92 lines
2.4 KiB
Rust
92 lines
2.4 KiB
Rust
use axum_login::{AuthUser, AuthnBackend, UserId};
|
|
use sea_orm::{DatabaseConnection, EntityTrait, ColumnTrait, QueryFilter};
|
|
use argon2::{
|
|
password_hash::{rand_core::OsRng, PasswordHash, PasswordHasher, PasswordVerifier, SaltString},
|
|
Argon2,
|
|
};
|
|
|
|
use crate::models::{user, User};
|
|
|
|
#[derive(Debug, Clone)]
|
|
pub struct AuthBackend {
|
|
pub db: DatabaseConnection,
|
|
}
|
|
|
|
impl AuthUser for user::Model {
|
|
type Id = i32;
|
|
|
|
fn id(&self) -> Self::Id {
|
|
self.id
|
|
}
|
|
|
|
fn session_auth_hash(&self) -> &[u8] {
|
|
self.password_hash.as_deref().unwrap_or("oauth").as_bytes()
|
|
}
|
|
}
|
|
|
|
#[derive(Debug, thiserror::Error)]
|
|
pub enum Error {
|
|
#[error("Database error: {0}")]
|
|
Database(#[from] sea_orm::DbErr),
|
|
#[error("Password hashing error")]
|
|
PasswordHash,
|
|
#[error("Invalid credentials")]
|
|
InvalidCredentials,
|
|
}
|
|
|
|
#[derive(Debug, Clone)]
|
|
pub struct Credentials {
|
|
pub username: String,
|
|
pub password: String,
|
|
}
|
|
|
|
#[async_trait::async_trait]
|
|
impl AuthnBackend for AuthBackend {
|
|
type User = user::Model;
|
|
type Credentials = Credentials;
|
|
type Error = Error;
|
|
|
|
async fn authenticate(
|
|
&self,
|
|
creds: Self::Credentials,
|
|
) -> Result<Option<Self::User>, Self::Error> {
|
|
let user = User::find()
|
|
.filter(user::Column::Username.eq(&creds.username))
|
|
.one(&self.db)
|
|
.await?;
|
|
|
|
if let Some(user) = user {
|
|
let password_hash = user.password_hash.as_ref().ok_or(Error::InvalidCredentials)?;
|
|
let parsed_hash = PasswordHash::new(password_hash)
|
|
.map_err(|_| Error::PasswordHash)?;
|
|
|
|
let is_valid = Argon2::default()
|
|
.verify_password(creds.password.as_bytes(), &parsed_hash)
|
|
.is_ok();
|
|
|
|
if is_valid {
|
|
Ok(Some(user))
|
|
} else {
|
|
Err(Error::InvalidCredentials)
|
|
}
|
|
} else {
|
|
Err(Error::InvalidCredentials)
|
|
}
|
|
}
|
|
|
|
async fn get_user(&self, user_id: &UserId<Self>) -> Result<Option<Self::User>, Self::Error> {
|
|
let user = User::find_by_id(*user_id).one(&self.db).await?;
|
|
Ok(user)
|
|
}
|
|
}
|
|
|
|
pub fn hash_password(password: &str) -> Result<String, Error> {
|
|
let salt = SaltString::generate(&mut OsRng);
|
|
let argon2 = Argon2::default();
|
|
|
|
argon2
|
|
.hash_password(password.as_bytes(), &salt)
|
|
.map(|hash| hash.to_string())
|
|
.map_err(|_| Error::PasswordHash)
|
|
}
|