pica/server/server.cpp

//  SPDX-FileCopyrightText: 2023 Yury Gubich <blue@macaw.me>
//  SPDX-License-Identifier: GPL-3.0-or-later

#include "server.h"

#include <random>

#include "handler/info.h"
#include "handler/env.h"
#include "handler/register.h"
#include "handler/login.h"

constexpr const char* pepper = "well, not much of a secret, huh?";
constexpr uint8_t currentDbVesion = 1;
constexpr const char* randomChars = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
constexpr uint8_t saltSize = 16;
constexpr uint8_t hashSize = 32;
constexpr uint8_t hashParallel = 1;
constexpr uint8_t hashIterations = 2;
constexpr uint32_t hashMemoryCost = 65536;

Server::Server():
    terminating(false),
    requestCount(0),
    serverName(std::nullopt),
    router(),
    db(),
    sessions()
{
    std::cout << "Startig pica..." << std::endl;

    db = DBInterface::create(DBInterface::Type::mysql);
    std::cout << "Database type: MySQL" << std::endl;

    db->setCredentials("pica", "pica");
    db->setDatabase("pica");

    db->connect("/run/mysqld/mysqld.sock");
    db->migrate(currentDbVesion);

    router.addRoute(std::make_unique<Handler::Info>());
    router.addRoute(std::make_unique<Handler::Env>());
    router.addRoute(std::make_unique<Handler::Register>(this));
    router.addRoute(std::make_unique<Handler::Login>(this));
}

Server::~Server() {}

void Server::run(int socketDescriptor) {
    while (!terminating) {
        std::unique_ptr<Request> request = std::make_unique<Request>();
        bool result = request->wait(socketDescriptor);
        if (!result) {
            std::cerr << "Error accepting a request" << std::endl;
            return;
        }
        handleRequest(std::move(request));
    }
}

void Server::handleRequest(std::unique_ptr<Request> request) {
    ++requestCount;
    if (!serverName) {
        try {
            serverName = request->getServerName();
            std::cout << "received server name " << serverName.value() << std::endl;
        } catch (...) {
            std::cerr << "failed to read server name" << std::endl;
            Response& error = request->createResponse(Response::Status::internalError);
            error.send();
            return;
        }
    }

    std::string path = request->getPath(serverName.value());
    router.route(path.data(), std::move(request));
}

std::string Server::generateRandomString(std::size_t length) {
    std::random_device rd;
    std::mt19937 gen(rd());
    std::uniform_int_distribution<uint8_t> distribution(0, std::strlen(randomChars) - 1);

    std::string result(length, 0);
    for (size_t i = 0; i < length; ++i)
        result[i] = randomChars[distribution(gen)];

    return result;
}

unsigned int Server::registerAccount(const std::string& login, const std::string& password) {
    std::size_t encSize = argon2_encodedlen(
        hashIterations, hashMemoryCost,
        hashParallel, saltSize, hashSize, Argon2_id
    );

    std::string hash(encSize, 0);
    std::string salt = generateRandomString(saltSize);
    std::string spiced = password + pepper;

    int result = argon2id_hash_encoded(
        hashIterations, hashMemoryCost, hashParallel,
        spiced.data(), spiced.size(),
        salt.data(), saltSize,
        hashSize, hash.data(), encSize
    );

    if (result != ARGON2_OK)
        throw std::runtime_error(std::string("Hashing failed: ") + argon2_error_message(result));

    return db->registerAccount(login, hash);
}

bool Server::validatePassword(const std::string& login, const std::string& password) {
    std::string hash = db->getAccountHash(login);

    std::string spiced = password + pepper;
    int result = argon2id_verify(hash.data(), spiced.data(), spiced.size());

    switch (result) {
        case ARGON2_OK:
            return true;
        case ARGON2_VERIFY_MISMATCH:
            return false;
        default:
            throw std::runtime_error(std::string("Failed to verify password: ") + argon2_error_message(result));
    }
}

Session& Server::openSession(const std::string& login) {
    std::string accessToken = generateRandomString(32);
    std::string renewToken = generateRandomString(32);
    unsigned int sessionId = db->createSession(login, accessToken, renewToken);

    std::unique_ptr<Session>& session = sessions[accessToken] = std::make_unique<Session>(sessionId, accessToken, renewToken);
    return *session.get();
}