store user password as hash

Author: PegasisForever

Cargo.lock

@@ -18,3 +18,4 @@ env_logger = "0.7"
 log = "0.4.11"
 json = "0.12.4"
 actix-cors = "0.2.0"
+rust-argon2 = "0.8.2"

Cargo.toml

@@ -62,11 +62,7 @@ impl UserDB {
     pub fn add(self: &UserDB, name: &str, password: &str) -> Result<Arc<User>, UserDBError> {
         match self.find(name) {
             None => {
-                let user = User {
-                    name: String::from(name),
-                    password: String::from(password),
-                };
-                let arc = Arc::new(user);
+                let arc = Arc::new(User::new(name, password));
                 self.list.lock().unwrap().push(arc.clone());
                 Ok(arc)
             }

src/database/user_db.rs

@@ -1,36 +1,49 @@
 use serde::Deserialize;
 use std::hash::Hasher;
 use json::{object, JsonValue};
+use argon2::{self, Config};
 
 #[derive(Debug, Clone, Deserialize)]
 pub struct User {
     pub name: String,
-    pub password: String,
+    password_hash: String,
 }
 
+const SALT: &[u8] = "fguU2N7af73!5^rD!!cZE9Z!5CK&f67yFPYRBvHM4%8UbbBNXVW-d+t7*QQwzn4c".as_bytes();
+
 impl User {
+    pub fn new(name: &str, password: &str) -> Self {
+        let config = Config::default();
+        let hash = argon2::hash_encoded(password.as_bytes(), SALT, &config).unwrap();
+
+        Self {
+            name: String::from(name),
+            password_hash: hash,
+        }
+    }
+
     pub fn from_json(json: &JsonValue) -> Self {
         Self {
             name: String::from(json["name"].as_str().unwrap()),
-            password: String::from(json["password"].as_str().unwrap()),
+            password_hash: String::from(json["password_hash"].as_str().unwrap()),
         }
     }
 
     pub fn to_json(self: &Self) -> JsonValue {
         object! {
             name: self.name.clone(),
-            password: self.password.clone(),
+            password_hash: self.password_hash.clone(),
         }
     }
 
     pub fn verify_password(self: &Self, password: &str) -> bool {
-        self.password == password
+        argon2::verify_encoded(&self.password_hash, password.as_bytes()).is_ok()
     }
 }
 
 impl std::cmp::PartialEq for User {
     fn eq(&self, other: &Self) -> bool {
-        self.name == other.name && self.password == other.password
+        self.name == other.name && self.password_hash == other.password_hash
     }
 }
 
@@ -39,6 +52,6 @@ impl std::cmp::Eq for User {}
 impl std::hash::Hash for User {
     fn hash<H: Hasher>(&self, state: &mut H) {
         self.name.hash(state);
-        self.password.hash(state);
+        self.password_hash.hash(state);
     }
 }