14 files changed, 490 insertions, 48 deletions

diff --git a/.zed/tasks.json b/.zed/tasks.json
index e725a43..cf60465 100644
--- a/.zed/tasks.json
+++ b/.zed/tasks.json
@@ -32,12 +32,40 @@
     "shell": "system"
   },
   {
+    "label": "Run debug database",
+    "command": "docker",
+    "args": [
+      "run",
+      "--name",
+      "debug-postgres",
+      "-e",
+      "POSTGRES_PASSWORD=itmo_queue",
+      "-e",
+      "POSTGRES_USER=itmo_queue",
+      "-e",
+      "POSTGRES_DB=itmo_queue",
+      "-p",
+      "5432:5432",
+      "--rm",
+      "postgres"
+    ],
+
+    "use_new_terminal": false,
+    "allow_concurrent_runs": false,
+    "reveal": "no_focus",
+    "reveal_target": "dock",
+    "hide": "never",
+    "shell": "system"
+  },
+  {
     "label": "Run release server",
     "command": "cargo",
     "args": ["run", "-r"],
 
     "env": {
-      "SERVER_BIND": "0.0.0.0:8080"
+      "SECRET": "secret",
+      "SERVER_BIND": "0.0.0.0:8080",
+      "DATABASE_URL": "postgres://itmo_queue:itmo_queue@localhost/itmo_queue"
     },
 
     "use_new_terminal": false,
@@ -53,7 +81,9 @@
     "args": ["run"],
 
     "env": {
-      "SERVER_BIND": "0.0.0.0:8080"
+      "SECRET": "secret",
+      "SERVER_BIND": "0.0.0.0:8080",
+      "DATABASE_URL": "postgres://itmo_queue:itmo_queue@localhost/itmo_queue"
     },
 
     "use_new_terminal": false,
diff --git a/Cargo.toml b/Cargo.toml
index 9b59ed0..3dc810d 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -8,8 +8,13 @@ publish = false
 members = [".", "entity", "migration"]
 
 [dependencies]
+argon2 = "0.5.3"
 axum = "0.8.4"
+axum-extra = { version = "0.10.1", features = ["typed-header"] }
+chrono = { version = "0.4.41", features = ["serde"] }
 entity = { version = "0.1.0", path = "entity" }
+headers = "0.4.1"
+jsonwebtoken = "9.3.1"
 migration = { version = "0.1.0", path = "migration" }
 sea-orm = { version = "1.1.14", features = ["sqlx-postgres", "runtime-tokio-rustls"] }
 serde = { version = "1.0.219", features = ["derive"] }
diff --git a/entity/src/users.rs b/entity/src/users.rs
index b61d51b..6628c9e 100644
--- a/entity/src/users.rs
+++ b/entity/src/users.rs
@@ -8,8 +8,8 @@ pub struct Model {
     #[sea_orm(primary_key)]
     pub id: i64,
     #[sea_orm(unique)]
-    pub login: String,
-    pub password: String,
+    pub username: String,
+    pub password_hash: String,
     pub password_issue_date: DateTime,
     pub first_name: String,
     pub last_name: String,
diff --git a/migration/src/m0_init_tables.rs b/migration/src/m0_init_tables.rs
index 576f45b..536b563 100644
--- a/migration/src/m0_init_tables.rs
+++ b/migration/src/m0_init_tables.rs
@@ -6,8 +6,8 @@ use sea_orm_migration::{prelude::*, schema::*};
 enum Users {
     Table,
     Id,
-    Login,
-    Password,
+    Username,
+    PasswordHash,
     PasswordIssueDate,
     FirstName,
     LastName,
@@ -64,8 +64,8 @@ impl MigrationTrait for Migration {
                     .table(Users::Table)
                     .if_not_exists()
                     .col(pk_auto(Users::Id).big_integer())
-                    .col(string(Users::Login).unique_key())
-                    .col(string(Users::Password))
+                    .col(string(Users::Username).unique_key())
+                    .col(string(Users::PasswordHash))
                     .col(timestamp(Users::PasswordIssueDate))
                     .col(string(Users::FirstName))
                     .col(string(Users::LastName))
diff --git a/src/auth.rs b/src/auth.rs
new file mode 100644
index 0000000..418f64e
--- /dev/null
+++ b/src/auth.rs
@@ -0,0 +1,49 @@
+use argon2::password_hash::rand_core::OsRng;
+use argon2::password_hash::{PasswordHasher, SaltString};
+use argon2::{Argon2, PasswordHash, PasswordVerifier};
+use jsonwebtoken::{self as jwt, DecodingKey, EncodingKey, Header, Validation};
+use serde::{Deserialize, Serialize};
+
+#[derive(Serialize, Deserialize)]
+pub struct JwtClaims {
+    pub sub: i64,
+    pub iat: i64,
+    pub exp: i64,
+}
+
+pub fn create_password(password: &str) -> argon2::password_hash::Result<String> {
+    Ok(Argon2::default()
+        .hash_password(password.as_bytes(), &SaltString::generate(&mut OsRng))?
+        .to_string())
+}
+
+pub fn validate_password(
+    password: &str,
+    password_hash: &str,
+) -> argon2::password_hash::Result<bool> {
+    Ok(Argon2::default()
+        .verify_password(password.as_bytes(), &PasswordHash::new(password_hash)?)
+        .is_ok())
+}
+
+pub fn create_jwt(claims: &JwtClaims, secret: &str) -> jwt::errors::Result<String> {
+    jwt::encode(
+        &Header::default(),
+        claims,
+        &EncodingKey::from_secret(secret.as_bytes()),
+    )
+}
+
+pub fn validate_jwt(token: &str, secret: &str) -> jwt::errors::Result<JwtClaims> {
+    let mut validation = Validation::default();
+    validation.set_required_spec_claims(&["exp"]);
+    validation.validate_exp = true;
+    validation.leeway = 0;
+
+    Ok(jwt::decode(
+        token,
+        &DecodingKey::from_secret(secret.as_bytes()),
+        &validation,
+    )?
+    .claims)
+}
diff --git a/src/error.rs b/src/error.rs
new file mode 100644
index 0000000..2d0f911
--- /dev/null
+++ b/src/error.rs
@@ -0,0 +1,89 @@
+use axum::extract::rejection::JsonRejection;
+use axum::response::{IntoResponse, Response};
+use axum_extra::typed_header::TypedHeaderRejection;
+
+use crate::response::{ErrorResponse, FailResponse, SuccessResponse};
+
+pub type ApiResult<T> = Result<SuccessResponse<T>, ApiError>;
+
+pub enum ApiError {
+    // 400
+    BadJsonBody(String),
+    BadAuthTokenHeader(String),
+    UserAlreadyExists { username: String },
+    InvalidPassword,
+    NotAuthorized,
+    // 500
+    Database(String),
+    PasswordHash(String),
+    InternalJwt(String),
+}
+
+impl From<JsonRejection> for ApiError {
+    fn from(value: JsonRejection) -> Self {
+        Self::BadJsonBody(value.body_text())
+    }
+}
+
+impl From<TypedHeaderRejection> for ApiError {
+    fn from(value: TypedHeaderRejection) -> Self {
+        Self::BadAuthTokenHeader(value.to_string())
+    }
+}
+
+impl From<sea_orm::DbErr> for ApiError {
+    fn from(value: sea_orm::DbErr) -> Self {
+        Self::Database(value.to_string())
+    }
+}
+
+impl From<argon2::password_hash::Error> for ApiError {
+    fn from(value: argon2::password_hash::Error) -> Self {
+        Self::PasswordHash(value.to_string())
+    }
+}
+
+impl ToString for ApiError {
+    fn to_string(&self) -> String {
+        match self {
+            // 400
+            ApiError::BadJsonBody(..) => "BadJsonBody",
+            ApiError::BadAuthTokenHeader(..) => "BadAuthTokenHeader",
+            ApiError::UserAlreadyExists { .. } => "UserAlreadyExists",
+            ApiError::InvalidPassword => "InvalidPassword",
+            ApiError::NotAuthorized => "NotAuthorized",
+            // 500
+            ApiError::Database(..) => "Database",
+            ApiError::PasswordHash(..) => "PasswordHash",
+            ApiError::InternalJwt(..) => "InternalJwt",
+        }
+        .to_string()
+    }
+}
+
+impl IntoResponse for ApiError {
+    fn into_response(self) -> Response {
+        let kind = self.to_string();
+        match self {
+            // 400
+            ApiError::BadJsonBody(msg) => FailResponse(kind, msg).into_response(),
+            ApiError::BadAuthTokenHeader(msg) => FailResponse(kind, msg).into_response(),
+            ApiError::UserAlreadyExists { username } => FailResponse(
+                kind,
+                format!("user with username `{}` already exists", username),
+            )
+            .into_response(),
+            ApiError::InvalidPassword => {
+                FailResponse(kind, "password is invalid".to_string()).into_response()
+            }
+            ApiError::NotAuthorized => {
+                FailResponse(kind, "user is not authorized".to_string()).into_response()
+            }
+
+            // 500
+            ApiError::Database(msg) => ErrorResponse(kind, msg).into_response(),
+            ApiError::PasswordHash(msg) => ErrorResponse(kind, msg).into_response(),
+            ApiError::InternalJwt(msg) => ErrorResponse(kind, msg).into_response(),
+        }
+    }
+}
diff --git a/src/extract/auth.rs b/src/extract/auth.rs
new file mode 100644
index 0000000..cc357fd
--- /dev/null
+++ b/src/extract/auth.rs
@@ -0,0 +1,36 @@
+use axum::extract::FromRequestParts;
+use axum::http::request::Parts;
+use axum_extra::TypedHeader;
+use entity::users;
+use headers::authorization::{Authorization, Bearer};
+use sea_orm::EntityTrait;
+
+use crate::{ApiError, AppState, validate_jwt};
+
+pub struct Auth(pub users::Model);
+
+impl FromRequestParts<AppState> for Auth {
+    type Rejection = ApiError;
+
+    async fn from_request_parts(
+        parts: &mut Parts,
+        state: &AppState,
+    ) -> Result<Self, Self::Rejection> {
+        let token_header =
+            TypedHeader::<Authorization<Bearer>>::from_request_parts(parts, state).await?;
+
+        let jwt_claims = validate_jwt(token_header.token(), &state.secret)
+            .map_err(|_| ApiError::NotAuthorized)?;
+
+        let user = users::Entity::find_by_id(jwt_claims.sub)
+            .one(&state.db)
+            .await?
+            .ok_or(ApiError::NotAuthorized)?;
+
+        if jwt_claims.iat < user.password_issue_date.and_utc().timestamp() {
+            return Err(ApiError::NotAuthorized);
+        }
+
+        Ok(Auth(user))
+    }
+}
diff --git a/src/extract/json.rs b/src/extract/json.rs
new file mode 100644
index 0000000..cfde15b
--- /dev/null
+++ b/src/extract/json.rs
@@ -0,0 +1,19 @@
+use axum::extract::rejection::JsonRejection;
+use axum::extract::{FromRequest, Request};
+
+use crate::error::ApiError;
+
+pub struct ApiJson<T>(pub T);
+
+impl<S, T> FromRequest<S> for ApiJson<T>
+where
+    axum::Json<T>: FromRequest<S, Rejection = JsonRejection>,
+    S: Send + Sync,
+{
+    type Rejection = ApiError;
+
+    #[inline]
+    async fn from_request(req: Request, state: &S) -> Result<Self, Self::Rejection> {
+        Ok(Self(axum::Json::<T>::from_request(req, state).await?.0))
+    }
+}
diff --git a/src/extract/mod.rs b/src/extract/mod.rs
new file mode 100644
index 0000000..b46a610
--- /dev/null
+++ b/src/extract/mod.rs
@@ -0,0 +1,5 @@
+mod auth;
+mod json;
+
+pub use auth::Auth;
+pub use json::ApiJson;
diff --git a/src/main.rs b/src/main.rs
index c53664a..3b3f868 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -1,9 +1,30 @@
+mod auth;
 mod error;
+mod extract;
 mod response;
 mod routers;
+mod state;
 
+pub use auth::{JwtClaims, create_jwt, create_password, validate_jwt, validate_password};
+pub use error::{ApiError, ApiResult};
+pub use response::{ErrorResponse, FailResponse, SuccessResponse};
+pub use state::AppState;
+
+use sea_orm::Database;
 use tokio::net::TcpListener;
-use tracing::{Level, info};
+use tower_http::trace::TraceLayer;
+use tracing::info;
+use tracing_subscriber::EnvFilter;
+
+async fn app_state() -> AppState {
+    let db_url = std::env::var("DATABASE_URL").expect("DATABASE_URL must be set");
+    let secret = std::env::var("SECRET").expect("SECRET must be set");
+
+    AppState {
+        db: Database::connect(db_url).await.unwrap(),
+        secret: secret,
+    }
+}
 
 async fn listener() -> TcpListener {
     let addr = std::env::var("SERVER_BIND").expect("SERVER_BIND must be set");
@@ -13,10 +34,13 @@ async fn listener() -> TcpListener {
 #[tokio::main]
 async fn main() {
     tracing_subscriber::fmt()
-        .with_max_level(Level::DEBUG)
+        .with_env_filter(EnvFilter::new("info,sqlx=warn,tower_http=debug"))
         .init();
 
-    let router = routers::router();
+    let state = app_state().await;
+    let router = routers::router()
+        .layer(TraceLayer::new_for_http())
+        .with_state(state);
     let listener = listener().await;
 
     info!(
diff --git a/src/response.rs b/src/response.rs
index 8d505a5..25c3008 100644
--- a/src/response.rs
+++ b/src/response.rs
@@ -1,32 +1,52 @@
+use axum::http::StatusCode;
 use axum::response::{IntoResponse, Response};
 use serde::Serialize;
 use serde_json::json;
 
-pub enum ApiResponse<T> {
-    Success(T),
-    Fail(T),
-    Error(String),
-}
+pub struct SuccessResponse<T>(pub T);
+pub struct FailResponse(pub String, pub String);
+pub struct ErrorResponse(pub String, pub String);
 
-impl<T> IntoResponse for ApiResponse<T>
+impl<T> IntoResponse for SuccessResponse<T>
 where
     T: Serialize,
 {
     fn into_response(self) -> Response {
-        axum::Json(match self {
-            ApiResponse::Success(data) => json!({
+        (
+            StatusCode::OK,
+            axum::Json(json!({
                 "status": "success",
-                "data": data
-            }),
-            ApiResponse::Fail(data) => json!({
+                "data": self.0
+            })),
+        )
+            .into_response()
+    }
+}
+
+impl IntoResponse for FailResponse {
+    fn into_response(self) -> Response {
+        (
+            StatusCode::BAD_REQUEST,
+            axum::Json(json!({
                 "status": "fail",
-                "data": data
-            }),
-            ApiResponse::Error(message) => json!({
+                "kind": self.0,
+                "message": self.1
+            })),
+        )
+            .into_response()
+    }
+}
+
+impl IntoResponse for ErrorResponse {
+    fn into_response(self) -> Response {
+        (
+            StatusCode::INTERNAL_SERVER_ERROR,
+            axum::Json(json!({
                 "status": "error",
-                "message": message
-            }),
-        })
-        .into_response()
+                "kind": self.0,
+                "message": self.1
+            })),
+        )
+            .into_response()
     }
 }
diff --git a/src/routers/account.rs b/src/routers/account.rs
index 8192133..98ee61d 100644
--- a/src/routers/account.rs
+++ b/src/routers/account.rs
@@ -1,24 +1,188 @@
 use axum::Router;
-use axum::response::IntoResponse;
-use axum::routing::{get, post};
+use axum::extract::State;
+use axum::routing::{delete, get, post, put};
+use chrono::{DateTime, Duration, Utc};
+use entity::users::{self};
+use sea_orm::ActiveValue::Set;
+use sea_orm::{
+    ActiveModelTrait, ColumnTrait, EntityTrait, IntoActiveModel, ModelTrait, QueryFilter,
+};
+use serde::{Deserialize, Serialize};
 
-use crate::response::ApiResponse;
+use crate::extract::{ApiJson, Auth};
+use crate::{
+    ApiError, ApiResult, AppState, JwtClaims, SuccessResponse, create_jwt, create_password,
+    validate_password,
+};
 
-async fn me() -> impl IntoResponse {
-    ApiResponse::Success("Me")
+#[derive(Serialize)]
+struct Account {
+    id: i64,
+    username: String,
+    first_name: String,
+    last_name: String,
 }
 
-async fn register() -> impl IntoResponse {
-    ApiResponse::Success("Register")
+#[derive(Serialize)]
+struct Token {
+    token: String,
+    expired_at: DateTime<Utc>,
 }
 
-async fn login() -> impl IntoResponse {
-    ApiResponse::Success("Login")
+async fn me(Auth(user): Auth) -> ApiResult<Account> {
+    return Ok(SuccessResponse(Account {
+        id: user.id,
+        username: user.username,
+        first_name: user.first_name,
+        last_name: user.last_name,
+    }));
 }
 
-pub(crate) fn router() -> Router {
+#[derive(Deserialize)]
+struct RegisterRequest {
+    username: String,
+    password: String,
+    first_name: String,
+    last_name: String,
+}
+
+async fn register(
+    State(state): State<AppState>,
+    ApiJson(req): ApiJson<RegisterRequest>,
+) -> ApiResult<Account> {
+    let user_exists = users::Entity::find()
+        .filter(users::Column::Username.eq(&req.username))
+        .one(&state.db)
+        .await?
+        .is_some();
+
+    if user_exists {
+        return Err(ApiError::UserAlreadyExists {
+            username: req.username,
+        });
+    }
+
+    let user = users::ActiveModel {
+        username: Set(req.username),
+        password_hash: Set(create_password(&req.password)?),
+        password_issue_date: Set(Utc::now().naive_utc()),
+        first_name: Set(req.first_name),
+        last_name: Set(req.last_name),
+        ..Default::default()
+    }
+    .insert(&state.db)
+    .await?;
+
+    Ok(SuccessResponse(Account {
+        id: user.id,
+        username: user.username,
+        first_name: user.first_name,
+        last_name: user.last_name,
+    }))
+}
+
+#[derive(Deserialize, Default)]
+enum TokenLifetime {
+    Day = 1,
+    #[default]
+    Week = 7,
+    Month = 31,
+}
+
+#[derive(Deserialize)]
+struct LoginRequest {
+    username: String,
+    password: String,
+    #[serde(default)]
+    token_lifetime: TokenLifetime,
+}
+
+async fn login(
+    State(state): State<AppState>,
+    ApiJson(req): ApiJson<LoginRequest>,
+) -> ApiResult<Token> {
+    let user = users::Entity::find()
+        .filter(users::Column::Username.eq(&req.username))
+        .one(&state.db)
+        .await?
+        .ok_or(ApiError::InvalidPassword)?;
+
+    if !validate_password(&req.password, &user.password_hash)? {
+        return Err(ApiError::InvalidPassword);
+    }
+
+    let expired_at = Utc::now() + Duration::days(req.token_lifetime as i64);
+
+    let token = create_jwt(
+        &JwtClaims {
+            sub: user.id,
+            iat: user.password_issue_date.and_utc().timestamp(),
+            exp: expired_at.timestamp(),
+        },
+        &state.secret,
+    )
+    .map_err(|e| ApiError::InternalJwt(e.to_string()))?;
+
+    Ok(SuccessResponse(Token { token, expired_at }))
+}
+
+#[derive(Deserialize)]
+struct ChangePasswordRequest {
+    old_password: String,
+    new_password: String,
+}
+
+async fn change_password(
+    State(state): State<AppState>,
+    Auth(user): Auth,
+    ApiJson(req): ApiJson<ChangePasswordRequest>,
+) -> ApiResult<Account> {
+    if !validate_password(&req.old_password, &user.password_hash)? {
+        return Err(ApiError::InvalidPassword);
+    }
+
+    let mut active_user = user.into_active_model();
+    active_user.password_hash = Set(create_password(&req.new_password)?);
+    active_user.password_issue_date = Set(Utc::now().naive_utc());
+
+    let user = active_user.update(&state.db).await?;
+    Ok(SuccessResponse(Account {
+        id: user.id,
+        username: user.username,
+        first_name: user.first_name,
+        last_name: user.last_name,
+    }))
+}
+
+#[derive(Deserialize)]
+struct DeleteUserRequest {
+    password: String,
+}
+
+async fn delete_account(
+    State(state): State<AppState>,
+    Auth(user): Auth,
+    ApiJson(req): ApiJson<DeleteUserRequest>,
+) -> ApiResult<Account> {
+    if !validate_password(&req.password, &user.password_hash)? {
+        return Err(ApiError::InvalidPassword);
+    }
+
+    user.clone().delete(&state.db).await?;
+
+    Ok(SuccessResponse(Account {
+        id: user.id,
+        username: user.username,
+        first_name: user.first_name,
+        last_name: user.last_name,
+    }))
+}
+
+pub(crate) fn router() -> Router<AppState> {
     Router::new()
         .route("/me", get(me))
         .route("/register", post(register))
         .route("/login", post(login))
+        .route("/change_password", put(change_password))
+        .route("/delete", delete(delete_account))
 }
diff --git a/src/routers/mod.rs b/src/routers/mod.rs
index ee925f0..b57f71d 100644
--- a/src/routers/mod.rs
+++ b/src/routers/mod.rs
@@ -1,15 +1,9 @@
 mod account;
 
 use axum::Router;
-use tower_http::trace::{DefaultOnRequest, DefaultOnResponse, TraceLayer};
-use tracing::Level;
 
-pub(crate) fn router() -> Router {
-    let trace_layer = TraceLayer::new_for_http()
-        .on_request(DefaultOnRequest::new().level(Level::INFO))
-        .on_response(DefaultOnResponse::new().level(Level::INFO));
+use crate::state::AppState;
 
-    Router::new()
-        .layer(trace_layer)
-        .nest("/account", account::router())
+pub(crate) fn router() -> Router<AppState> {
+    Router::new().nest("/account", account::router())
 }
diff --git a/src/state.rs b/src/state.rs
new file mode 100644
index 0000000..9779b46
--- /dev/null
+++ b/src/state.rs
@@ -0,0 +1,7 @@
+use sea_orm::DatabaseConnection;
+
+#[derive(Clone)]
+pub struct AppState {
+    pub db: DatabaseConnection,
+    pub secret: String,
+}