server/cmd/api/api.go

@@ -97,7 +97,14 @@ func getUserFromReq(opts config.Options, req *http.Request) (u *db.User, err err
 
 	opts.Logger.Printf("checking auth for %s", username)
 
-	u, err = checkAuth(opts, username, hash)
+	if u, err = db.GetUserByName(opts.DB, username); err != nil {
+		return
+	}
+
+	if u.Hash != hash {
+		u = nil
+		err = errors.New("bad credentials")
+	}
 
 	return
 }
@@ -125,44 +132,6 @@ func (a *API) InstanceInfo(ctx *ReqCtx) (resp *BBJResponse, err error) {
 	return
 }
 
-func (a *API) CheckAuth(ctx *ReqCtx) (resp *BBJResponse, err error) {
-	if !ctx.IsPost() {
-		err = badMethod()
-		return
-	}
-	type AuthArgs struct {
-		Username string `json:"target_user"`
-		Hash     string `json:"target_hash"`
-	}
-
-	var args AuthArgs
-	if err = json.NewDecoder(ctx.Req.Body).Decode(&args); err != nil {
-		err = invalidArgs(err.Error())
-		return
-	}
-
-	if args.Hash == "" || args.Username == "" {
-		err = invalidArgs("missing either username or auth hash")
-		return
-	}
-
-	_, err = checkAuth(a.Opts, args.Username, args.Hash)
-	if err != nil {
-		if err.Error() != "bad credentials" {
-			return
-		}
-		err = &HTTPError{Code: 403, Msg: err.Error()}
-		return
-	}
-
-	// TODO usermap
-	resp = &BBJResponse{
-		Data: true,
-	}
-
-	return
-}
-
 func (a *API) UserRegister(ctx *ReqCtx) (resp *BBJResponse, err error) {
 	if !ctx.IsPost() {
 		err = badMethod()
@@ -184,7 +153,7 @@ func (a *API) UserRegister(ctx *ReqCtx) (resp *BBJResponse, err error) {
 		return
 	}
 
-	if _, err = checkAuth(a.Opts, args.Username, args.Hash); err == nil {
+	if err = checkAuth(a.Opts, args.Username, args.Hash); err == nil {
 		a.Opts.Logger.Printf("user %s already registered", args.Username)
 		err = &HTTPError{Code: 403, Msg: "user already exists"}
 		return
@@ -204,9 +173,9 @@ func (a *API) UserRegister(ctx *ReqCtx) (resp *BBJResponse, err error) {
 	return
 }
 
-// checkAuth returns an error if username is not associated with hash
+func checkAuth(opts config.Options, username, hash string) (err error) {
-func checkAuth(opts config.Options, username, hash string) (user *db.User, err error) {
 	opts.Logger.Printf("querying for %s", username)
+	var user *db.User
 	if user, err = db.GetUserByName(opts.DB, username); err != nil {
 		return
 	}

server/cmd/api/api_test.go

@@ -41,137 +41,6 @@ func userCount(db *sql.DB) (count int, err error) {
 	return
 }
 
-func Test_CheckAuth(t *testing.T) {
-	ts := []struct {
-		name    string
-		req     func() *http.Request
-		setup   func(*config.Options) error
-		assert  func(*BBJResponse, *testing.T)
-		wantErr *HTTPError
-	}{
-		{
-			name: "blank user",
-			req: func() *http.Request {
-				req, _ := http.NewRequest("POST", "/check_auth", strings.NewReader(`{"target_hash":"abc123"}`))
-				return req
-			},
-			wantErr: &HTTPError{Code: 400, Msg: "invalid args: missing either username or auth hash"},
-		},
-		{
-			name: "blank hash",
-			req: func() *http.Request {
-				req, _ := http.NewRequest("POST", "/check_auth", strings.NewReader(`{"target_user":"jillvalentine"}`))
-				return req
-			},
-			wantErr: &HTTPError{Code: 400, Msg: "invalid args: missing either username or auth hash"},
-		},
-		{
-			name: "bad method",
-			req: func() *http.Request {
-				r, _ := http.NewRequest("GET", "", strings.NewReader(""))
-				return r
-			},
-			wantErr: &HTTPError{
-				Msg:  "bad method",
-				Code: 400,
-			},
-		},
-		{
-			name: "mismatch hash",
-			setup: func(opts *config.Options) error {
-				return db.CreateUser(opts.DB, db.User{
-					Username: "jillvalentine",
-					Hash:     "xyz789",
-					Created:  time.Now(),
-				})
-			},
-			req: func() *http.Request {
-				req, _ := http.NewRequest("POST", "/check_auth", strings.NewReader(`{"target_user":"jillvalentine", "target_hash":"abc123"}`))
-				return req
-			},
-			wantErr: &HTTPError{Code: 403, Msg: "bad credentials"},
-		},
-		{
-			name: "good",
-			setup: func(opts *config.Options) error {
-				return db.CreateUser(opts.DB, db.User{
-					Username: "jillvalentine",
-					Hash:     "xyz789",
-					Created:  time.Now(),
-				})
-			},
-			req: func() *http.Request {
-				req, _ := http.NewRequest("POST", "/check_auth", strings.NewReader(`{"target_user":"jillvalentine", "target_hash":"xyz789"}`))
-				return req
-			},
-			assert: func(resp *BBJResponse, t *testing.T) {
-				if !resp.Data.(bool) {
-					t.Error("expected true Data")
-				}
-			},
-		},
-	}
-
-	for _, tt := range ts {
-		t.Run(tt.name, func(t *testing.T) {
-			// TODO BOILERPLATE
-			opts, err := createTestState()
-			if err != nil {
-				t.Fatalf("failed to create test state: %s", err.Error())
-				return
-			}
-			var req *http.Request
-			if tt.req == nil {
-				req, _ = http.NewRequest("POST", "", strings.NewReader(`{"user_name":"albertwesker","auth_hash":"1234abc"}`))
-			} else {
-				req = tt.req()
-			}
-			teardown, err := db.Setup(opts)
-			if err != nil {
-				t.Fatalf("could not initialize DB: %s", err.Error())
-				return
-			}
-			defer teardown()
-
-			err = db.EnsureSchema(*opts)
-			if err != nil {
-				t.Fatalf("could not initialize DB: %s", err.Error())
-				return
-			}
-
-			if tt.setup != nil {
-				err = tt.setup(opts)
-				if err != nil {
-					t.Fatalf("setup failed: %s", err.Error())
-					return
-				}
-			}
-			// END BOILERPLATE
-
-			api := &API{Opts: *opts}
-			ctx := &ReqCtx{Req: req}
-			var resp *BBJResponse
-			resp, err = api.CheckAuth(ctx)
-			if err != nil {
-				if tt.wantErr == nil || tt.wantErr.Error() != err.Error() {
-					t.Errorf("got unexpected error: %s", err)
-				}
-				return
-			} else {
-				if tt.wantErr != nil {
-					t.Error("expected error, got none")
-					return
-				}
-			}
-
-			if tt.assert != nil {
-				tt.assert(resp, t)
-			}
-
-		})
-	}
-}
-
 func Test_UserRegister(t *testing.T) {
 	ts := []struct {
 		name    string

server/cmd/main.go

@@ -88,12 +88,69 @@ func setupAPI(opts config.Options) {
 		a.Invoke(w, req, a.UserRegister)
 	})
 
-	http.HandleFunc("/check_auth", func(w http.ResponseWriter, req *http.Request) {
-		a.Invoke(w, req, a.CheckAuth)
-	})
 }
 
 /*
+	http.HandleFunc("/check_auth", handler(opts, func(w http.ResponseWriter, req *http.Request) {
+		if req.Method != "POST" {
+			badMethod(w)
+			return
+		}
+
+		type AuthArgs struct {
+			Username string `json:"target_user"`
+			AuthHash string `json:"target_hash"`
+		}
+
+		var args AuthArgs
+		if err := json.NewDecoder(req.Body).Decode(&args); err != nil {
+			invalidArgs(w)
+			return
+		}
+
+		opts.Logf("got %s %s", args.Username, args.AuthHash)
+
+		db := opts.DB
+
+		stmt, err := db.Prepare("select auth_hash from users where user_name = ?")
+		if err != nil {
+			serverErr(w, err)
+			return
+		}
+		defer stmt.Close()
+
+		var authHash string
+		err = stmt.QueryRow(args.Username).Scan(&authHash)
+		if err != nil {
+			if strings.Contains(err.Error(), "no rows in result") {
+				opts.Logf("user not found")
+				writeErrorResponse(w, 404, BBJResponse{
+					Error: true,
+					Data:  "user not found",
+				})
+			} else {
+				serverErr(w, err)
+			}
+			return
+		}
+
+		// TODO unique constraint on user_name
+
+		if authHash != args.AuthHash {
+			http.Error(w, "incorrect password", 403)
+			writeErrorResponse(w, 403, BBJResponse{
+				Error: true,
+				Data:  "incorrect password",
+			})
+			return
+		}
+
+		// TODO include usermap?
+		writeResponse(w, BBJResponse{
+			Data: true,
+		})
+	}))
+
 	http.HandleFunc("/thread_index", handler(opts, func(w http.ResponseWriter, req *http.Request) {
 		db := opts.DB
 		rows, err := db.Query("SELECT * FROM threads JOIN messages ON threads.thread_id = messages.thread_id")