decomp DBCServer_Release and inspect/document database

decomp/schema/RustyHearts_Account/procs/AuthenticateUser.sql

@@ -0,0 +1,74 @@
+
+CREATE PROCEDURE [dbo].[AuthenticateUser]
+@Identifier varchar(255),
+@password_verify_result BIT,
+@LastLoginIP varchar(15)
+AS
+BEGIN
+SET NOCOUNT ON;
+
+DECLARE @Result varchar(20)
+DECLARE @WindyCode varchar(50)
+DECLARE @AuthID varchar(50)
+DECLARE @LoginAttempts int
+DECLARE @IsLocked BIT
+DECLARE @Now datetime = GETDATE()
+DECLARE @LastLogin datetime
+DECLARE @Token NVARCHAR(64)
+DECLARE @RandomBytes VARBINARY(32)
+
+BEGIN TRY
+    BEGIN TRANSACTION
+
+    -- Retrieve account information
+    SELECT @WindyCode = WindyCode, @LoginAttempts = LoginAttempts, @IsLocked = IsLocked, @LastLogin = LastLogin
+    FROM AccountTable 
+    WHERE WindyCode = @Identifier OR Email = @Identifier;
+		SELECT @AuthID = AuthID
+    FROM RustyHearts_Auth.dbo.AuthTable
+    WHERE WindyCode = @WindyCode;
+		
+    -- Check if last login attempt is within 5 minutes
+    IF DATEDIFF(minute, @LastLogin, @Now) > 5 
+    BEGIN
+        UPDATE AccountTable SET LoginAttempts = 0 WHERE WindyCode = @Identifier OR Email = @Identifier;
+    END
+	    
+    -- Verify password
+    IF @password_verify_result = 1 
+    BEGIN
+        SET @Result = 'LoginSuccess';
+        
+				SET @RandomBytes = CAST(CRYPT_GEN_RANDOM(32) AS VARBINARY(32)) -- Generate 32 random bytes
+				SET @Token = LOWER(CONVERT(NVARCHAR(64), HashBytes('SHA2_256', @RandomBytes), 2)) -- Hash the random bytes using SHA256 and convert to lowercase hexadecimal string
+    END
+    ELSE 
+        SET @Result = 'InvalidCredentials';
+
+    -- Check account status
+    IF @Result = 'LoginSuccess' AND @IsLocked = 1
+    SET @Result = 'Locked';
+    ELSE IF @LoginAttempts >= 10 
+    SET @Result = 'TooManyAttempts';
+    ELSE 
+
+    -- Update login attempts, token, and last login IP
+    IF @Result = 'LoginSuccess' 
+    BEGIN
+        UPDATE AccountTable SET LoginAttempts = 0, Token = @Token, LastLoginIP = @LastLoginIP, LastLogin = @Now WHERE (WindyCode = @Identifier OR Email = @Identifier);
+    END
+    ELSE IF @Result = 'InvalidCredentials' 
+    BEGIN
+        UPDATE AccountTable SET LoginAttempts = @LoginAttempts + 1, LastLogin = @Now WHERE (WindyCode = @Identifier OR Email = @Identifier);
+    END
+
+    COMMIT TRANSACTION;
+END TRY
+BEGIN CATCH
+    ROLLBACK TRANSACTION;
+    SET @Result = 'TransactionFailed';
+END CATCH
+
+SELECT @Result as Result, @WindyCode as WindyCode, @AuthID as AuthID, @Token as Token;
+END
+