oslo-lib/Cargo.toml

@@ -4,9 +4,8 @@ version = "0.1.0"
 authors = ["Dylan Baker <dylan@simulacrum.party>"]
 edition = "2018"
 
-# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
-
 [dependencies]
+rust-argon2 = "0.4.0"
 async-std = { version = "1.6.0", features = ["attributes"] }
 chrono = { version = "0.4", features = ["serde", "rustc-serialize"] }
 dotenv = "0.15.0"

oslo-lib/src/lib.rs

@@ -1,4 +1,5 @@
-use dotenv;
+use argon2::{self, Config};
+use dotenv::{self};
 use tide::utils::After;
 
 mod fs;
@@ -23,8 +24,6 @@ pub async fn build_app() -> Result<tide::Server<State>, tide::Error> {
         login_path: login_path.clone(),
     });
 
-    app.at("/static").serve_dir("static")?;
-
     app.with(After(errors));
     app.with(session());
 
@@ -55,3 +54,11 @@ pub async fn build_app() -> Result<tide::Server<State>, tide::Error> {
 
     Ok(app)
 }
+
+pub fn hash_password(password: &str, username: &str) -> String {
+    let password = password.as_bytes();
+    let salt = format!("{}{}", &username, &username);
+    let salt = salt.as_bytes();
+    let config = Config::default();
+    argon2::hash_encoded(password, salt, &config).unwrap()
+}

oslo-lib/src/routes.rs

@@ -8,7 +8,7 @@ use tide::{Redirect, Request, Response, Result, StatusCode};
 
 use std::env;
 
-use crate::{fs, post::Post, templates::render_template, util, State};
+use crate::{fs, hash_password, post::Post, templates::render_template, util, State};
 
 #[derive(Debug, Serialize, Deserialize)]
 struct User {
@@ -87,7 +87,8 @@ pub async fn login(mut req: Request<State>) -> Result {
     let username = env::var("ADMIN_USERNAME")?;
     let password = env::var("ADMIN_PASSWORD")?;
     let user: User = req.body_form().await?;
-    if user.username == username && user.password == password {
+
+    if user.username == username && hash_password(&user.password, &user.username) == password {
         req.session_mut().insert("logged_in", true)?;
         redirect("/")
     } else {

src/main.rs

@@ -1,13 +1,29 @@
-use oslo_lib::build_app;
+use oslo_lib::{build_app, hash_password};
 use tide::Result;
 
 #[async_std::main]
 async fn main() -> Result<()> {
-    tide::log::start();
-    let hostname = std::env::var("HOSTNAME").unwrap_or(String::from("127.0.0.1"));
-    let port = std::env::var("PORT").unwrap_or(String::from("8080"));
-    let app = build_app().await?;
-    app.listen(format!("{}:{}", hostname, port)).await?;
+    let mut args = std::env::args();
+    if let Some(command) = &args.nth(1) {
+        if command == "passwordgen" {
+            let username = &args.next().expect("Username is required");
+            let password = &args.next().expect("Password is required");
+            let hash = hash_password(&password, &username);
+            println!("{}", hash);
+        }
 
-    Ok(())
+        Ok(())
+    } else {
+        let env = std::env::var("OSLO_ENVIRONMENT").unwrap_or(String::from("development"));
+        if env == "development" {
+            tide::log::start();
+        }
+
+        let hostname = std::env::var("HOSTNAME").unwrap_or(String::from("127.0.0.1"));
+        let port = std::env::var("PORT").unwrap_or(String::from("8080"));
+        let app = build_app().await?;
+        app.listen(format!("{}:{}", hostname, port)).await?;
+
+        Ok(())
+    }
 }

tests/auth.rs

@@ -2,7 +2,7 @@ mod tests {
     use std::path::PathBuf;
 
     use async_std::task::block_on;
-    use oslo_lib::State;
+    use oslo_lib::{hash_password, State};
     use serde_json::json;
     use tide::{
         http::{Method, Request, Response, StatusCode, Url},
@@ -10,6 +10,11 @@ mod tests {
     };
 
     async fn build_app() -> Server<State> {
+        std::env::set_var("ADMIN_USERNAME", "correct_username".to_string());
+        std::env::set_var(
+            "ADMIN_PASSWORD",
+            hash_password("correct_password", "correct_username"),
+        );
         oslo_lib::build_app().await.unwrap()
     }
 
@@ -38,8 +43,8 @@ mod tests {
             let app = build_app().await;
             let mut req = Request::new(Method::Post, url("login"));
             req.set_content_type(tide::http::mime::MULTIPART_FORM);
-            let username = std::env::var("ADMIN_USERNAME").unwrap();
-            let password = std::env::var("ADMIN_PASSWORD").unwrap();
+            let username = String::from("correct_username");
+            let password = String::from("correct_password");
             req.replace_body(format!("username={}&password={}", username, password));
             let res: Response = app.respond(req).await?;
             assert_eq!(res.status(), StatusCode::Found);