mirror of
https://github.com/chmouel/liseur-sync.git
synced 2026-08-29 09:21:55 +00:00
0b35367200
KOReader and Readest kosync clients never transmit the raw pairing code: they compute `md5(password)` locally and send that digest as both the registration password and the `x-auth-key` credential on every subsequent request. The adapter was hashing the raw code for storage and then hashing `md5(code)` for the device slot key, so redemption could never match what a real client actually sent, causing every pairing attempt to return 403. - Introduced `KosyncUserKey` (MD5 derivation) and `KosyncPairingHash` (SHA-256 of the derived key) in the auth package so pairing codes are stored under the hash of what the client will actually present - Removed the server-side `md5hex` helper that re-derived the key after registration; the received value is already the derived key - Normalized the received key to lowercase before hashing to match canonical hex encoding - Updated all pairing code creation sites (admin CLI, web UI, self-service) to use `KosyncPairingHash` - Added `TestClientSendsMD5DerivedKeyNotTheCode` regression test verifying that the raw code is rejected and the derived key works - Updated tests to send the derived key on the wire, matching real client behavior Signed-off-by: Chmouel Boudjnah <chmouel@chmouel.com> |
||
|---|---|---|
| .. | ||
| admin.go | ||
| admin_test.go | ||
| adminrole_test.go | ||
| folders.go | ||
| folders_test.go | ||
| tty.go | ||
| users.go | ||