gru/rustpad
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

big features

Browse Source
This commit is contained in:
Mateusz Gruszczyński
2026-07-22 11:03:50 +02:00
parent 0d77624adc
commit 1be2023e36
30 changed files with 1077 additions and 77 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/auth.rs
+188
View File
@@ -0,0 +1,188 @@
use argon2::{password_hash::{PasswordHash, PasswordHasher, PasswordVerifier, SaltString}, Argon2};
use axum::{extract::State, http::{HeaderMap, StatusCode}, Json};
use chrono::{Duration, Utc};
use lettre::{message::Mailbox, AsyncSmtpTransport, AsyncTransport, Message, Tokio1Executor, transport::smtp::authentication::Credentials};
use rand_core::{OsRng, RngCore};
use serde::{Deserialize, Serialize};
use sha2::{Digest, Sha256};
use sqlx::FromRow;
use crate::{queries, state::{SharedState, SmtpConfig}};
const MIN_PASSWORD: usize = 8;
const MAX_PASSWORD: usize = 128;
const MAX_NICKNAME: usize = 40;
#[derive(Debug, Clone, FromRow)]
pub struct User { pub id: i64, pub nickname: String, pub email: String, pub password_hash: String }
#[derive(Deserialize)] pub struct IdentityRequest { nickname: String, #[serde(default)] session_token: Option<String> }
#[derive(Deserialize)] pub struct RegisterRequest { nickname: String, email: String, password: String }
#[derive(Deserialize)] pub struct LoginRequest { email: String, password: String }
#[derive(Deserialize)] pub struct ResetRequest { email: String }
#[derive(Deserialize)] pub struct ResetConfirmRequest { token: String, password: String }
#[derive(Serialize)] pub struct SessionResponse { token: String, nickname: String, email: String, expires_at: String }
#[derive(Serialize)] pub struct IdentityResponse { nickname: String, registered: bool }
pub async fn identity(State(state): State<SharedState>, Json(req): Json<IdentityRequest>) -> Result<Json<IdentityResponse>, AuthError> {
let nickname = validate_nickname(&req.nickname)?;
match find_user_by_nickname(&state, &nickname).await? {
None => Ok(Json(IdentityResponse { nickname, registered: false })),
Some(user) => {
let token = req.session_token.as_deref().ok_or_else(|| AuthError::unauthorized("This nickname is registered. Log in to use it."))?;
let current = user_from_token(&state, token).await?.ok_or_else(|| AuthError::unauthorized("Your session has expired. Log in again."))?;
if current.id != user.id { return Err(AuthError::unauthorized("This nickname belongs to another account.")); }
Ok(Json(IdentityResponse { nickname: user.nickname, registered: true }))
}
}
}
pub async fn register(State(state): State<SharedState>, Json(req): Json<RegisterRequest>) -> Result<(StatusCode, Json<SessionResponse>), AuthError> {
if !state.registration_enabled { return Err(AuthError::forbidden("Registration is disabled.")); }
let nickname = validate_nickname(&req.nickname)?;
let email = validate_email(&req.email)?;
validate_password(&req.password)?;
let nickname_key = normalize(&nickname);
let email_key = normalize(&email);
if find_user_by_nickname(&state, &nickname).await?.is_some() { return Err(AuthError::conflict("This nickname is already registered.")); }
if find_user_by_email(&state, &email).await?.is_some() { return Err(AuthError::conflict("This e-mail address is already registered.")); }
let hash = hash_password(&req.password)?;
sqlx::query(queries::get(state.db.kind(), queries::AUTH_INSERT_USER))
.bind(&nickname).bind(nickname_key).bind(&email).bind(email_key).bind(hash).execute(state.db.pool()).await
.map_err(AuthError::database)?;
let user = find_user_by_nickname(&state, &nickname).await?.ok_or_else(|| AuthError::internal("Failed to create the account."))?;
Ok((StatusCode::CREATED, Json(create_session(&state, &user).await?)))
}
pub async fn login(State(state): State<SharedState>, Json(req): Json<LoginRequest>) -> Result<Json<SessionResponse>, AuthError> {
let email = validate_email(&req.email)?;
let user = find_user_by_email(&state, &email).await?.ok_or_else(|| AuthError::unauthorized("Invalid e-mail address or password."))?;
if !verify_password(&user.password_hash, &req.password) { return Err(AuthError::unauthorized("Invalid e-mail address or password.")); }
Ok(Json(create_session(&state, &user).await?))
}
pub async fn me(State(state): State<SharedState>, headers: HeaderMap) -> Result<Json<SessionResponse>, AuthError> {
let token = bearer(&headers).ok_or_else(|| AuthError::unauthorized("Not logged in."))?;
let user = user_from_token(&state, token).await?.ok_or_else(|| AuthError::unauthorized("Your session has expired."))?;
let expires_at: String = sqlx::query_scalar(queries::get(state.db.kind(), queries::AUTH_SESSION_EXPIRES_AT))
.bind(token).fetch_one(state.db.pool()).await.map_err(AuthError::database)?;
Ok(Json(SessionResponse { token: token.into(), nickname: user.nickname, email: user.email, expires_at }))
}
pub async fn logout(State(state): State<SharedState>, headers: HeaderMap) -> Result<Json<serde_json::Value>, AuthError> {
if let Some(token) = bearer(&headers) { sqlx::query(queries::get(state.db.kind(), queries::AUTH_DELETE_SESSION_BY_TOKEN)).bind(token).execute(state.db.pool()).await.map_err(AuthError::database)?; }
Ok(Json(serde_json::json!({"ok": true})))
}
pub async fn request_reset(State(state): State<SharedState>, Json(req): Json<ResetRequest>) -> Result<Json<serde_json::Value>, AuthError> {
let email = validate_email(&req.email)?;
let smtp = state.smtp.as_ref().ok_or_else(|| AuthError::service_unavailable("Password reset is not configured on this server."))?;
if let Some(user) = find_user_by_email(&state, &email).await? {
let token = random_token();
let expires = (Utc::now() + Duration::minutes(30)).to_rfc3339();
sqlx::query(queries::get(state.db.kind(), queries::AUTH_DELETE_RESET_TOKENS_BY_USER)).bind(user.id).execute(state.db.pool()).await.map_err(AuthError::database)?;
sqlx::query(queries::get(state.db.kind(), queries::AUTH_INSERT_RESET_TOKEN))
.bind(hash_token(&token)).bind(user.id).bind(expires).execute(state.db.pool()).await.map_err(AuthError::database)?;
send_reset(smtp, &user, &token).await?;
}
Ok(Json(serde_json::json!({"ok": true, "message": "If the account exists, a reset link has been sent."})))
}
pub async fn confirm_reset(State(state): State<SharedState>, Json(req): Json<ResetConfirmRequest>) -> Result<Json<serde_json::Value>, AuthError> {
validate_password(&req.password)?;
let now_time = Utc::now();
let now = now_time.to_rfc3339();
let token_hash = hash_token(req.token.trim());
let token_row: Option<(i64, String, Option<String>)> = sqlx::query_as(queries::get(state.db.kind(), queries::AUTH_FIND_RESET_TOKEN))
.bind(&token_hash).fetch_optional(state.db.pool()).await.map_err(AuthError::database)?;
let (user_id, expires_at, used_at) = token_row.ok_or_else(|| AuthError::bad_request("The reset link is invalid or has expired."))?;
let expires_at = chrono::DateTime::parse_from_rfc3339(&expires_at)
.map_err(|_| AuthError::bad_request("The reset link is invalid or has expired."))?
.with_timezone(&Utc);
if used_at.is_some() || expires_at <= now_time {
return Err(AuthError::bad_request("The reset link is invalid or has expired."));
}
let password_hash = hash_password(&req.password)?;
let mut tx = state.db.pool().begin().await.map_err(AuthError::database)?;
let updated = sqlx::query(queries::get(state.db.kind(), queries::AUTH_UPDATE_PASSWORD))
.bind(password_hash).bind(&now).bind(user_id).execute(&mut *tx).await.map_err(AuthError::database)?;
if updated.rows_affected() != 1 { return Err(AuthError::internal("The account could not be updated.")); }
sqlx::query(queries::get(state.db.kind(), queries::AUTH_MARK_RESET_TOKEN_USED))
.bind(&now).bind(&token_hash).execute(&mut *tx).await.map_err(AuthError::database)?;
sqlx::query(queries::get(state.db.kind(), queries::AUTH_DELETE_SESSIONS_BY_USER))
.bind(user_id).execute(&mut *tx).await.map_err(AuthError::database)?;
tx.commit().await.map_err(AuthError::database)?;
Ok(Json(serde_json::json!({"ok": true})))
}
pub async fn user_from_token(state: &SharedState, token: &str) -> Result<Option<User>, AuthError> {
let now = Utc::now().to_rfc3339();
sqlx::query_as::<_, User>(queries::get(state.db.kind(), queries::AUTH_USER_BY_SESSION))
.bind(token).bind(now).fetch_optional(state.db.pool()).await.map_err(AuthError::database)
}
pub async fn authorize_nickname(state: &SharedState, nickname: Option<String>, token: Option<String>) -> Result<Option<String>, String> {
let Some(nickname) = nickname else { return Ok(None); };
let nickname = validate_nickname(&nickname).map_err(|e| e.message)?;
let registered = find_user_by_nickname(state, &nickname).await.map_err(|_| "Database error".to_string())?;
match registered {
None => Ok(Some(nickname)),
Some(owner) => {
let Some(token) = token else { return Err("This nickname is registered. Log in to use it.".into()); };
let current = user_from_token(state, &token).await.map_err(|_| "Database error".to_string())?;
match current { Some(user) if user.id == owner.id => Ok(Some(owner.nickname)), _ => Err("This nickname belongs to another account or the session expired.".into()) }
}
}
}
async fn create_session(state: &SharedState, user: &User) -> Result<SessionResponse, AuthError> {
let token = random_token();
let expires_at = (Utc::now() + Duration::days(30)).to_rfc3339();
sqlx::query(queries::get(state.db.kind(), queries::AUTH_INSERT_SESSION))
.bind(&token).bind(user.id).bind(&expires_at).execute(state.db.pool()).await.map_err(AuthError::database)?;
Ok(SessionResponse { token, nickname: user.nickname.clone(), email: user.email.clone(), expires_at })
}
async fn find_user_by_nickname(state: &SharedState, nickname: &str) -> Result<Option<User>, AuthError> {
sqlx::query_as::<_, User>(queries::get(state.db.kind(), queries::AUTH_USER_BY_NICKNAME))
.bind(normalize(nickname)).fetch_optional(state.db.pool()).await.map_err(AuthError::database)
}
async fn find_user_by_email(state: &SharedState, email: &str) -> Result<Option<User>, AuthError> {
sqlx::query_as::<_, User>(queries::get(state.db.kind(), queries::AUTH_USER_BY_EMAIL))
.bind(normalize(email)).fetch_optional(state.db.pool()).await.map_err(AuthError::database)
}
fn validate_nickname(v: &str) -> Result<String, AuthError> { let v=v.trim(); if v.is_empty() || v.chars().count()>MAX_NICKNAME { return Err(AuthError::bad_request("Nickname must contain 1 to 40 characters.")); } if v.chars().any(|c| c.is_control()) { return Err(AuthError::bad_request("Nickname contains invalid characters.")); } Ok(v.into()) }
fn validate_email(v: &str) -> Result<String, AuthError> { let v=v.trim(); if v.len()>320 || !v.contains('@') || v.starts_with('@') || v.ends_with('@') { return Err(AuthError::bad_request("Enter a valid e-mail address.")); } Ok(v.into()) }
fn validate_password(v: &str) -> Result<(), AuthError> { if v.len()<MIN_PASSWORD || v.len()>MAX_PASSWORD { Err(AuthError::bad_request("Password must contain 8 to 128 characters.")) } else { Ok(()) } }
fn normalize(v: &str)->String { v.trim().to_lowercase() }
fn hash_password(v:&str)->Result<String,AuthError>{let salt=SaltString::generate(&mut OsRng);Argon2::default().hash_password(v.as_bytes(),&salt).map(|h|h.to_string()).map_err(|_|AuthError::internal("Failed to secure the password."))}
fn verify_password(hash:&str,v:&str)->bool{PasswordHash::new(hash).ok().and_then(|h|Argon2::default().verify_password(v.as_bytes(),&h).ok()).is_some()}
fn random_token()->String{let mut bytes=[0u8;32];let mut rng=OsRng;rng.fill_bytes(&mut bytes);bytes.iter().map(|b|format!("{b:02x}")).collect()}
fn hash_token(v:&str)->String{format!("{:x}",Sha256::digest(v.as_bytes()))}
fn bearer(headers:&HeaderMap)->Option<&str>{headers.get("authorization")?.to_str().ok()?.strip_prefix("Bearer ")}
async fn send_reset(smtp:&SmtpConfig,user:&User,token:&str)->Result<(),AuthError>{
let url=format!("{}/?reset_token={}",smtp.public_url.trim_end_matches('/'),token);
let message=Message::builder().from(smtp.from.parse::<Mailbox>().map_err(|_|AuthError::internal("Invalid SMTP_FROM."))?).to(user.email.parse::<Mailbox>().map_err(|_|AuthError::internal("Invalid recipient address."))?).subject("RustPad password reset").body(format!("Hello {},\n\nUse this link within 30 minutes to set a new password:\n{}\n\nIf you did not request this, ignore this message.",user.nickname,url)).map_err(|_|AuthError::internal("Failed to build reset e-mail."))?;
// Port 465 uses implicit TLS. Standard submission ports (usually 587)
// require STARTTLS; using implicit TLS there causes an immediate SMTP failure.
let mut builder = if smtp.port == 465 {
AsyncSmtpTransport::<Tokio1Executor>::relay(&smtp.host)
} else {
AsyncSmtpTransport::<Tokio1Executor>::starttls_relay(&smtp.host)
}
.map_err(|error| {
tracing::error!(error=%error, host=%smtp.host, port=smtp.port, "invalid SMTP configuration");
AuthError::internal("Invalid SMTP configuration.")
})?
.port(smtp.port);
if !smtp.username.is_empty() { builder=builder.credentials(Credentials::new(smtp.username.clone(),smtp.password.clone())); }
let mailer=builder.build();
mailer.send(message).await.map_err(|error| {
tracing::error!(error=%error, host=%smtp.host, port=smtp.port, "password reset e-mail failed");
AuthError::service_unavailable("The reset e-mail could not be sent. Check the SMTP configuration.")
})?;
Ok(())
}
pub struct AuthError { status: StatusCode, pub message: String }
impl AuthError { fn bad_request(m:&str)->Self{Self{status:StatusCode::BAD_REQUEST,message:m.into()}} fn unauthorized(m:&str)->Self{Self{status:StatusCode::UNAUTHORIZED,message:m.into()}} fn forbidden(m:&str)->Self{Self{status:StatusCode::FORBIDDEN,message:m.into()}} fn conflict(m:&str)->Self{Self{status:StatusCode::CONFLICT,message:m.into()}} fn internal(m:&str)->Self{Self{status:StatusCode::INTERNAL_SERVER_ERROR,message:m.into()}} fn service_unavailable(m:&str)->Self{Self{status:StatusCode::SERVICE_UNAVAILABLE,message:m.into()}} fn database(e:sqlx::Error)->Self{tracing::error!(error=%e,"authentication database error");Self::internal("Database error.")} }
impl axum::response::IntoResponse for AuthError { fn into_response(self)->axum::response::Response{(self.status,Json(serde_json::json!({"error":self.message}))).into_response()} }