From 2572fcbffd9b2733a184bf8799bf7a18b81aa616 Mon Sep 17 00:00:00 2001 From: Imbus Date: Sat, 21 Oct 2023 00:02:58 +0200 Subject: [PATCH 01/17] Added init-sqlx target to justfile, to quickly get sqlx up to speed --- justfile | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/justfile b/justfile index 5bce120..7c73356 100644 --- a/justfile +++ b/justfile @@ -33,6 +33,12 @@ build-container-release: start-release: build-container-release remove-podman-containers {{runtime}} run -d -p 8080:8080 --name frostbyte fb-server +init-sqlx: + echo "DATABASE_URL=sqlite:debug.db" > server/.env + cd server && sqlx database create + cd server && sqlx migrate run + cd server && cargo sqlx prepare + # Removes and stops any containers related to the project [private] remove-podman-containers: From cf607ae34556288bbee1839b0454841cd3a053ea Mon Sep 17 00:00:00 2001 From: Imbus Date: Sat, 21 Oct 2023 00:59:21 +0200 Subject: [PATCH 02/17] Added some triggers and formatting to the migration scripts --- server/migrations/0001_users_table.sql | 38 +++++++++++++++----- server/migrations/0002_posts_table.sql | 50 +++++++++++++++++++------- 2 files changed, 68 insertions(+), 20 deletions(-) diff --git a/server/migrations/0001_users_table.sql b/server/migrations/0001_users_table.sql index 76976d2..b9ccfdb 100644 --- a/server/migrations/0001_users_table.sql +++ b/server/migrations/0001_users_table.sql @@ -1,9 +1,31 @@ -CREATE TABLE IF NOT EXISTS users ( - id INTEGER PRIMARY KEY, - username TEXT NOT NULL, - password TEXT NOT NULL, - created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP, - updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP -); +CREATE TABLE + IF NOT EXISTS users ( + id INTEGER PRIMARY KEY NOT NULL, + username TEXT NOT NULL UNIQUE, + password TEXT NOT NULL, + created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP, + updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP + ); -create index users_username_index on users (username); \ No newline at end of file +-- Create a trigger to set created_at and updated_at on INSERT +CREATE TRIGGER IF NOT EXISTS set_created_at AFTER INSERT ON users BEGIN +UPDATE users +SET + created_at = CURRENT_TIMESTAMP +WHERE + id = NEW.id; + +END; + +-- Create a trigger to set updated_at on UPDATE +CREATE TRIGGER IF NOT EXISTS set_updated_at AFTER +UPDATE ON users BEGIN +UPDATE users +SET + updated_at = CURRENT_TIMESTAMP +WHERE + id = NEW.id; + +END; + +CREATE INDEX users_username_index ON users (username); \ No newline at end of file diff --git a/server/migrations/0002_posts_table.sql b/server/migrations/0002_posts_table.sql index c5d05e5..3863b63 100644 --- a/server/migrations/0002_posts_table.sql +++ b/server/migrations/0002_posts_table.sql @@ -1,12 +1,38 @@ -CREATE TABLE IF NOT EXISTS posts ( - id INTEGER PRIMARY KEY NOT NULL, - user_id INTEGER NOT NULL, - content TEXT NOT NULL, - upvotes INT NOT NULL DEFAULT 0, - downvotes INT NOT NULL DEFAULT 0, - created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP, - updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP, - FOREIGN KEY (user_id) REFERENCES users (id) -); -create index IF NOT EXISTS posts_user_id_index on posts (user_id); -create index IF NOT EXISTS posts_id_index on posts (id); \ No newline at end of file +CREATE TABLE + IF NOT EXISTS posts ( + id INTEGER PRIMARY KEY NOT NULL, + user_id INTEGER NOT NULL, + content TEXT NOT NULL, + upvotes INTEGER NOT NULL DEFAULT 0, + downvotes INTEGER NOT NULL DEFAULT 0, + created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP, + updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP, + FOREIGN KEY (user_id) REFERENCES users (id) + ); + +-- Create a trigger to set created_at and updated_at on INSERT +CREATE TRIGGER IF NOT EXISTS set_created_at AFTER INSERT ON posts BEGIN +UPDATE posts +SET + created_at = CURRENT_TIMESTAMP +WHERE + id = NEW.id; + +END; + +-- Create a trigger to set updated_at on UPDATE +CREATE TRIGGER IF NOT EXISTS set_updated_at AFTER +UPDATE ON posts BEGIN +UPDATE posts +SET + updated_at = CURRENT_TIMESTAMP +WHERE + id = NEW.id; + +END; + +create INDEX IF NOT EXISTS posts_user_id_index ON posts (user_id); + +create INDEX IF NOT EXISTS posts_id_index ON posts (id); + +CREATE INDEX idx_created_at_desc ON your_table (created_at DESC); \ No newline at end of file From db0783fe2e4ead50f5a6a66e79ce8406f644d246 Mon Sep 17 00:00:00 2001 From: Imbus Date: Sat, 21 Oct 2023 00:59:35 +0200 Subject: [PATCH 03/17] Slight improvement of the api --- server/src/db.rs | 2 +- server/src/routes/post.rs | 7 ++----- server/src/state.rs | 29 +++++++++-------------------- 3 files changed, 12 insertions(+), 26 deletions(-) diff --git a/server/src/db.rs b/server/src/db.rs index c2f0f39..65b74f4 100644 --- a/server/src/db.rs +++ b/server/src/db.rs @@ -1,6 +1,6 @@ use crate::routes::{NewPost, Post}; use log::warn; -use sqlx::{Row, SqlitePool}; +use sqlx::SqlitePool; // Gets all posts from the database pub async fn db_get_posts(pool: &SqlitePool) -> Vec { diff --git a/server/src/routes/post.rs b/server/src/routes/post.rs index cc7970c..0555e47 100755 --- a/server/src/routes/post.rs +++ b/server/src/routes/post.rs @@ -1,4 +1,4 @@ -use crate::db::db_new_post; +use crate::db::{db_get_posts, db_new_post}; use crate::ServerState; use actix_web::web::Data; @@ -38,10 +38,7 @@ pub struct User { #[get("/posts")] pub async fn get_posts(state: Data) -> Result { - let stream = sqlx::query_as!(Post, "SELECT * FROM posts"); - - let posts = stream.fetch_all(&state.pool).await.unwrap(); - Ok(HttpResponse::Ok().json(posts)) + Ok(HttpResponse::Ok().json(db_get_posts(&state.pool).await)) } #[post("/posts")] diff --git a/server/src/state.rs b/server/src/state.rs index 783b08d..fbda6c8 100644 --- a/server/src/state.rs +++ b/server/src/state.rs @@ -23,7 +23,7 @@ impl ServerState { sqlx::migrate!("./migrations").run(&pool).await.unwrap(); #[cfg(debug_assertions)] - debug_setup(&pool).await; + debug_setup(&pool).await.unwrap(); Self { pool } } @@ -32,27 +32,16 @@ impl ServerState { // Inserts a bunch of dummy data into the database // Mostly useful for debugging new posts, as we need to satisfy foreign key constraints. #[cfg(debug_assertions)] -async fn debug_setup(pool: &SqlitePool) { - use chrono::NaiveDateTime; +async fn debug_setup(pool: &SqlitePool) -> Result<(), sqlx::Error> { use sqlx::query; - let now = NaiveDateTime::from_timestamp(0, 0); + query!("INSERT INTO users (username, password) VALUES ('testuser', 'testpassword')",) + .execute(pool) + .await?; - query!( - "INSERT INTO users (username, password, created_at, updated_at) VALUES ('test', 'test', ?, ?)", - now, - now - ) - .execute(pool) - .await - .unwrap(); + query!("INSERT INTO posts (user_id, content) VALUES (1, 'Hello world!')",) + .execute(pool) + .await?; - query!( - "INSERT INTO posts (user_id, content, created_at, updated_at) VALUES (1, 'Hello world!', ?, ?)", - now, - now - ) - .execute(pool) - .await - .unwrap(); + Ok(()) } From 204ed8ec41540e246095ff80ab1f5f85b5248b9d Mon Sep 17 00:00:00 2001 From: Imbus Date: Sat, 21 Oct 2023 01:55:07 +0200 Subject: [PATCH 04/17] Fixing typo --- server/migrations/0002_posts_table.sql | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/migrations/0002_posts_table.sql b/server/migrations/0002_posts_table.sql index 3863b63..1b9601b 100644 --- a/server/migrations/0002_posts_table.sql +++ b/server/migrations/0002_posts_table.sql @@ -35,4 +35,4 @@ create INDEX IF NOT EXISTS posts_user_id_index ON posts (user_id); create INDEX IF NOT EXISTS posts_id_index ON posts (id); -CREATE INDEX idx_created_at_desc ON your_table (created_at DESC); \ No newline at end of file +CREATE INDEX idx_created_at_desc ON posts (created_at DESC); \ No newline at end of file From 4fc00eaf23596fed6fcfb6df2836a88ad904a206 Mon Sep 17 00:00:00 2001 From: Imbus Date: Sat, 21 Oct 2023 01:55:27 +0200 Subject: [PATCH 05/17] Tidying up routes, query parameters for posts, better database api --- server/src/db.rs | 17 +++++++++++------ server/src/jwt.rs | 4 ---- server/src/routes/post.rs | 30 +++++++++++++++++++++++++----- server/src/routes/users.rs | 4 ---- server/src/state.rs | 4 +++- 5 files changed, 39 insertions(+), 20 deletions(-) diff --git a/server/src/db.rs b/server/src/db.rs index 65b74f4..710fb97 100644 --- a/server/src/db.rs +++ b/server/src/db.rs @@ -2,12 +2,17 @@ use crate::routes::{NewPost, Post}; use log::warn; use sqlx::SqlitePool; -// Gets all posts from the database -pub async fn db_get_posts(pool: &SqlitePool) -> Vec { - sqlx::query_as!(Post, "SELECT * FROM posts") - .fetch_all(pool) - .await - .unwrap() +// Gets the latest posts from the database, ordered by created_at +pub async fn db_get_latest_posts(pool: &SqlitePool, limit: i64, offset: i64) -> Vec { + sqlx::query_as!( + Post, + "SELECT * FROM posts ORDER BY created_at DESC LIMIT ? OFFSET ?", + limit, + offset + ) + .fetch_all(pool) + .await + .unwrap() } // Inserts a new post to the database diff --git a/server/src/jwt.rs b/server/src/jwt.rs index 2e4bc44..5989cf9 100755 --- a/server/src/jwt.rs +++ b/server/src/jwt.rs @@ -1,7 +1,3 @@ -// use crate::{ -// config::{DAYS_VALID, JWT_SECRET}, -// Claims, -// }; use jsonwebtoken::{ decode, encode, errors::Result as JwtResult, DecodingKey, EncodingKey, Header, Validation, }; diff --git a/server/src/routes/post.rs b/server/src/routes/post.rs index 0555e47..2b71ca1 100755 --- a/server/src/routes/post.rs +++ b/server/src/routes/post.rs @@ -1,7 +1,7 @@ -use crate::db::{db_get_posts, db_new_post}; +use crate::db::{db_get_latest_posts, db_new_post}; use crate::ServerState; -use actix_web::web::Data; +use actix_web::web::{Data, Query}; use actix_web::{get, post, web::Json, HttpResponse, Responder, Result}; use log::info; use serde::{Deserialize, Serialize}; @@ -27,6 +27,7 @@ pub struct Post { pub updated_at: chrono::NaiveDateTime, } +/// The user as it is stored in the database, with all the related metadata #[derive(Debug, Serialize, Deserialize, Clone, FromRow)] pub struct User { pub id: i64, @@ -36,11 +37,30 @@ pub struct User { pub updated_at: chrono::NaiveDateTime, } -#[get("/posts")] -pub async fn get_posts(state: Data) -> Result { - Ok(HttpResponse::Ok().json(db_get_posts(&state.pool).await)) +// These look like /posts?limit=10&offset=20 in the URL +// Note that these are optional +/// Query parameters for the /posts endpoint +#[derive(Debug, Serialize, Deserialize)] +struct QueryParams { + limit: Option, + offset: Option, } +/// Gets all posts from the database, query parameters are optional +/// If limit is not specified, it defaults to a sane value +#[get("/posts")] +pub async fn get_posts( + query: Query, + state: Data, +) -> Result { + if let (Some(lim), Some(ofs)) = (query.limit, query.offset) { + return Ok(HttpResponse::Ok() + .json(db_get_latest_posts(&state.pool, std::cmp::min(lim, 30), ofs).await)); + } + Ok(HttpResponse::Ok().json(db_get_latest_posts(&state.pool, 30, 0).await)) +} + +/// Creates a new post, requires a token in release mode #[post("/posts")] pub async fn new_post(new_post: Json, state: Data) -> Result { return match db_new_post(new_post.into_inner(), &state.pool).await { diff --git a/server/src/routes/users.rs b/server/src/routes/users.rs index e5cdec8..62f504b 100755 --- a/server/src/routes/users.rs +++ b/server/src/routes/users.rs @@ -74,10 +74,6 @@ pub async fn register( #[post("/login")] pub async fn login(data: Json, state: Data) -> Result { - // let q = "SELECT password FROM users WHERE username = ?"; - // let query = sqlx::query(q).bind(&data.username); - // let result = query.fetch_one(&state.pool).await.ok(); - let uname = data.username.clone(); let q = sqlx::query!("SELECT password FROM users WHERE username = ?", uname) .fetch_one(&state.pool) diff --git a/server/src/state.rs b/server/src/state.rs index fbda6c8..f43f91b 100644 --- a/server/src/state.rs +++ b/server/src/state.rs @@ -35,10 +35,12 @@ impl ServerState { async fn debug_setup(pool: &SqlitePool) -> Result<(), sqlx::Error> { use sqlx::query; - query!("INSERT INTO users (username, password) VALUES ('testuser', 'testpassword')",) + // Or ignore is just to silence the error if the user already exists + query!("INSERT OR IGNORE INTO users (username, password) VALUES ('testuser', 'testpassword')",) .execute(pool) .await?; + // This requires that the user with id 1 exists in the user table query!("INSERT INTO posts (user_id, content) VALUES (1, 'Hello world!')",) .execute(pool) .await?; From 4c398a40f6c55cf4274ae248b1990d798f6fd534 Mon Sep 17 00:00:00 2001 From: Imbus Date: Sat, 21 Oct 2023 01:55:47 +0200 Subject: [PATCH 06/17] Removed unused menu entries --- client-solid/src/Root.tsx | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-) diff --git a/client-solid/src/Root.tsx b/client-solid/src/Root.tsx index 254424a..60c0b15 100644 --- a/client-solid/src/Root.tsx +++ b/client-solid/src/Root.tsx @@ -26,7 +26,7 @@ function Root() { function Navbar() { return (
- hello + FrostByte Login @@ -48,16 +48,6 @@ function Menu() { New -
  • - - Boards - -
    • -
  • - - Login - -
    • ); } From fa9b2b6fc16eb4b82e3b90d8d85b81ca1b8d35aa Mon Sep 17 00:00:00 2001 From: Imbus Date: Sat, 21 Oct 2023 05:11:42 +0200 Subject: [PATCH 07/17] Working but untested captcha api --- justfile | 7 +++-- server/Cargo.lock | 13 ++++++++ server/Cargo.toml | 1 + server/src/db.rs | 12 +++++--- server/src/main.rs | 5 ++- server/src/routes/post.rs | 2 +- server/src/routes/users.rs | 62 ++++++++++++++++++++++++++++++++++++-- server/src/state.rs | 17 +++++++++++ 8 files changed, 107 insertions(+), 12 deletions(-) diff --git a/justfile b/justfile index 7c73356..e0e6a37 100644 --- a/justfile +++ b/justfile @@ -4,14 +4,15 @@ runtime := "podman" dev: start-debug @echo "Cd into client and run 'npm run dev' to start the client in dev mode." -# Builds the client with npm (result in client/dist +[private] npm-install directory: cd {{directory}} && npm install # Builds the client with npm (result in client/dist) [private] -npm-build: (npm-install "client-solid") - cd client && npm run build +npm-build directory: (npm-install directory) + cd {{directory}} && npm run build + @echo "Built client at {{directory}}/dist" # Builds a debug container [private] diff --git a/server/Cargo.lock b/server/Cargo.lock index 93d4286..3dfcfc7 100755 --- a/server/Cargo.lock +++ b/server/Cargo.lock @@ -391,6 +391,18 @@ version = "1.6.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "8c3c1a368f70d6cf7302d78f8f7093da241fb8e8807c05cc9e51a125895a6d5b" +[[package]] +name = "biosvg" +version = "0.1.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "51c50785b88aca88dc4417a3aede395dac83b5031286f02523ddf4839c59e7f8" +dependencies = [ + "once_cell", + "rand", + "regex", + "thiserror", +] + [[package]] name = "bitflags" version = "1.3.2" @@ -1780,6 +1792,7 @@ dependencies = [ "actix-files", "actix-web", "argon2", + "biosvg", "chrono", "clap", "dotenvy", diff --git a/server/Cargo.toml b/server/Cargo.toml index 8afda9d..f770f6e 100644 --- a/server/Cargo.toml +++ b/server/Cargo.toml @@ -9,6 +9,7 @@ edition = "2021" actix-files = "0.6.2" actix-web = "4.4.0" argon2 = { version = "0.5.2", features = ["zeroize"] } +biosvg = "0.1.3" chrono = { version = "0.4.31", features = ["serde"] } clap = { version = "4.4.5", features = ["derive"] } dotenvy = "0.15.7" diff --git a/server/src/db.rs b/server/src/db.rs index 710fb97..5d01141 100644 --- a/server/src/db.rs +++ b/server/src/db.rs @@ -17,25 +17,27 @@ pub async fn db_get_latest_posts(pool: &SqlitePool, limit: i64, offset: i64) -> // Inserts a new post to the database pub async fn db_new_post(post: NewPost, pool: &SqlitePool) -> Option { - let q2 = sqlx::query!( + let insert_query = sqlx::query!( "INSERT INTO posts (user_id, content) VALUES (1, ?)", post.content ) .execute(pool) .await; - if q2.is_err() { - let s = q2.err().unwrap(); + if insert_query.is_err() { + let s = insert_query.err().unwrap(); warn!("Error inserting post into database: {}", s); return None; } - let q = sqlx::query_as!( + // Dips into the database to get the post we just inserted + let post = sqlx::query_as!( Post, "SELECT * FROM posts WHERE id = (SELECT MAX(id) FROM posts)" ) .fetch_one(pool) .await .ok()?; - Some(q) + + Some(post) } diff --git a/server/src/main.rs b/server/src/main.rs index 18e07d2..719a040 100755 --- a/server/src/main.rs +++ b/server/src/main.rs @@ -11,6 +11,7 @@ mod routes; mod state; use routes::{get_posts, login, new_post, register}; +use state::CaptchaState; use state::ServerState; #[actix_web::main] @@ -18,6 +19,7 @@ async fn main() -> std::io::Result<()> { env_logger::Builder::from_env(env_logger::Env::default().default_filter_or("debug")).init(); let data = ServerState::new().await; + let capt_db = CaptchaState::new(); info!("Spinning up server on http://localhost:8080"); HttpServer::new(move || { @@ -31,7 +33,8 @@ async fn main() -> std::io::Result<()> { .service(new_post) .service(login) .service(register) - .app_data(Data::new(data.clone())), + .app_data(Data::new(data.clone())) + .app_data(Data::new(capt_db.clone())), ) .service(Files::new("/", "./public").index_file("index.html")) }) diff --git a/server/src/routes/post.rs b/server/src/routes/post.rs index 2b71ca1..d0e5538 100755 --- a/server/src/routes/post.rs +++ b/server/src/routes/post.rs @@ -41,7 +41,7 @@ pub struct User { // Note that these are optional /// Query parameters for the /posts endpoint #[derive(Debug, Serialize, Deserialize)] -struct QueryParams { +pub struct QueryParams { limit: Option, offset: Option, } diff --git a/server/src/routes/users.rs b/server/src/routes/users.rs index 62f504b..ca47319 100755 --- a/server/src/routes/users.rs +++ b/server/src/routes/users.rs @@ -1,14 +1,16 @@ use crate::jwt::token_factory; +use crate::state::CaptchaState; use crate::ServerState; use actix_web::web::Data; use actix_web::{post, web::Json, HttpResponse, Responder, Result}; -use argon2::password_hash::rand_core::OsRng; +use argon2::password_hash::rand_core::{OsRng, RngCore}; use argon2::password_hash::SaltString; use argon2::password_hash::*; use argon2::Argon2; use argon2::PasswordHasher; use argon2::PasswordVerifier; +use biosvg::BiosvgBuilder; use log::*; use serde::{Deserialize, Serialize}; @@ -101,7 +103,7 @@ pub async fn login(data: Json, state: Data) -> Result { @@ -110,3 +112,59 @@ pub async fn login(data: Json, state: Data) -> Result) -> Result { + // This might block the thread a bit too long + let (answer, svg) = get_captcha(); + + let id = rand_core::OsRng.next_u32() as i32; + + let cresponse = CaptchaResponse { + captcha_svg: svg.clone(), + captcha_id: id, + }; + + // This is bad in about every way i can think of + // It might just be better to hit the database every time, and let the database + // handle rng and maybe set a trigger to delete old captchas + match cstate.capthca_db.lock() { + Ok(mut db) => { + if (db.len() as i32) > 100 { + // To prevent the database from growing too large + // Replace with a proper LRU cache or circular buffer + db.remove(&(id % 100)); // This is terrible + } + db.insert(id, answer.clone()); // We do not care about collisions + return Ok(HttpResponse::Ok().json(cresponse)); + } + Err(_) => { + // This shouldnt happen + error!("Failed to lock captcha database"); + return Ok(HttpResponse::InternalServerError().json("Error")); + } + } +} + +/// Returns a new captcha in the form of a tuple (answer, svg) +fn get_captcha() -> (String, String) { + BiosvgBuilder::new() + .length(4) + .difficulty(6) + .colors(vec![ + "#0078D6".to_string(), + "#aa3333".to_string(), + "#f08012".to_string(), + "#33aa00".to_string(), + "#aa33aa".to_string(), + ]) + .build() + .unwrap() +} diff --git a/server/src/state.rs b/server/src/state.rs index f43f91b..3e4796b 100644 --- a/server/src/state.rs +++ b/server/src/state.rs @@ -1,8 +1,25 @@ +use std::collections::BTreeMap; +use std::sync::Arc; +use std::sync::Mutex; + use sqlx::Pool; use sqlx::Sqlite; use sqlx::SqlitePool; use sqlx::{self, sqlite}; +#[derive(Clone)] +pub struct CaptchaState { + pub capthca_db: Arc>>, +} + +impl CaptchaState { + pub fn new() -> Self { + Self { + capthca_db: Arc::new(Mutex::new(BTreeMap::new())), + } + } +} + #[derive(Clone)] pub struct ServerState { pub pool: Pool, From 508cf528af06e6688e5a8c5dc0dfd7ee40b6e0bf Mon Sep 17 00:00:00 2001 From: Imbus Date: Sat, 21 Oct 2023 07:54:26 +0200 Subject: [PATCH 08/17] Splitting database access logic from routing code --- server/src/db.rs | 97 ++++++++++++++++++++++++++++++++++++-- server/src/jwt.rs | 3 +- server/src/routes/post.rs | 25 +++++++++- server/src/routes/users.rs | 74 ++++------------------------- server/src/state.rs | 7 ++- 5 files changed, 131 insertions(+), 75 deletions(-) diff --git a/server/src/db.rs b/server/src/db.rs index 5d01141..0c694ee 100644 --- a/server/src/db.rs +++ b/server/src/db.rs @@ -1,5 +1,9 @@ -use crate::routes::{NewPost, Post}; -use log::warn; +use crate::routes::{Post, User}; +use argon2::{ + password_hash::{rand_core::OsRng, SaltString}, + Argon2, PasswordHasher, PasswordVerifier, +}; +use log::{info, warn}; use sqlx::SqlitePool; // Gets the latest posts from the database, ordered by created_at @@ -16,10 +20,13 @@ pub async fn db_get_latest_posts(pool: &SqlitePool, limit: i64, offset: i64) -> } // Inserts a new post to the database -pub async fn db_new_post(post: NewPost, pool: &SqlitePool) -> Option { +pub async fn db_new_post(userid: i64, content: &str, pool: &SqlitePool) -> Option { + info!("User with id {} submitted a post", userid); + let insert_query = sqlx::query!( - "INSERT INTO posts (user_id, content) VALUES (1, ?)", - post.content + "INSERT INTO posts (user_id, content) VALUES (?, ?)", + userid, + content ) .execute(pool) .await; @@ -41,3 +48,83 @@ pub async fn db_new_post(post: NewPost, pool: &SqlitePool) -> Option { Some(post) } + +pub async fn db_user_exists(username: String, pool: &SqlitePool) -> bool { + let exists = sqlx::query!("SELECT username FROM users WHERE username = ?", username) + .fetch_one(pool) + .await + .ok() + .map(|row| row.username); + + exists.is_some() +} + +pub async fn db_user_login(username: String, password: String, pool: &SqlitePool) -> Option { + let username = username.clone(); + let user = sqlx::query_as!(User, "SELECT * FROM users WHERE username = ?", username) + .fetch_one(pool) + .await + .ok()?; + + let phc_password = user.password.clone(); + let phc_password = match argon2::PasswordHash::new(&phc_password) { + Ok(phc_password) => phc_password, + Err(_) => { + warn!( + "Invalid hash for user {} fetched from database (not a valid PHC string)", + username + ); + return None; + } + }; + + let argon2 = Argon2::default(); + let password = password.as_bytes(); + + match argon2.verify_password(password, &phc_password) { + Ok(_) => Some(user), + Err(_) => None, + } +} + +pub async fn db_new_user(username: String, password: String, pool: &SqlitePool) -> Option { + // First check if the user already exists + match db_user_exists(username.clone(), pool).await { + true => { + warn!("User \"{}\" already exists", username); + return None; + } + false => {} + } + + // Unwrapping here because if this fails, we have a serious problem + let phc_hash = Argon2::default() + .hash_password(password.as_bytes(), &SaltString::generate(&mut OsRng)) + .unwrap() + .to_string(); + + // Insert our new user into the database + let insert_query = sqlx::query!( + "INSERT INTO users (username, password) VALUES (?, ?)", + username, + phc_hash + ) + .execute(pool) + .await; + + match insert_query { + Ok(_) => { + info!("User: {} registered", username); + let user = sqlx::query_as!(User, "SELECT * FROM users WHERE username = ?", username) + .fetch_one(pool) + .await + .ok()?; + + Some(user) + } + Err(e) => { + warn!("Error inserting user into database: {}", e); + return None; + } + } +} diff --git a/server/src/jwt.rs b/server/src/jwt.rs index 5989cf9..d603c4d 100755 --- a/server/src/jwt.rs +++ b/server/src/jwt.rs @@ -36,7 +36,8 @@ pub fn token_factory(user: &str) -> JwtResult { Ok(token) } -#[allow(dead_code)] +// JwtResult is just a predefined error from the jsonwebtoken crate +// This function is incomplete and should be expanded to check for more things pub fn validate_token(token: &str) -> JwtResult { let token_data = decode::( token, diff --git a/server/src/routes/post.rs b/server/src/routes/post.rs index d0e5538..8380f97 100755 --- a/server/src/routes/post.rs +++ b/server/src/routes/post.rs @@ -1,4 +1,5 @@ use crate::db::{db_get_latest_posts, db_new_post}; +use crate::jwt::validate_token; use crate::ServerState; use actix_web::web::{Data, Query}; @@ -63,7 +64,29 @@ pub async fn get_posts( /// Creates a new post, requires a token in release mode #[post("/posts")] pub async fn new_post(new_post: Json, state: Data) -> Result { - return match db_new_post(new_post.into_inner(), &state.pool).await { + let user_claims = validate_token(&new_post.token); + + if let Err(e) = user_claims { + info!("Error validating token: {}", e); + return Ok(HttpResponse::BadRequest().json("Error")); + } + + // Bail if the token is invalid + let claims = user_claims.unwrap(); + info!("User {:?} created a new post", &claims.sub); + + let content = new_post.content.clone(); + let username = claims.sub.clone(); + + // This one is avoidable if we just store the user id in the token + let userid = sqlx::query!("SELECT id FROM users WHERE username = ?", username) + .fetch_one(&state.pool) + .await + .unwrap() + .id; + + // By now we know that the token is valid, so we can create the post + return match db_new_post(userid, &content, &state.pool).await { Some(post) => { info!("Created post {:?}", post.id); Ok(HttpResponse::Ok().json(post)) diff --git a/server/src/routes/users.rs b/server/src/routes/users.rs index ca47319..5b7d999 100755 --- a/server/src/routes/users.rs +++ b/server/src/routes/users.rs @@ -1,15 +1,12 @@ +use crate::db::{db_new_user, db_user_login}; use crate::jwt::token_factory; use crate::state::CaptchaState; use crate::ServerState; use actix_web::web::Data; use actix_web::{post, web::Json, HttpResponse, Responder, Result}; -use argon2::password_hash::rand_core::{OsRng, RngCore}; -use argon2::password_hash::SaltString; +use argon2::password_hash::rand_core::RngCore; use argon2::password_hash::*; -use argon2::Argon2; -use argon2::PasswordHasher; -use argon2::PasswordVerifier; use biosvg::BiosvgBuilder; use log::*; use serde::{Deserialize, Serialize}; @@ -21,7 +18,7 @@ pub struct LoginData { } #[derive(Debug, Serialize, Deserialize)] -struct LoginResponse { +pub struct LoginResponse { username: String, token: String, } @@ -38,75 +35,23 @@ pub async fn register( data: Json, state: Data, ) -> Result { - // First check if the user already exists - let exists = sqlx::query!( - "SELECT username FROM users WHERE username = ?", - data.username - ) - .fetch_one(&state.pool) - .await - .ok() - .map(|row| row.username); - - // Bail out if the user already exists - if exists.is_some() { - info!("User \"{}\" already exists", data.username); - return Ok(HttpResponse::BadRequest().json("Error")); - } - - // Unwrapping here because if this fails, we have a serious problem - let phc_hash = Argon2::default() - .hash_password(data.password.as_bytes(), &SaltString::generate(&mut OsRng)) - .unwrap() - .to_string(); - - // Insert our new user into the database - sqlx::query!( - "INSERT INTO users (username, password) VALUES (?, ?)", - data.username, - phc_hash - ) - .execute(&state.pool) - .await - .unwrap(); - + db_new_user(data.username.clone(), data.password.clone(), &state.pool).await; info!("User: {} registered", data.username); Ok(HttpResponse::Ok().json("User registered")) } #[post("/login")] pub async fn login(data: Json, state: Data) -> Result { - let uname = data.username.clone(); - let q = sqlx::query!("SELECT password FROM users WHERE username = ?", uname) - .fetch_one(&state.pool) - .await - .ok(); + let result = db_user_login(data.username.clone(), data.password.clone(), &state.pool).await; - if q.is_none() { - info!("User \"{}\" failed to log in", data.username); - return Ok(HttpResponse::BadRequest().json("Error")); - } - - let phc_password = q.unwrap().password; - let phc_password = PasswordHash::new(&phc_password).unwrap_or_else(|_| { - warn!( - "Invalid hash for user {} fetched from database (not a valid PHC string)", - data.username - ); - panic!(); - }); - - match Argon2::default().verify_password(data.password.as_bytes(), &phc_password) { - Ok(_) => { - info!("User {} logged in", data.username); - let token = token_factory(&data.username).unwrap(); - println!("{:?}", token); + match result { + Some(_) => { return Ok(HttpResponse::Ok().json(LoginResponse { username: data.username.clone(), - token, + token: token_factory(&data.username).unwrap(), })); } - Err(_) => { + None => { info!("User \"{}\" failed to log in", data.username); return Ok(HttpResponse::BadRequest().json("Error")); } @@ -159,6 +104,7 @@ fn get_captcha() -> (String, String) { .length(4) .difficulty(6) .colors(vec![ + // Feel free to change these "#0078D6".to_string(), "#aa3333".to_string(), "#f08012".to_string(), diff --git a/server/src/state.rs b/server/src/state.rs index 3e4796b..93b1d1d 100644 --- a/server/src/state.rs +++ b/server/src/state.rs @@ -52,10 +52,9 @@ impl ServerState { async fn debug_setup(pool: &SqlitePool) -> Result<(), sqlx::Error> { use sqlx::query; - // Or ignore is just to silence the error if the user already exists - query!("INSERT OR IGNORE INTO users (username, password) VALUES ('testuser', 'testpassword')",) - .execute(pool) - .await?; + use crate::db::db_new_user; + + db_new_user("testuser".to_string(), "testpassword".to_string(), pool).await; // This requires that the user with id 1 exists in the user table query!("INSERT INTO posts (user_id, content) VALUES (1, 'Hello world!')",) From c2103071bcb1bac20b7acd49e5221bdec518e5eb Mon Sep 17 00:00:00 2001 From: Imbus Date: Sat, 21 Oct 2023 07:54:47 +0200 Subject: [PATCH 09/17] Working login modal pointed to the correct api endpoint --- client-solid/index.html | 2 +- client-solid/src/Root.tsx | 195 +++++++++++++++++++++++++++++++++----- client-solid/src/api.ts | 4 +- 3 files changed, 174 insertions(+), 27 deletions(-) diff --git a/client-solid/index.html b/client-solid/index.html index 35ca88f..363220e 100644 --- a/client-solid/index.html +++ b/client-solid/index.html @@ -9,7 +9,7 @@ FrostByteSolid - +
    diff --git a/client-solid/src/Root.tsx b/client-solid/src/Root.tsx index 60c0b15..a07f185 100644 --- a/client-solid/src/Root.tsx +++ b/client-solid/src/Root.tsx @@ -1,4 +1,4 @@ -import { createSignal } from "solid-js"; +import { Accessor, createSignal, useContext } from "solid-js"; import { createContext } from "solid-js"; import { Route, Routes, A } from "@solidjs/router"; @@ -6,30 +6,71 @@ import { Route, Routes, A } from "@solidjs/router"; import { createPost, getPosts } from "./api"; import { Post, NewPost } from "./api"; -export const TestContext = createContext("Test123"); +// Representing the state of varoious modals. +// So far we only have one modal, but we can add more later +// by adding more fields to this interface, or maybe an enum +interface ModalContextType { + loginModalOpen: Accessor; + setLoginModalOpen: (value: boolean) => void; +} + +interface LoginContextType { + token: Accessor; + setToken: (value: string) => void; + username: Accessor; + setUsername: (value: string) => void; +} + +// It is unclear to me if this is the idiomatic way to do this in Solid +export const ModalContext = createContext(); +export const LoginContext = createContext(); function Root() { + // All of these are passed into context providers + const [loginModalOpen, setLoginModalOpen] = createSignal(false); + const [token, setToken] = createSignal(""); + const [username, setUsername] = createSignal(""); + + // This may not be the best place to do this. + localStorage.getItem("token") && setToken(localStorage.getItem("token")!); + localStorage.getItem("username") && + setUsername(localStorage.getItem("username")!); + return ( <> - -
    - -
    - + + +
    + + +
    + +
    -
    - + + ); } function Navbar() { + let modal_ctx = useContext(ModalContext); + let login_ctx = useContext(LoginContext); return (
    FrostByte - - Login + { + b.preventDefault(); + modal_ctx?.setLoginModalOpen(true); + }} + > + {login_ctx?.token() != "" ? login_ctx?.username() : "Login"}
    ); @@ -54,11 +95,14 @@ function Menu() { function NewPostInputArea() { const [content, setContent] = createSignal(""); + const login_ctx = useContext(LoginContext); + return (
    - -
    + ); } diff --git a/client-solid/src/SinglePost.tsx b/client-solid/src/SinglePost.tsx new file mode 100644 index 0000000..b4440be --- /dev/null +++ b/client-solid/src/SinglePost.tsx @@ -0,0 +1,19 @@ +import { useParams } from "@solidjs/router"; +import { Show, Suspense, createResource } from "solid-js"; +import { getPost } from "./api"; +import { PostSegment } from "./Posts"; + +export function SinglePost() { + const params = useParams(); + const [post] = createResource(params.postid, getPost); + + return ( + Some loading message
    }> +
    + + + +
    + + ); +} diff --git a/client-solid/src/api.ts b/client-solid/src/api.ts index e858037..6b9660f 100644 --- a/client-solid/src/api.ts +++ b/client-solid/src/api.ts @@ -11,13 +11,12 @@ interface Votes { } export interface Post extends NewPost { - uuid: string; + id: string; createdAt: string; votes: Votes; } export async function getPosts(): Promise { -// const res = await fetch(`${API_URL}/posts`); const res = await fetch("/api/posts"); const data = await res.json(); return data; @@ -25,7 +24,9 @@ export async function getPosts(): Promise { export async function getPost(id: string): Promise { const res = await fetch(`/api/posts/${id}`); + console.log(res) const data = await res.json(); + console.log(data) return data; } From 9c60ae2000c876f019532c984abd8aaa8befc267 Mon Sep 17 00:00:00 2001 From: Imbus Date: Fri, 27 Oct 2023 16:05:12 +0200 Subject: [PATCH 14/17] Individual post api endpoint --- server/src/db.rs | 8 ++++++++ server/src/main.rs | 3 ++- server/src/routes/post.rs | 13 +++++++++++-- 3 files changed, 21 insertions(+), 3 deletions(-) diff --git a/server/src/db.rs b/server/src/db.rs index 0c694ee..aa7e33d 100644 --- a/server/src/db.rs +++ b/server/src/db.rs @@ -19,6 +19,14 @@ pub async fn db_get_latest_posts(pool: &SqlitePool, limit: i64, offset: i64) -> .unwrap() } +// Gets the post with id from the database +pub async fn db_get_post(id: i64, pool: &SqlitePool) -> Option { + sqlx::query_as!(Post, "SELECT * FROM posts WHERE id = ?", id) + .fetch_one(pool) + .await + .ok() +} + // Inserts a new post to the database pub async fn db_new_post(userid: i64, content: &str, pool: &SqlitePool) -> Option { info!("User with id {} submitted a post", userid); diff --git a/server/src/main.rs b/server/src/main.rs index 719a040..6d95008 100755 --- a/server/src/main.rs +++ b/server/src/main.rs @@ -10,7 +10,7 @@ mod jwt; mod routes; mod state; -use routes::{get_posts, login, new_post, register}; +use routes::{get_posts, login, new_post, post_by_id, register}; use state::CaptchaState; use state::ServerState; @@ -31,6 +31,7 @@ async fn main() -> std::io::Result<()> { scope("/api") .service(get_posts) .service(new_post) + .service(post_by_id) .service(login) .service(register) .app_data(Data::new(data.clone())) diff --git a/server/src/routes/post.rs b/server/src/routes/post.rs index 8380f97..42ef85e 100755 --- a/server/src/routes/post.rs +++ b/server/src/routes/post.rs @@ -1,8 +1,8 @@ -use crate::db::{db_get_latest_posts, db_new_post}; +use crate::db::{db_get_latest_posts, db_get_post, db_new_post}; use crate::jwt::validate_token; use crate::ServerState; -use actix_web::web::{Data, Query}; +use actix_web::web::{Data, Path, Query}; use actix_web::{get, post, web::Json, HttpResponse, Responder, Result}; use log::info; use serde::{Deserialize, Serialize}; @@ -94,3 +94,12 @@ pub async fn new_post(new_post: Json, state: Data) -> Resu None => Ok(HttpResponse::InternalServerError().json("Error")), }; } + +#[get("posts/{id}")] +pub async fn post_by_id(path: Path, state: Data) -> Result { + let id = path.into_inner(); + match db_get_post(id, &state.pool).await { + Some(post) => Ok(HttpResponse::Ok().json(post)), + None => Ok(HttpResponse::NotFound().json("Error")), + } +} From e9b215c686662e84db6414761c80b7b288d06d60 Mon Sep 17 00:00:00 2001 From: Imbus Date: Wed, 1 Nov 2023 15:47:51 +0100 Subject: [PATCH 15/17] Fixed cleaning target in justfile --- justfile | 2 ++ 1 file changed, 2 insertions(+) diff --git a/justfile b/justfile index e0e6a37..bedd409 100644 --- a/justfile +++ b/justfile @@ -63,6 +63,8 @@ clean: {{runtime}} image rm -f fb-server-debug rm -rf client/dist rm -rf client/node_modules + rm -rf client-solid/dist + rm -rf client-solid/node_modules rm -rf server/public rm -rf server/target @echo "Cleaned up! Make sure to run 'just nuke' to nuke everything podman related." From d92a1cd617a5b9cdac548e4b1d840e5434e6dae7 Mon Sep 17 00:00:00 2001 From: Imbus Date: Thu, 2 Nov 2023 11:29:34 +0100 Subject: [PATCH 16/17] Demo user --- server/src/state.rs | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/server/src/state.rs b/server/src/state.rs index 6264987..43b2519 100644 --- a/server/src/state.rs +++ b/server/src/state.rs @@ -2,6 +2,8 @@ use std::collections::BTreeMap; use std::sync::Arc; use std::sync::Mutex; +use log::error; +use log::info; use sqlx::Pool; use sqlx::Sqlite; use sqlx::SqlitePool; @@ -30,6 +32,7 @@ impl ServerState { // This is almost certainly bad practice for more reasons than I can count dotenvy::dotenv().ok(); let db_url = dotenvy::var("DATABASE_URL").unwrap_or(":memory:".to_string()); + info!("Using db_url: {}", &db_url); let pool = sqlite::SqlitePoolOptions::new() .max_connections(5) @@ -39,6 +42,12 @@ impl ServerState { sqlx::migrate!("./migrations").run(&pool).await.unwrap(); + match crate::db::db_new_user("imbus".to_string(), "kartellen1234".to_string(), &pool).await + { + Some(u) => info!("Created default user {}", u.username), + None => error!("Failed to create default user..."), + } + #[cfg(debug_assertions)] debug_setup(&pool).await.unwrap(); From b3124948c4656542dc18509973f740cfed8a0588 Mon Sep 17 00:00:00 2001 From: Imbus Date: Sat, 4 Nov 2023 21:53:55 +0100 Subject: [PATCH 17/17] Create sqlite db if not exist, constrain debug deps to debug builds --- justfile | 2 +- server/src/state.rs | 9 ++++++++- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/justfile b/justfile index bedd409..1ec67a7 100644 --- a/justfile +++ b/justfile @@ -32,7 +32,7 @@ build-container-release: # Builds a release container and runs it start-release: build-container-release remove-podman-containers - {{runtime}} run -d -p 8080:8080 --name frostbyte fb-server + {{runtime}} run -d -e DATABASE_URL=sqlite:release.db -p 8080:8080 --name frostbyte fb-server init-sqlx: echo "DATABASE_URL=sqlite:debug.db" > server/.env diff --git a/server/src/state.rs b/server/src/state.rs index 43b2519..b828927 100644 --- a/server/src/state.rs +++ b/server/src/state.rs @@ -4,9 +4,9 @@ use std::sync::Mutex; use log::error; use log::info; +use sqlx::migrate::MigrateDatabase; use sqlx::Pool; use sqlx::Sqlite; -use sqlx::SqlitePool; use sqlx::{self, sqlite}; #[derive(Clone)] @@ -34,6 +34,10 @@ impl ServerState { let db_url = dotenvy::var("DATABASE_URL").unwrap_or(":memory:".to_string()); info!("Using db_url: {}", &db_url); + if !sqlx::Sqlite::database_exists(&db_url).await.unwrap() { + sqlx::Sqlite::create_database(&db_url).await.unwrap(); + } + let pool = sqlite::SqlitePoolOptions::new() .max_connections(5) .connect(&db_url) @@ -55,6 +59,9 @@ impl ServerState { } } +#[cfg(debug_assertions)] +use sqlx::SqlitePool; + // Inserts a bunch of dummy data into the database // Mostly useful for debugging new posts, as we need to satisfy foreign key constraints. #[cfg(debug_assertions)]