SnitchItaly/backend
3
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

refractor(auth): removed password from everywhere

Browse Source
This commit is contained in:
gabdevele
2026-06-16 10:37:31 +02:00 Unverified
parent 4f80d7f995
commit bb7ed18539
25 changed files with 69 additions and 454 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/AdminService.cc
+3 -4
View File
@@ -80,8 +80,7 @@ const JsonRowSchema &adminUserSchema()
static const JsonRowSchema schema{
{"id", JsonFieldType::UInt64},
{"points", JsonFieldType::Int64},
{"banned", JsonFieldType::Bool},
{"must_change_password", JsonFieldType::Bool}};
{"banned", JsonFieldType::Bool}};
return schema;
}
@@ -591,13 +590,13 @@ Json::Value AdminService::listUsers(const auth::UserContext &user)
response["users"] = repositories::resultToJson(
drogon::app().getDbClient()->execSqlSync(
"SELECT u.id, u.first_name, u.last_name, u.email, u.fiscal_code, "
"u.phone, u.points, u.banned, u.must_change_password, "
"u.phone, u.points, u.banned, "
"GROUP_CONCAT(r.name ORDER BY r.name SEPARATOR ',') AS roles "
"FROM users u "
"LEFT JOIN user_roles ur ON ur.user_id = u.id "
"LEFT JOIN roles r ON r.id = ur.role_id "
"GROUP BY u.id, u.first_name, u.last_name, u.email, u.fiscal_code, "
"u.phone, u.points, u.banned, u.must_change_password "
"u.phone, u.points, u.banned "
"ORDER BY u.created_at DESC LIMIT 200"),
adminUserSchema());
return response;
services/AuthService.cc
+7 -65
View File
@@ -1,9 +1,10 @@
#include "services/AuthService.h"
#include "common/Crypto.h"
#include "common/Email.h"
#include "common/Validation.h"
#include "common/Crypto.h"
#include <drogon/drogon.h>
namespace visione::services
@@ -62,7 +63,7 @@ Json::Value issueToken(long long userId)
Json::Value AuthService::registerCitizen(const Json::Value &body)
{
const auto missing = validation::missingStrings(
body, {"first_name", "last_name", "email", "password", "fiscal_code"});
body, {"first_name", "last_name", "email", "fiscal_code"});
if (!missing.empty())
{
auto response = failure("missing_fields");
@@ -96,12 +97,11 @@ Json::Value AuthService::registerCitizen(const Json::Value &body)
db->execSqlSync(
"INSERT INTO users "
"(first_name, last_name, email, password_hash, fiscal_code, birth_date, "
"birth_place, phone) VALUES (?, ?, ?, ?, ?, NULLIF(?, ''), ?, ?)",
"(first_name, last_name, email, fiscal_code, birth_date, "
"birth_place, phone) VALUES (?, ?, ?, ?, NULLIF(?, ''), ?, ?)",
body["first_name"].asString(),
body["last_name"].asString(),
email,
crypto::hashPassword(body["password"].asString()),
fiscalCode,
body.get("birth_date", "").asString(),
body.get("birth_place", "").asString(),
@@ -183,68 +183,12 @@ Json::Value AuthService::verifyOtp(const Json::Value &body)
return issueToken(challenge[0]["user_id"].as<long long>());
}
Json::Value AuthService::loginWithPassword(const Json::Value &body)
{
const auto missing = validation::missingStrings(body, {"email", "password"});
if (!missing.empty())
{
return failure("missing_fields");
}
auto db = drogon::app().getDbClient();
const auto user = db->execSqlSync(
"SELECT id, password_hash FROM users WHERE email = ? AND banned = FALSE "
"LIMIT 1",
body["email"].asString());
if (user.empty() ||
!crypto::verifyPassword(body["password"].asString(),
user[0]["password_hash"].as<std::string>()))
{
return failure("invalid_credentials");
}
return issueToken(user[0]["id"].as<long long>());
}
Json::Value AuthService::changePassword(const auth::UserContext &user,
const Json::Value &body)
{
const auto missing =
validation::missingStrings(body, {"current_password", "new_password"});
if (!missing.empty())
{
return failure("missing_fields");
}
if (body["new_password"].asString().size() < 10)
{
return failure("weak_password");
}
auto db = drogon::app().getDbClient();
const auto current = db->execSqlSync(
"SELECT password_hash FROM users WHERE id = ? AND banned = FALSE",
user.id);
if (current.empty() ||
!crypto::verifyPassword(
body["current_password"].asString(),
current[0]["password_hash"].as<std::string>()))
{
return failure("invalid_credentials");
}
db->execSqlSync(
"UPDATE users SET password_hash = ?, must_change_password = FALSE "
"WHERE id = ?",
crypto::hashPassword(body["new_password"].asString()),
user.id);
return success();
}
Json::Value AuthService::currentUser(const auth::UserContext &user)
{
auto db = drogon::app().getDbClient();
const auto result = db->execSqlSync(
"SELECT id, first_name, last_name, email, fiscal_code, phone, points, "
"must_change_password FROM users WHERE id = ?",
"SELECT id, first_name, last_name, email, fiscal_code, phone, points "
"FROM users WHERE id = ?",
user.id);
auto response = success();
@@ -257,8 +201,6 @@ Json::Value AuthService::currentUser(const auth::UserContext &user)
response["user"]["fiscal_code"] = result[0]["fiscal_code"].as<std::string>();
response["user"]["phone"] = result[0]["phone"].as<std::string>();
response["user"]["points"] = result[0]["points"].as<int>();
response["user"]["must_change_password"] =
result[0]["must_change_password"].as<bool>();
response["user"]["role"] = user.role;
for (const auto &role : user.roles)
{
services/AuthService.h
-2
View File
@@ -12,8 +12,6 @@ class AuthService
Json::Value registerCitizen(const Json::Value &body);
Json::Value requestOtp(const Json::Value &body);
Json::Value verifyOtp(const Json::Value &body);
Json::Value loginWithPassword(const Json::Value &body);
Json::Value changePassword(const auth::UserContext &user, const Json::Value &body);
Json::Value currentUser(const auth::UserContext &user);
Json::Value editUser(const auth::UserContext & user, Json::Value::const_iterator::reference body);
};