package api import ( "crypto/rand" "fmt" "math/big" "net/http" "time" "dns.froth.zone/pomme/internal" "github.com/go-chi/render" "golang.org/x/crypto/bcrypt" "gorm.io/gorm" ) // NewUser takes a POST request and user form and creates a user in the database. func NewUser(w http.ResponseWriter, r *http.Request) { var result internal.User logger, ok := r.Context().Value(keyLoggerContextID).(*Responder) if !ok { return } db, ok := r.Context().Value(keyPrincipalContextID).(*gorm.DB) if !ok { logger.Response = Response{ Message: "unable to init DB", } logger.newLogEntry().apiError(logger.Response, w, r) return } err := r.ParseForm() if err != nil { logger.Response = Response{ Message: "unable to parse request", Status: http.StatusInternalServerError, Err: err.Error(), } logger.newLogEntry().infoLogger(logger.Response) logger.newLogEntry().apiError(logger.Response, w, r) return } username := r.Form.Get("username") if username == "" { username = autoUname() } password := r.Form.Get("password") if password == "" { logger.Response = Response{ Message: "no password provided", Status: http.StatusInternalServerError, } logger.newLogEntry().infoLogger(logger.Response) logger.newLogEntry().apiError(logger.Response, w, r) return } db.Where("username = ?", username).First(&result) if result.Username != "" { logger.Response = Response{ Message: "internal server error", Status: http.StatusInternalServerError, } logger.newLogEntry().infoLogger(logger.Response) logger.newLogEntry().apiError(logger.Response, w, r) return } hashedPassword, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost) if err != nil { logger.Response = Response{ Message: "login failed", Status: http.StatusUnauthorized, Realm: "authentication", } logger.newLogEntry().infoLogger(logger.Response) return } db.Create(&internal.User{Username: username, HashedPassword: string(hashedPassword)}) token, err := makeToken(username) if err != nil { logger.Response = Response{ Message: "internal server error", Status: http.StatusInternalServerError, Err: err.Error(), } logger.newLogEntry().errorLogger(logger.Response) return } http.SetCookie(w, &http.Cookie{ HttpOnly: true, Expires: time.Now().Add(1 * time.Hour), MaxAge: 3600, SameSite: http.SameSiteStrictMode, // Comment below to disable HTTPS: Secure: true, Name: "jwt", // Must be named "jwt" or else the token cannot be searched for by jwtauth.Verifier. Value: token, }) w.Header().Set("Content-Type", "application/json; charset=utf-8") w.WriteHeader(http.StatusCreated) render.JSON(w, r, internal.Response{ Message: "Successfully created account and logged in", }) http.Redirect(w, r, "/", http.StatusSeeOther) } func autoUname() string { n, err := rand.Int(rand.Reader, big.NewInt(1000)) if err != nil { return "" } return fmt.Sprintf("user%d", n.Int64()) }