mv rest__login/logout to rz_user

2 files changed, 40 insertions, 35 deletions

diff --git a/src/server/rz_api.py b/src/server/rz_api.py
index 363dba40..6a40e9a4 100644
--- a/src/server/rz_api.py
+++ b/src/server/rz_api.py
@@ -168,38 +168,3 @@ def index():
     profileinitials = username_initials(username)
     return render_template('index.html', username=username, profileinitials=profileinitials)
 
-def login():
-
-    def sanitize_input(req):
-        req_json = request.get_json()
-        u = req_json['username']
-        p = req_json['password']
-        return u, p
-
-    if request.method == 'POST':
-        try:
-            u, p = sanitize_input(request)
-        except:
-            log.warn('failed to sanitize inputs. request: %s' % request)
-            return make_response__json(status=401)  # return empty response
-        try:
-            crypt_util.validate_login(flask.current_app.rz_config, u, p)
-        except Exception as e:
-            # login failed
-            log.warn('login: unauthorized: user: %s' % (u))
-            return make_response__json(status=401)  # return empty response
-
-        # login successful
-        session['username'] = u
-        log.debug('login: success: user: %s' % (u))
-        return make_response__json(status=200)  # return empty response
-
-    if request.method == 'GET':
-        return render_template('login.html')
-
-def logout():
-    # remove the username from the session if it's there
-    u = session.pop('username', None)
-    log.debug('logout: success: user: %s' % (u))
-    return redirect(url_for('login'))
-
diff --git a/src/server/rz_user.py b/src/server/rz_user.py
index 87f8f225..102efe40 100644
--- a/src/server/rz_user.py
+++ b/src/server/rz_user.py
@@ -79,6 +79,46 @@ def activate_user_account(us_req):
 
     log.info('user account activated: email: %s, rz_username: %s' % (us_req['email_address'], us_req['rz_username']))
 
+def rest__login():
+
+    def sanitize_input(req):
+        req_json = request.get_json()
+        u = req_json['username']
+        p = req_json['password']
+        return u, p
+
+    if request.method == 'POST':
+        try:
+            u, p = sanitize_input(request)
+        except:
+            log.warn('failed to sanitize inputs. request: %s' % request)
+            return make_response__json(status=401)  # return empty response
+        try:
+            salt = current_app.rz_config.secret_key
+            pw_hash = hash_pw(p, salt)
+            current_app.user_db.validate_login(u, pw_hash)
+        except Exception as e:
+            # login failed
+            log.warn('login: unauthorized: user: %s' % (u))
+            return make_response__json(status=401)  # return empty response
+
+        # login successful
+        session['username'] = u
+        log.debug('login: success: user: %s' % (u))
+        return make_response__json(status=200)  # return empty response
+
+    if request.method == 'GET':
+        return render_template('login.html')
+
+def rest__logout():
+    """
+    REST API endpoint: logout
+    """
+    # remove the username from the session if it's there
+    u = session.pop('username', None)
+    log.debug('logout: success: user: %s' % (u))
+    return redirect(url_for('login'))
+
 def rest__user_signup():
     """
     REST API endpoint: user sign up