jtom38/go-cook
2
0
Fork 0
Code Issues 9 Pull Requests Packages Projects Releases Wiki Activity

found a bug that would let the same username get used over and over

Browse Source
This commit is contained in:
James Tombleson 2024-04-01 17:48:38 -07:00
parent f591dadd3b
commit b3ee4e420b
1 changed files with 25 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
api/handlers/v1/auth.go
View File

@ -4,6 +4,7 @@ import (
"errors"
"go-cook/api/domain"
"go-cook/api/repositories"
"log"
"net/http"
"github.com/golang-jwt/jwt/v5"
@ -11,16 +12,20 @@ import (
)
const (
ErrJwtMissing = "auth token is missing"
ErrJwtClaimsMissing = "claims missing on token"
ErrJwtExpired = "auth token has expired"
ErrJwtScopeMissing = "required scope is missing"
ErrUserNotFound = "requested user does not exist"
ErrJwtMissing = "auth token is missing"
ErrJwtClaimsMissing = "claims missing on token"
ErrJwtExpired = "auth token has expired"
ErrJwtScopeMissing = "required scope is missing"
ErrUserNotFound = "requested user does not exist"
ErrUsernameAlreadyExists = "the requested username already exists"
)
func (h *Handler) AuthRegister(c echo.Context) error {
username := c.QueryParam("username")
_, err := h.userRepo.GetByName(username)
username := c.FormValue("username")
password := c.FormValue("password")
//username := c.QueryParam("username")
exists, err := h.userRepo.GetByName(username)
if err != nil {
// if we have an err, validate that if its not user not found.
// if the user is not found, we can use that name
@ -31,8 +36,11 @@ func (h *Handler) AuthRegister(c echo.Context) error {
})
}
}
if exists.Name == username {
return h.InternalServerErrorResponse(c, ErrUsernameAlreadyExists)
}
password := c.QueryParam("password")
//password := c.QueryParam("password")
err = h.UserService.CheckPasswordForRequirements(password)
if err != nil {
return c.JSON(http.StatusInternalServerError, domain.ErrorResponse{
@ -41,7 +49,7 @@ func (h *Handler) AuthRegister(c echo.Context) error {
})
}
_, err = h.userRepo.Create(username, password)
_, err = h.userRepo.Create(username, password, domain.ScopeRecipeRead)
if err != nil {
return c.JSON(http.StatusInternalServerError, domain.ErrorResponse{
HttpCode: http.StatusInternalServerError,
@ -53,8 +61,13 @@ func (h *Handler) AuthRegister(c echo.Context) error {
}
func (h *Handler) AuthLogin(c echo.Context) error {
username := c.QueryParam("username")
password := c.QueryParam("password")
formValues, err := c.FormParams()
if err != nil {
h.InternalServerErrorResponse(c, err.Error())
}
log.Println(formValues)
username := formValues.Get("name")
password := formValues.Get("password")
// Check to see if they are trying to login with the admin token
if username == "" {
@ -62,7 +75,7 @@ func (h *Handler) AuthLogin(c echo.Context) error {
}
// check if the user exists
err := h.UserService.DoesUserExist(username)
err = h.UserService.DoesUserExist(username)
if err != nil {
return h.InternalServerErrorResponse(c, err.Error())
}