From 2ab5b1aa4c0d01a5012a7f9599fd00241f8d33a7 Mon Sep 17 00:00:00 2001
From: Guillaume Horel <guillaume.horel@gmail.com>
Date: Tue, 15 Oct 2019 21:50:34 -0400
Subject: WIP to handle different hashing schemes

---
 store.go | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

(limited to 'store.go')

diff --git a/store.go b/store.go
index d830150..1744ada 100644
--- a/store.go
+++ b/store.go
@@ -1,7 +1,10 @@
 package main
 
 import (
+	"bytes"
+	"crypto/subtle"
 	"database/sql"
+	"errors"
 	"log"
 	"time"
 
@@ -24,6 +27,7 @@ type Store interface {
 	GetSession(id string) (*Session, bool)
 	NewSession(userId int64) *Session
 	GetUser(name string) (*User, bool)
+	ValidateUser(name string, password string) (*User, error)
 	DeleteSession(id string)
 	ChangePassword(userId int64, hash []byte)
 }
@@ -88,3 +92,29 @@ func (store *PgStore) GetUser(name string) (*User, bool) {
 	}
 	return u, true
 }
+
+func (store *PgStore) ValidateUser(name string, password string) (*User, error) {
+	u := &User{Name: name}
+	row := store.QueryRow(
+		"SELECT id, password FROM users WHERE name = $1",
+		name,
+	)
+	if err := row.Scan(&u.Id, &u.Password); err != nil {
+		return nil, errors.New("Utilisateur non enregistré")
+	}
+	z := bytes.SplitN(u.Password, []byte("}"), 2)
+	scheme := string(z[0][:len(z[0])])
+	true_hash := z[1]
+	var hash []byte
+	switch scheme {
+	case "PLAIN-MD5":
+		hash = md5hex([]byte(password))
+	default:
+		return nil, errors.New("Unknown password hashing scheme.")
+	}
+	if subtle.ConstantTimeCompare(true_hash, hash) != 1 {
+		return nil, errors.New("Mot de passe incorrect.")
+	} else {
+		return u, nil
+	}
+}
-- 
cgit v1.2.3-70-g09d2