changing username, password, and more security

server/main.py

@@ -8,7 +8,7 @@ from db import Database
 
 
 userdb = Database("users")
-userdb.createTable("NAMES",{"id":"int","name":"string","creation_date":"int","last_login":"int"})
+userdb.createTable("NAMES",{"id":"int","name":"string","creation_date":"int","last_login":"int","last_namechange":"int"})
 userdb.createTable("PASSWORDS",{"id":"int","sum":"string"})
 
 def makeUserID() -> int:
@@ -21,6 +21,7 @@ def makeUserID() -> int:
     return uid
 
 def isValidUsername(name) -> bool:
+    if len(name)>16: return False
     pattern = re.compile("^[a-z][a-z0-9-_]*")
     match = pattern.match(name)
     if match==None: return False
@@ -45,36 +46,44 @@ def serverError(msg,**kwargs) -> str:
     return json.dumps({"type":"error","error":msg,"server":True,**kwargs})
 
 sessionUsers = {}
+sessionCreatedAccount = []
 
 async def handleCommand(ws,cmd):
     global sessionUsers
     print(f"recieved command: {cmd} (from {id(ws)})")
     if not "type" in cmd:
         return await ws.send(clientError("Malformed command"))
+    uid = None
     if id(ws) in sessionUsers:
         uid = sessionUsers[id(ws)]
     match cmd["type"]:
         case "ping":
             return await ws.send(response("Pong!"))
         case "createuser":
+            if uid != None:
+                return await ws.send(clientError("You are already logged in."))
             uid = makeUserID()
             name = cmd["name"]
             name = name.lower()
             if not isValidUsername(name):
                 return await ws.send(clientError("Username is not valid."))
-            if len(userdb.select("SELECT * FROM NAMES WHERE name = ?",(name,)))>0:
+            if userdb.findRow("NAMES","name = ?",(name,))!=None:
                 return await ws.send(clientError(f"The username '{name}' is already taken."))
             psum = cmd["pass"]
             psum = psum.lower()
             if not isValidChecksum(psum):
                 return await ws.send(clientError("Recieved password has not been correctly checksummed."))
+
+            if id(ws) in sessionCreatedAccount: raise
+            sessionCreatedAccount.append(id(ws))
+
             create = time.time()
             userdb.insertRow("NAMES",{"id":uid,"name":cmd["name"],"creation_date":create,"last_login":create})
             userdb.insertRow("PASSWORDS",{"id":uid,"sum":psum})
             return await ws.send(response({"uid":uid}))
 
         case "login":
-            if id(ws) in sessionUsers:
+            if uid != None:
                 return await ws.send(clientError("You are already logged in."))
             name = cmd["name"]
             psum = cmd["pass"]
@@ -95,17 +104,47 @@ async def handleCommand(ws,cmd):
             return await ws.send(response("success"))
 
         case "logout":
-            if not id(ws) in sessionUsers:
+            if uid == None:
                 return await ws.send(clientError("You are already logged out."))
             del sessionUsers[id(ws)]
             return await ws.send(response("success"))
 
         case "status":
-            if not id(ws) in sessionUsers:
+            if uid == None:
                 return await ws.send(response({"login":False}))
             name = userdb.rowFromPK("NAMES","id",uid)["name"]
             return await ws.send(response({"login":True,"uid":uid,"name":name}))
 
+        case "changename":
+            if uid == None:
+                return await ws.send(clientError("You are not logged in."))
+            name = cmd["name"]
+            if not isValidUsername(name):
+                return await ws.send(clientError("Username is not valid."))
+            if userdb.findRow("NAMES","name = ?",(name,))!=None:
+                return await ws.send(clientError(f"The username '{name}' is already taken."))
+
+            lastchange = userdb.rowFromPK("NAMES","id",uid)["last_namechange"]
+            if lastchange == None: lastchange = 0
+            if (lastchange+7*24*60*60)>time.time():
+                return await ws.send(clientError("You can only change your username after 7 days."))
+
+            userdb.updateFromPK("NAMES","id",uid,{"name":name,"last_namechange":time.time()})
+            return await ws.send(response("success"))
+
+        case "changepass":
+            if uid == None:
+                return await ws.send(clientError("You are not logged in."))
+            oldpass = cmd["oldpass"].lower()
+            newpass = cmd["newpass"].lower()
+            if not (isValidChecksum(oldpass) and isValidChecksum(newpass)):
+                return await ws.send(clientError("Recieved password has not been correctly checksummed."))
+            dbpass = userdb.rowFromPK("PASSWORDS","id",uid)["sum"].lower()
+            if oldpass != dbpass:
+                return await ws.send(clientError("Invalid username or password."))
+            userdb.updateFromPK("PASSWORDS","id",uid,{"sum":newpass})
+            return await ws.send(response("success"))
+
         case _:
             return await ws.send(clientError(f"Command '{cmd["type"]}' does not exist."))