refractor(auth): removed password from everywhere

common/Auth.cc

@@ -45,7 +45,7 @@ std::optional<UserContext> authenticate(const drogon::HttpRequestPtr &request)
 
     auto db = drogon::app().getDbClient();
     const auto userResult = db->execSqlSync(
-        "SELECT u.id, u.email, u.must_change_password "
+        "SELECT u.id, u.email "
         "FROM api_tokens t "
         "JOIN users u ON u.id = t.user_id "
         "WHERE t.token_hash = ? AND t.revoked_at IS NULL "
@@ -93,7 +93,6 @@ std::optional<UserContext> authenticate(const drogon::HttpRequestPtr &request)
     context.roles = std::move(roles);
     context.permissions = std::move(permissions);
     context.role = primaryRole(context.roles);
-    context.mustChangePassword = userResult[0]["must_change_password"].as<bool>();
     return context;
 }
 
@@ -122,9 +121,4 @@ bool isAdmin(const UserContext &user)
 {
     return hasRole(user, "admin") || hasPermission(user, "admin.manage");
 }
-
-bool mustChangePassword(const UserContext &user)
-{
-    return user.mustChangePassword;
-}
 }  // namespace visione::auth

common/Auth.h

@@ -15,7 +15,6 @@ struct UserContext
     std::string role;
     std::vector<std::string> roles;
     std::vector<std::string> permissions;
-    bool mustChangePassword{false};
 };
 
 std::optional<std::string> bearerToken(const drogon::HttpRequestPtr &request);
@@ -25,5 +24,4 @@ bool hasPermission(const UserContext &user, const std::string &permission);
 bool canManageReports(const UserContext &user);
 bool canOperateReports(const UserContext &user);
 bool isAdmin(const UserContext &user);
-bool mustChangePassword(const UserContext &user);
 }  // namespace visione::auth

common/Crypto.cc

@@ -1,10 +1,6 @@
 #include "common/Crypto.h"
 
 #include <drogon/utils/Utilities.h>
-
-#include <openssl/evp.h>
-
-#include <array>
 #include <iomanip>
 #include <random>
 #include <sstream>
@@ -14,9 +10,6 @@ namespace visione::crypto
 {
 namespace
 {
-constexpr int passwordIterations = 210000;
-constexpr size_t passwordHashBytes = 32;
-
 std::string toHex(const unsigned char *data, size_t size)
 {
     std::ostringstream stream;
@@ -27,22 +20,6 @@ std::string toHex(const unsigned char *data, size_t size)
     }
     return stream.str();
 }
-
-std::string pbkdf2(const std::string &password,
-                   const std::string &salt,
-                   int iterations)
-{
-    std::array<unsigned char, passwordHashBytes> output{};
-    PKCS5_PBKDF2_HMAC(password.c_str(),
-                      static_cast<int>(password.size()),
-                      reinterpret_cast<const unsigned char *>(salt.data()),
-                      static_cast<int>(salt.size()),
-                      iterations,
-                      EVP_sha256(),
-                      static_cast<int>(output.size()),
-                      output.data());
-    return toHex(output.data(), output.size());
-}
 }  // namespace
 
 std::string sha256(const std::string &value)
@@ -70,42 +47,6 @@ std::string randomToken()
     return drogon::utils::getUuid() + drogon::utils::getUuid();
 }
 
-std::string hashPassword(const std::string &password)
-{
-    const auto salt = drogon::utils::getUuid() + drogon::utils::getUuid();
-    return "pbkdf2_sha256$" + std::to_string(passwordIterations) + "$" + salt +
-           "$" + pbkdf2(password, salt, passwordIterations);
-}
-
-bool verifyPassword(const std::string &password, const std::string &hash)
-{
-    constexpr std::string_view pbkdf2Prefix = "pbkdf2_sha256$";
-
-    if (!hash.starts_with(pbkdf2Prefix))
-    {
-        return false;
-    }
-
-    const auto iterationsStart = pbkdf2Prefix.size();
-    const auto saltStart = hash.find('$', iterationsStart);
-    if (saltStart == std::string::npos)
-    {
-        return false;
-    }
-    const auto digestStart = hash.find('$', saltStart + 1);
-    if (digestStart == std::string::npos)
-    {
-        return false;
-    }
-
-    const auto iterations =
-        std::stoi(hash.substr(iterationsStart, saltStart - iterationsStart));
-    const auto salt = hash.substr(saltStart + 1, digestStart - saltStart - 1);
-    const auto expected = "pbkdf2_sha256$" + std::to_string(iterations) + "$" +
-                          salt + "$" + pbkdf2(password, salt, iterations);
-    return expected == hash;
-}
-
 std::string hashSecret(const std::string &secret)
 {
     return sha256("visione:" + secret);

common/Crypto.h

@@ -7,8 +7,5 @@ namespace visione::crypto
 std::string sha256(const std::string &value);
 std::string randomNumericCode(int digits);
 std::string randomToken();
-std::string hashPassword(const std::string &password);
-bool verifyPassword(const std::string &password, const std::string &hash);
 std::string hashSecret(const std::string &secret);
 }  // namespace visione::crypto
-