pid generation and double hashing

models/pnid.js

@@ -34,6 +34,10 @@ const PNIDSchema = new mongoose.Schema({
 	pnid: {
 		key: {
 			type: String // not sure what this should be
+		},
+		pid: {
+			type: String,
+			unique: true
 		}
 	},
 	consoles: []
@@ -48,15 +52,14 @@ function validateEmail(email) {
 PNIDSchema.plugin(uniqueValidator, {message: '{PATH} already in use.'});
 
 // hashing password
-PNIDSchema.pre('save', function(next) {
+PNIDSchema.pre('save', async function(next) {
 	// only if modified
 	if (!this.isModified('password')) {
 		return next();
 	}
-
-	// TODO make security all weird with double hash.
 	// hashing
-	bcrypt.hash(this.get('password'), 10, (err, hash) => {
+	const primaryhash = PNIDModel.hashPasswordPrimary(this.get('password'), this.get('pid'));
+	bcrypt.hash(primaryhash, 10, (err, hash) => {
 		if (err) {
 			return next(err);
 		}
@@ -72,6 +75,41 @@ PNIDSchema.statics.findByEmail = function(username) {
 	});
 };
 
+PNIDSchema.statics.hashPasswordPrimary = function(password, pid) {
+	const buff1 = require('python-struct').pack('<I', pid);
+	const buff2 = Buffer.from(password).toString('ascii');
+
+	const unpacked = new Buffer(bufferToHex(buff1) + '\x02eCF' + buff2, 'ascii');
+	const hashed = require('crypto').createHash('sha256').update(unpacked).digest().toString('hex');
+
+	return hashed;
+};
+
+function bufferToHex(buff) {
+	let result = '';
+	const arr = buff.toString('hex').match(/.{1,2}/g);
+	for (let i=0;i<arr.length;i++) {
+		const char = arr[i];
+		result += String.fromCharCode(parseInt(char, 16));
+	}
+	result.replace(/\\/g, '&#92;');
+	return result;
+}
+
+PNIDSchema.statics.generatePID  = async function() {
+	// Quick, dirty fix for PIDs
+	const pid = Math.floor(Math.random() * (4294967295 - 1000000000) + 1000000000);
+	const does_pid_inuse = await PNIDModel.findOne({
+		'pnid.pid': pid
+	});
+
+	if (does_pid_inuse) {
+		return await PNIDModel.generatePID();
+	}
+
+	return pid;
+};
+
 const PNIDModel = mongoose.model('pnid', PNIDSchema);
 
 module.exports = {

package-lock.json

@@ -1655,6 +1655,11 @@
       "resolved": "https://registry.npmjs.org/lodash.get/-/lodash.get-4.4.2.tgz",
       "integrity": "sha1-LRd/ZS+jHpObRDjVNBSZ36OCXpk="
     },
+    "long": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/long/-/long-3.2.0.tgz",
+      "integrity": "sha1-2CG3E4yhy1gcFymQ7xTbIAtcR0s="
+    },
     "longest": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/longest/-/longest-1.0.1.tgz",
@@ -2177,6 +2182,14 @@
       "integrity": "sha512-XRsRjdf+j5ml+y/6GKHPZbrF/8p2Yga0JPtdqTIY2Xe5ohJPD9saDJJLPvp9+NSBprVvevdXZybnj2cv8OEd0A==",
       "dev": true
     },
+    "python-struct": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/python-struct/-/python-struct-1.0.6.tgz",
+      "integrity": "sha512-r40v2MDFZKNBECMuo/oih6wInNEFXX0gmQgCJH4R7VULJsQDwcE95004r7A8iy1tDipgcZDyF8H6Tc2bhJdRZQ==",
+      "requires": {
+        "long": "3.2.0"
+      }
+    },
     "qs": {
       "version": "6.5.1",
       "resolved": "https://registry.npmjs.org/qs/-/qs-6.5.1.tgz",

package.json

@@ -28,6 +28,7 @@
     "mongoose-unique-validator": "^2.0.2",
     "passport": "^0.4.0",
     "passport-local": "^1.0.0",
+    "python-struct": "^1.0.6",
     "showdown": "^1.8.6"
   },
   "devDependencies": {

routes/pnid.js

@@ -26,9 +26,9 @@ router.get('/pnid/login', (req, res) => {
 });
 
 /* 
-*	/admin/api/v1/login
+*	/api/v1/login
 *
-*	signs admin user in
+*	signs user in
 *
 *	post {
 *		email
@@ -53,24 +53,22 @@ router.post('/api/v1/login', passport.authenticate('PNIDStrategy'), function (re
 });
 
 /* 
-*	/admin/api/v1/register
-*	- requires admin auth
+*	/api/v1/register
 *
 *	registers a new admin user
 *
 *	post {
-*		username - username of new admin account
-*		password - password of new admin account
+*		username
+*		password
 *	}
 *	return {
 *		code: httpcode
 *		success: boolean - true if register was successull
-*		username: undefined | string - username if register was successfull
-*		role: undefined | string - role of user if register was successfull
+*		username: undefined | string - username if register was successfullW
 *		errors: Strings[messages]
 *	}
 */
-router.post('/api/v1/register', recaptcha.middleware.verify, (req, res) => {
+router.post('/api/v1/register', recaptcha.middleware.verify, async (req, res) => {
 	if (!req.body) {
 		// no post body
 		apiHelper.sendApiGenericError(res);
@@ -84,7 +82,11 @@ router.post('/api/v1/register', recaptcha.middleware.verify, (req, res) => {
 	const { email, password } = req.body;
 	const newUser = new PNID.PNIDModel({
 		email,
-		password
+		password,
+		pnid: {
+			key: 'abcd',
+			pid: PNID.PNIDModel.generatePID()
+		}
 	});
 
 	// TODO verify password