jtom38/go-cook
2
0
Fork 0
Code Issues 9 Pull Requests Packages Projects Releases Wiki Activity

found a bug that would let the same username get used over and over

Browse Source
This commit is contained in:
James Tombleson 2024-04-01 17:48:38 -07:00
parent f591dadd3b
commit b3ee4e420b
1 changed files with 25 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
api/handlers/v1/auth.go
View File

@ -4,6 +4,7 @@ import (
"errors" "errors"
"go-cook/api/domain" "go-cook/api/domain"
"go-cook/api/repositories" "go-cook/api/repositories"
"log"
"net/http" "net/http"
"github.com/golang-jwt/jwt/v5" "github.com/golang-jwt/jwt/v5"
@ -11,16 +12,20 @@ import (
) )
const ( const (
ErrJwtMissing = "auth token is missing" ErrJwtMissing = "auth token is missing"
ErrJwtClaimsMissing = "claims missing on token" ErrJwtClaimsMissing = "claims missing on token"
ErrJwtExpired = "auth token has expired" ErrJwtExpired = "auth token has expired"
ErrJwtScopeMissing = "required scope is missing" ErrJwtScopeMissing = "required scope is missing"
ErrUserNotFound = "requested user does not exist" ErrUserNotFound = "requested user does not exist"
ErrUsernameAlreadyExists = "the requested username already exists"
) )
func (h *Handler) AuthRegister(c echo.Context) error { func (h *Handler) AuthRegister(c echo.Context) error {
username := c.QueryParam("username") username := c.FormValue("username")
_, err := h.userRepo.GetByName(username) password := c.FormValue("password")
//username := c.QueryParam("username")
exists, err := h.userRepo.GetByName(username)
if err != nil { if err != nil {
// if we have an err, validate that if its not user not found. // if we have an err, validate that if its not user not found.
// if the user is not found, we can use that name // if the user is not found, we can use that name
@ -31,8 +36,11 @@ func (h *Handler) AuthRegister(c echo.Context) error {
}) })
} }
} }
if exists.Name == username {
return h.InternalServerErrorResponse(c, ErrUsernameAlreadyExists)
}
password := c.QueryParam("password") //password := c.QueryParam("password")
err = h.UserService.CheckPasswordForRequirements(password) err = h.UserService.CheckPasswordForRequirements(password)
if err != nil { if err != nil {
return c.JSON(http.StatusInternalServerError, domain.ErrorResponse{ return c.JSON(http.StatusInternalServerError, domain.ErrorResponse{
@ -41,7 +49,7 @@ func (h *Handler) AuthRegister(c echo.Context) error {
}) })
} }
_, err = h.userRepo.Create(username, password) _, err = h.userRepo.Create(username, password, domain.ScopeRecipeRead)
if err != nil { if err != nil {
return c.JSON(http.StatusInternalServerError, domain.ErrorResponse{ return c.JSON(http.StatusInternalServerError, domain.ErrorResponse{
HttpCode: http.StatusInternalServerError, HttpCode: http.StatusInternalServerError,
@ -53,8 +61,13 @@ func (h *Handler) AuthRegister(c echo.Context) error {
} }
func (h *Handler) AuthLogin(c echo.Context) error { func (h *Handler) AuthLogin(c echo.Context) error {
username := c.QueryParam("username") formValues, err := c.FormParams()
password := c.QueryParam("password") if err != nil {
h.InternalServerErrorResponse(c, err.Error())
}
log.Println(formValues)
username := formValues.Get("name")
password := formValues.Get("password")
// Check to see if they are trying to login with the admin token // Check to see if they are trying to login with the admin token
if username == "" { if username == "" {
@ -62,7 +75,7 @@ func (h *Handler) AuthLogin(c echo.Context) error {
} }
// check if the user exists // check if the user exists
err := h.UserService.DoesUserExist(username) err = h.UserService.DoesUserExist(username)
if err != nil { if err != nil {
return h.InternalServerErrorResponse(c, err.Error()) return h.InternalServerErrorResponse(c, err.Error())
} }