74 lines
2.3 KiB
Transact-SQL
74 lines
2.3 KiB
Transact-SQL
|
|
CREATE PROCEDURE [dbo].[AuthenticateUser]
|
|
@Identifier varchar(255),
|
|
@password_verify_result BIT,
|
|
@LastLoginIP varchar(15)
|
|
AS
|
|
BEGIN
|
|
SET NOCOUNT ON;
|
|
|
|
DECLARE @Result varchar(20)
|
|
DECLARE @WindyCode varchar(50)
|
|
DECLARE @AuthID varchar(50)
|
|
DECLARE @LoginAttempts int
|
|
DECLARE @IsLocked BIT
|
|
DECLARE @Now datetime = GETDATE()
|
|
DECLARE @LastLogin datetime
|
|
DECLARE @Token NVARCHAR(64)
|
|
DECLARE @RandomBytes VARBINARY(32)
|
|
|
|
BEGIN TRY
|
|
BEGIN TRANSACTION
|
|
|
|
-- Retrieve account information
|
|
SELECT @WindyCode = WindyCode, @LoginAttempts = LoginAttempts, @IsLocked = IsLocked, @LastLogin = LastLogin
|
|
FROM AccountTable
|
|
WHERE WindyCode = @Identifier OR Email = @Identifier;
|
|
SELECT @AuthID = AuthID
|
|
FROM RustyHearts_Auth.dbo.AuthTable
|
|
WHERE WindyCode = @WindyCode;
|
|
|
|
-- Check if last login attempt is within 5 minutes
|
|
IF DATEDIFF(minute, @LastLogin, @Now) > 5
|
|
BEGIN
|
|
UPDATE AccountTable SET LoginAttempts = 0 WHERE WindyCode = @Identifier OR Email = @Identifier;
|
|
END
|
|
|
|
-- Verify password
|
|
IF @password_verify_result = 1
|
|
BEGIN
|
|
SET @Result = 'LoginSuccess';
|
|
|
|
SET @RandomBytes = CAST(CRYPT_GEN_RANDOM(32) AS VARBINARY(32)) -- Generate 32 random bytes
|
|
SET @Token = LOWER(CONVERT(NVARCHAR(64), HashBytes('SHA2_256', @RandomBytes), 2)) -- Hash the random bytes using SHA256 and convert to lowercase hexadecimal string
|
|
END
|
|
ELSE
|
|
SET @Result = 'InvalidCredentials';
|
|
|
|
-- Check account status
|
|
IF @Result = 'LoginSuccess' AND @IsLocked = 1
|
|
SET @Result = 'Locked';
|
|
ELSE IF @LoginAttempts >= 10
|
|
SET @Result = 'TooManyAttempts';
|
|
ELSE
|
|
|
|
-- Update login attempts, token, and last login IP
|
|
IF @Result = 'LoginSuccess'
|
|
BEGIN
|
|
UPDATE AccountTable SET LoginAttempts = 0, Token = @Token, LastLoginIP = @LastLoginIP, LastLogin = @Now WHERE (WindyCode = @Identifier OR Email = @Identifier);
|
|
END
|
|
ELSE IF @Result = 'InvalidCredentials'
|
|
BEGIN
|
|
UPDATE AccountTable SET LoginAttempts = @LoginAttempts + 1, LastLogin = @Now WHERE (WindyCode = @Identifier OR Email = @Identifier);
|
|
END
|
|
|
|
COMMIT TRANSACTION;
|
|
END TRY
|
|
BEGIN CATCH
|
|
ROLLBACK TRANSACTION;
|
|
SET @Result = 'TransactionFailed';
|
|
END CATCH
|
|
|
|
SELECT @Result as Result, @WindyCode as WindyCode, @AuthID as AuthID, @Token as Token;
|
|
END
|
|
|