Method Authenticate

internal/models/user.go:387–427

Authenticate a user from a password

(ctx context.Context, tx *storage.Connection, password string, decryptionKeys map[string]string, encrypt bool, encryptionKeyID string)

// Authenticate a user from a password
func (u *User) Authenticate(ctx context.Context, tx *storage.Connection, password string, decryptionKeys map[string]string, encrypt bool, encryptionKeyID string) (bool, bool, error) {
	if u.EncryptedPassword == nil {
		return false, false, nil
	}

	hash := *u.EncryptedPassword

	if hash == "" {
		return false, false, nil
	}

	es := crypto.ParseEncryptedString(hash)
	if es != nil {
		h, err := es.Decrypt(u.ID.String(), decryptionKeys)
		if err != nil {
			return false, false, err
		}

		hash = string(h)
	}

	compareErr := crypto.CompareHashAndPassword(ctx, hash, password)

	if !strings.HasPrefix(hash, crypto.Argon2Prefix) && !strings.HasPrefix(hash, crypto.FirebaseScryptPrefix) {
		// check if cost exceeds default cost or is too low
		cost, err := bcrypt.Cost([]byte(hash))
		if err != nil {
			return compareErr == nil, false, err
		}

		if cost > bcrypt.DefaultCost || cost == bcrypt.MinCost {
			// don't bother with encrypting the password in Authenticate
			// since it's handled separately
			if err := u.SetPassword(ctx, password, false, "", ""); err != nil {
				return compareErr == nil, false, err
			}
		}
	}

	return compareErr == nil, encrypt && (es == nil || es.ShouldReEncrypt(encryptionKeyID)), nil
}

// ConfirmReauthentication resets the reauthentication token
func (u *User) ConfirmReauthentication(tx *storage.Connection) error {