From cc91ac6cc02d6b95f21067edee2242733d97445c Mon Sep 17 00:00:00 2001
From: sirux88 <sirux88@gmail.com>
Date: Sat, 14 Jan 2023 10:16:03 +0100
Subject: [PATCH] include key into user.set_password

---
 src/api/core/accounts.rs         | 13 ++++++-------
 src/api/core/emergency_access.rs |  5 ++---
 src/api/identity.rs              |  2 +-
 src/db/models/user.rs            | 13 ++++++++++++-
 4 files changed, 21 insertions(+), 12 deletions(-)

diff --git a/src/api/core/accounts.rs b/src/api/core/accounts.rs
index 5faff713..b8d3bd8a 100644
--- a/src/api/core/accounts.rs
+++ b/src/api/core/accounts.rs
@@ -161,8 +161,7 @@ pub async fn _register(data: JsonUpcase<RegisterData>, mut conn: DbConn) -> Json
         user.client_kdf_type = client_kdf_type;
     }
 
-    user.set_password(&data.MasterPasswordHash, true, None);
-    user.akey = data.Key;
+    user.set_password(&data.MasterPasswordHash, Some(data.Key), true, None);
     user.password_hint = password_hint;
 
     // Add extra fields if present
@@ -318,10 +317,11 @@ async fn post_password(
 
     user.set_password(
         &data.NewMasterPasswordHash,
+        Some(data.Key),
         true,
         Some(vec![String::from("post_rotatekey"), String::from("get_contacts"), String::from("get_public_keys")]),
     );
-    user.akey = data.Key;
+
     let save_result = user.save(&mut conn).await;
 
     nt.send_user_update(UpdateType::LogOut, &user).await;
@@ -355,8 +355,7 @@ async fn post_kdf(data: JsonUpcase<ChangeKdfData>, headers: Headers, mut conn: D
 
     user.client_kdf_iter = data.KdfIterations;
     user.client_kdf_type = data.Kdf;
-    user.set_password(&data.NewMasterPasswordHash, true, None);
-    user.akey = data.Key;
+    user.set_password(&data.NewMasterPasswordHash, Some(data.Key), true, None);
     let save_result = user.save(&mut conn).await;
 
     nt.send_user_update(UpdateType::LogOut, &user).await;
@@ -565,8 +564,8 @@ async fn post_email(
     user.email_new = None;
     user.email_new_token = None;
 
-    user.set_password(&data.NewMasterPasswordHash, true, None);
-    user.akey = data.Key;
+    user.set_password(&data.NewMasterPasswordHash, Some(data.Key), true, None);
+
     let save_result = user.save(&mut conn).await;
 
     nt.send_user_update(UpdateType::LogOut, &user).await;
diff --git a/src/api/core/emergency_access.rs b/src/api/core/emergency_access.rs
index 64ed6d86..fcabc617 100644
--- a/src/api/core/emergency_access.rs
+++ b/src/api/core/emergency_access.rs
@@ -644,7 +644,7 @@ async fn password_emergency_access(
 
     let data: EmergencyAccessPasswordData = data.into_inner().data;
     let new_master_password_hash = &data.NewMasterPasswordHash;
-    let key = data.Key;
+    //let key = &data.Key;
 
     let requesting_user = headers.user;
     let emergency_access = match EmergencyAccess::find_by_uuid(&emer_id, &mut conn).await {
@@ -662,8 +662,7 @@ async fn password_emergency_access(
     };
 
     // change grantor_user password
-    grantor_user.set_password(new_master_password_hash, true, None);
-    grantor_user.akey = key;
+    grantor_user.set_password(new_master_password_hash, Some(data.Key), true, None);
     grantor_user.save(&mut conn).await?;
 
     // Disable TwoFactor providers since they will otherwise block logins
diff --git a/src/api/identity.rs b/src/api/identity.rs
index 7d004a9c..e52608e9 100644
--- a/src/api/identity.rs
+++ b/src/api/identity.rs
@@ -153,7 +153,7 @@ async fn _password_login(
     // Change the KDF Iterations
     if user.password_iterations != CONFIG.password_iterations() {
         user.password_iterations = CONFIG.password_iterations();
-        user.set_password(password, false, None);
+        user.set_password(password, None, false, None);
 
         if let Err(e) = user.save(conn).await {
             error!("Error updating user: {:#?}", e);
diff --git a/src/db/models/user.rs b/src/db/models/user.rs
index 15aacf1f..5ce87e14 100644
--- a/src/db/models/user.rs
+++ b/src/db/models/user.rs
@@ -147,17 +147,28 @@ impl User {
     /// # Arguments
     ///
     /// * `password` - A str which contains a hashed version of the users master password.
+    /// * `new_key` - A String  which contains the new aKey value of the users master password.
     /// * `allow_next_route` - A Option<Vec<String>> with the function names of the next allowed (rocket) routes.
     ///                       These routes are able to use the previous stamp id for the next 2 minutes.
     ///                       After these 2 minutes this stamp will expire.
     ///
-    pub fn set_password(&mut self, password: &str, reset_security_stamp: bool, allow_next_route: Option<Vec<String>>) {
+    pub fn set_password(
+        &mut self,
+        password: &str,
+        new_key: Option<String>,
+        reset_security_stamp: bool,
+        allow_next_route: Option<Vec<String>>,
+    ) {
         self.password_hash = crypto::hash_password(password.as_bytes(), &self.salt, self.password_iterations as u32);
 
         if let Some(route) = allow_next_route {
             self.set_stamp_exception(route);
         }
 
+        if let Some(new_key) = new_key {
+            self.akey = new_key;
+        }
+
         if reset_security_stamp {
             self.reset_security_stamp()
         }