password encryption

Author: jim108dev

.psc-ide-port

@@ -1 +1 @@
-15328
+15822

sql/CreateDB.sql

@@ -1,9 +1,13 @@
 DROP DATABASE IF EXISTS conduit;
 
 CREATE DATABASE conduit;
+
 CREATE USER a WITH ENCRYPTED PASSWORD 'password';
+
 GRANT ALL PRIVILEGES ON DATABASE conduit TO a;
 
 \connect conduit
 CREATE EXTENSION IF NOT EXISTS citext;
 
+CREATE EXTENSION IF NOT EXISTS pgcrypto;
+

src/Server/User/Persistence/Postgres.purs

@@ -3,7 +3,6 @@
 module Server.User.Persistence.Postgres (mkHandle) where
 
 import Prelude
-
 import Control.Monad.Except (throwError)
 import Data.Array (head)
 import Data.Either (Either(..))
@@ -29,7 +28,7 @@ mkHandle p =
 findByCredentials :: Pool -> Credentials -> Aff Result
 findByCredentials pool { email, password } =
   withClient pool \conn ->
-    query readJson (Query """SELECT * FROM "user" WHERE email = $1 AND password = $2""" :: Query User)
+    query readJson (Query """SELECT * FROM "user" WHERE email = $1 AND password = crypt($2, password)""" :: Query User)
       [ p_ email, p_ password ]
       conn
       >>= validate
@@ -53,15 +52,25 @@ findById pool id =
 insert :: Pool -> Raw -> Aff Result
 insert pool u =
   withClient pool \conn ->
-    query readJson (Query """INSERT INTO "user" (bio, email, image, password, username) VALUES ($1, $2, $3, $4, $5) RETURNING *""" :: Query User)
+    query readJson (Query """INSERT INTO "user" (bio, email, image, password, username) VALUES ($1, $2, $3, crypt($4, gen_salt('bf')), $5) RETURNING *""" :: Query User)
       [ p_ u.bio, p_ u.email, p_ u.image, p_ u.password, p_ u.username ]
       conn
       >>= validate
 
 update :: Pool -> Raw -> UserId -> Aff Result
 update pool r id =
   withClient pool \conn ->
-    query readJson (Query """UPDATE "user" SET  bio = $1, email = $2, image = $3, password = $4, username = $5 WHERE id = $6 RETURNING *""" :: Query User)
+    query readJson
+      ( Query
+          """UPDATE "user" SET bio = $1, email = $2, image = $3
+    , password = 
+      CASE  
+			  WHEN password = crypt($4, password) THEN password 
+          ELSE crypt($4, gen_salt('bf'))
+		  END     
+    , username = $5 WHERE id = $6 RETURNING *""" ::
+          Query User
+      )
       [ p_ r.bio, p_ r.email, p_ r.image, p_ r.password, p_ r.username, p_ id ]
       conn
       >>= validate

src/Shared/Type/Misc.purs

@@ -49,7 +49,7 @@ type Offset
   = Int
 
 type Password
-  = ShortString
+  = LongString
 
 type Secret
   = String

test/Server/User/UpdateBackSuccessRequest.json

@@ -1,8 +1,9 @@
 {
     "user": {
-        "username": "jake",
-        "image": null,
+        "bio": "I work at statefarm",
         "email": "jake@jake.jake",
-        "bio": "I work at statefarm"
+        "image": null,
+        "password": "jake",
+        "username": "jake"
     }
 }

test/Server/User/UpdateSuccessRequest.json

@@ -1,8 +1,9 @@
 {
     "user": {
-        "username": "jim",
-        "image": null,
+        "bio": "I work at statefarm",
         "email": "jim@jjim.jim",
-        "bio": "I work at statefarm"
+        "image": null,
+        "password": "jim",
+        "username": "jim"
     }
 }