(String) is a now a thing

Should help the auth module be more clear in what's  going on

4. fn get_jwt_json -> renamed from get_jwt to indicate we're getting something from json payload. Nothing more

5. async fn valid_jwt: Attempts to decode the given token, if successful it then looks if that user has given us an active jwt budget-session-key if (returns boolean)

6. wall_entry now returns an AuthReason without the sql wrapping, since thats db-lib's problem anyway

Also we're collecting all data upfront then verifying it as we go.

7. async fn login_get_jwt::ROUTE

On login_auth here we simply create a JWT for the user, store it in cache, then give it back to the user to use.
Tokens take a week to expire

8. Removed busted tests that weren't doing anything useful for the time being
2020-12-22 21:51:23 -08:00
shockrah
5a5ecfad26 Optimizations for buidling memcacache for our tokens 2020-12-20 19:43:27 -08:00
shockrah
88f6e5b532 skeleton code for jwt things 2020-12-18 13:03:30 -08:00
shockrah
13eb58ec06 * Owner perms were not being calculated correctly, this is now fixed 2020-11-21 19:18:40 -08:00
shockrah
8661bcabe7 Removed redudancies and loud error messages 2020-11-21 19:05:44 -08:00
shockrah
ea5162d185 + Better secret generation
+ Helper function to clearly encrypt generated secrets
+ New test for auth::valid_secret as a sanity check
! routes::is_open is no longer retarded and behaves as expected
2020-11-21 13:19:52 -08:00
shockrah
f0f0272c32 Removal of unused uses or random code that was dead anyway 2020-11-16 22:58:58 -08:00
shockrah
ec732dfd34 changed auth calls to use the new db api 2020-10-21 21:40:55 -07:00
shockrah
dfc9f88e66 first sampling of what the lib migration interactions will look like 2020-10-10 19:53:13 -07:00
shockrah
9eff4284a9 + checkin mod::auth for valid permissions
+ helper function for getting a permission mask from permissions module
2020-08-25 23:27:41 -07:00
shockrah
797042b97a Merge branch 'testing' into master 2020-08-22 15:58:13 -07:00
shockrah
0822be3d20 renamed server/ to api/ since this is really only the api portion of the typical fc server 2020-08-22 15:52:37 -07:00