You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

195 lines
4.8 KiB
Go

10 months ago
package api
import (
9 months ago
"bytes"
"crypto/rand"
"database/sql"
10 months ago
"encoding/base64"
"encoding/json"
"fmt"
"net/http"
9 months ago
"regexp"
10 months ago
"github.com/Flashfyre/pokerogue-server/db"
9 months ago
"golang.org/x/crypto/argon2"
10 months ago
)
9 months ago
const (
argonTime = 1
argonMemory = 256*1024
argonThreads = 4
argonKeyLength = 32
)
var isValidUsername = regexp.MustCompile(`^\w{1,16}$`).MatchString
9 months ago
10 months ago
// /api/account/info - get account info
type AccountInfoResponse struct{
Username string `json:"string"`
}
func (s *Server) HandleAccountInfo(w http.ResponseWriter, r *http.Request) {
if r.Header.Get("Authorization") == "" {
http.Error(w, "missing token", http.StatusBadRequest)
return
}
10 months ago
token, err := base64.StdEncoding.DecodeString(r.Header.Get("Authorization"))
if err != nil {
http.Error(w, fmt.Sprintf("failed to decode token: %s", err), http.StatusBadRequest)
return
}
9 months ago
username, err := db.GetUsernameFromToken(token)
10 months ago
if err != nil {
http.Error(w, err.Error(), http.StatusBadRequest)
return
}
response, err := json.Marshal(AccountInfoResponse{Username: username})
if err != nil {
http.Error(w, fmt.Sprintf("failed to marshal response json: %s", err), http.StatusInternalServerError)
return
}
w.Write(response)
}
// /api/account/register - register account
type AccountRegisterRequest GenericAuthRequest
func (s *Server) HandleAccountRegister(w http.ResponseWriter, r *http.Request) {
10 months ago
var request AccountRegisterRequest
err := json.NewDecoder(r.Body).Decode(&request)
if err != nil {
http.Error(w, fmt.Sprintf("failed to decode request body: %s", err), http.StatusBadRequest)
return
}
if !isValidUsername(request.Username) {
9 months ago
http.Error(w, "invalid username", http.StatusBadRequest)
return
}
if len(request.Password) < 6 {
http.Error(w, "invalid password", http.StatusBadRequest)
return
}
uuid := make([]byte, 16)
_, err = rand.Read(uuid)
if err != nil {
http.Error(w, fmt.Sprintf("failed to generate uuid: %s", err), http.StatusInternalServerError)
return
}
salt := make([]byte, 16)
_, err = rand.Read(salt)
if err != nil {
http.Error(w, fmt.Sprintf("failed to generate salt: %s", err), http.StatusInternalServerError)
return
}
err = db.AddAccountRecord(uuid, request.Username, argon2.IDKey([]byte(request.Password), salt, argonTime, argonMemory, argonThreads, argonKeyLength), salt)
if err != nil {
http.Error(w, fmt.Sprintf("failed to add account record: %s", err), http.StatusInternalServerError)
9 months ago
return
}
w.WriteHeader(http.StatusOK)
10 months ago
}
// /api/account/login - log into account
type AccountLoginRequest GenericAuthRequest
type AccountLoginResponse GenericAuthResponse
func (s *Server) HandleAccountLogin(w http.ResponseWriter, r *http.Request) {
9 months ago
var request AccountLoginRequest
err := json.NewDecoder(r.Body).Decode(&request)
if err != nil {
http.Error(w, fmt.Sprintf("failed to decode request body: %s", err), http.StatusBadRequest)
return
}
if !isValidUsername(request.Username) {
9 months ago
http.Error(w, "invalid username", http.StatusBadRequest)
return
}
if len(request.Password) < 6 {
http.Error(w, "invalid password", http.StatusBadRequest)
return
}
key, salt, err := db.GetAccountKeySaltFromUsername(request.Username)
if err != nil {
if err == sql.ErrNoRows {
http.Error(w, "account doesn't exist", http.StatusBadRequest)
return
}
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}
if !bytes.Equal(key, argon2.IDKey([]byte(request.Password), salt, argonTime, argonMemory, argonThreads, argonKeyLength)) {
http.Error(w, "password doesn't match", http.StatusBadRequest)
return
}
token := make([]byte, 16)
_, err = rand.Read(token)
if err != nil {
http.Error(w, fmt.Sprintf("failed to generate token: %s", err), http.StatusInternalServerError)
return
}
10 months ago
9 months ago
err = db.AddAccountSession(request.Username, token)
if err != nil {
http.Error(w, "failed to add account session", http.StatusInternalServerError)
return
}
response, err := json.Marshal(AccountLoginResponse{Token: base64.StdEncoding.EncodeToString(token)})
if err != nil {
http.Error(w, fmt.Sprintf("failed to marshal response json: %s", err), http.StatusInternalServerError)
return
}
w.Write(response)
10 months ago
}
// /api/account/logout - log out of account
func (s *Server) HandleAccountLogout(w http.ResponseWriter, r *http.Request) {
9 months ago
token, err := base64.StdEncoding.DecodeString(r.Header.Get("Authorization"))
if err != nil {
http.Error(w, fmt.Sprintf("failed to decode token: %s", err), http.StatusBadRequest)
return
}
if len(token) != 32 {
http.Error(w, "invalid token", http.StatusBadRequest)
return
}
err = db.RemoveSessionFromToken(token)
if err != nil {
if err == sql.ErrNoRows {
http.Error(w, "token not found", http.StatusBadRequest)
return
}
http.Error(w, "failed to remove account session", http.StatusInternalServerError)
return
}
10 months ago
9 months ago
w.WriteHeader(http.StatusOK)
10 months ago
}