874d0bf · denis · git.iko.soy

git.iko.soy/denis

Fixed token verification bug.

commit874d0bf6ec3b395d8f6b23dde1dd1bd74d878b32 authoriko <ilyakooo0@gmail.com> dateFri 10 May 2019, 19:35 (7 years ago) parent5722001

3 files changed+7−5

compare with master

unifiedsplit

denis/src/Data/Query.hs+1−1 denis/src/Server/Auth.hs+5−3 denis/src/Server/Auth/Token.hs+1−1

denis/src/Data/Query.hs+1−1

@@ -589,7 +589,7 @@ updateTokenQ :: Manipulation Schema (TuplePG Token) '[]

589589updateTokenQ = update_ #tokens (

590590 Same `as` #tokenUserId :*

591591 Same `as` #tokenValue :*

592− Same `as` #tokenExpiryDate :*

592+ Set (param @3) `as` #tokenExpiryDate :*

593593 Set (param @4) `as` #tokenVerificationCode :*

594594 Set (param @5) `as` #tokenActivationTriesLeft)

595595 (#tokenUserId .== param @1 .&& #tokenValue .== param @2)

denis/src/Server/Auth.hs+5−3

@@ -71,7 +71,7 @@ type LoginDescription = Description "Try to log in with the given email\n\nRespo

7171

7272type LogoutDescription = Description "Log out with the given cookie"

7373

74−type VerifyDescription = Description "Verify token with the verification code from the user.\n\nReturns 400 if the token was not supplied.\n\nReturns 498 if the token was parsed but is invalid.\n\n"

74+type VerifyDescription = Description "Verify token with the verification code from the user.\n\nReturns 400 if the token was not supplied.\n\nReturns 498 if the token was parsed but is invalid.\n\nRetusn 403 if the token/code compination is invalid."

7575

7676type RegisterDescription = Description "Register the user for a new account.\n\nReturns 409 if a user can not be created. (Most likely the email is already registered).\n\nSets the token if creation was successful.\n\nYou should prompt user for code and verify the token with `/verify`."

7777

@@ -159,8 +159,10 @@ verifyToken (Just cookie) code = do

159159 case mbToken of

160160 Nothing -> throwError err400

161161 (Just (AuthenticationCookieData uId tokenData)) -> do

162− _ <- runQ invalidToken $ tryVerifyToken uId tokenData code

163− return NoContent

162+ token <- runQ invalidToken $ tryVerifyToken uId tokenData code

163+ case token of

164+ Just _ -> return NoContent

165+ Nothing -> throwError err403

164166

165167logOut :: Maybe String -> App (Headers '[Header "Set-Cookie" String] NoContent)

166168logOut cookie' = do

denis/src/Server/Auth/Token.hs+1−1

@@ -33,7 +33,7 @@ data Token = Token {

3333 tokenExpiryDate :: UTCTime,

3434 tokenVerificationCode :: Maybe TokenVerificationCode,

3535 tokenActivationTriesLeft :: Int32

36−} deriving (GHC.Generic, SOP.Generic, SOP.HasDatatypeInfo)

36+} deriving (Show, GHC.Generic, SOP.Generic, SOP.HasDatatypeInfo)

3737

3838generateToken :: (MonadIO m, CryptoRNG m) => UserId -> m Token

3939generateToken uId = do