diff options
Diffstat (limited to 'internal/game/core_login_account.go')
| -rw-r--r-- | internal/game/core_login_account.go | 33 |
1 files changed, 3 insertions, 30 deletions
diff --git a/internal/game/core_login_account.go b/internal/game/core_login_account.go index 3b35b15..0224a06 100644 --- a/internal/game/core_login_account.go +++ b/internal/game/core_login_account.go @@ -2,7 +2,6 @@ package game import ( "fmt" - "log" "strings" "time" @@ -86,23 +85,13 @@ func (g *Game) handlePassword(sess *net.Session, input string) { return } auth := passwordAuth{ok: true, stored: acc.PasswordHash} - // Transparent upgrade: legacy single-pass SHA-256 hashes rehash to - // Argon2id after a successful verification. A failed save keeps the - // legacy hash and retries on the next login. - if player.NeedsRehash(acc.PasswordHash) { - if hash, hashErr := player.HashPassword(input); hashErr == nil { - auth.rehash = hash - } else { - log.Printf("login: password rehash for %s: %v", acc.Name, hashErr) - } - } g.applyPasswordAuth(sess, auth) } // passwordAuth carries the result of the EXPENSIVE password work (Argon2id -// verification and any rehash), which runs on the caller's connection -// goroutine — never on the owner, where a burst of logins would stall -// every command and tick behind password hashing. +// verification), which runs on the caller's connection goroutine — never on +// the owner, where a burst of logins would stall every command and tick +// behind password hashing. type passwordAuth struct { ok bool // loadErr marks an account read failure off the owner: the owner task @@ -112,8 +101,6 @@ type passwordAuth struct { // file against it so a password change, rename, or delete made during // verification cannot authorize a stale login. stored string - // rehash is an upgraded hash to persist after a successful check. - rehash string } // handlePasswordOffOwner verifies the password on the caller's connection @@ -170,16 +157,6 @@ func (g *Game) handlePasswordOffOwner(sess *net.Session, input string) { case player.CheckPassword(input, acc.PasswordHash): auth.ok, auth.stored = true, acc.PasswordHash throttle.clear(key) - // Transparent upgrade: legacy single-pass SHA-256 hashes rehash to - // Argon2id after a successful verification. A failed rehash keeps - // the legacy hash and retries on the next login. - if player.NeedsRehash(acc.PasswordHash) { - if hash, hashErr := player.HashPassword(input); hashErr == nil { - auth.rehash = hash - } else { - log.Printf("login: password rehash for %s: %v", acc.Name, hashErr) - } - } default: // Wrong password: apply an escalating per-(account, IP) delay so a // brute-force attempt costs real wall-clock time. This is the @@ -229,10 +206,6 @@ func (g *Game) applyPasswordAuth(sess *net.Session, auth passwordAuth) { reject("Account changed; sign in again.") return } - if auth.rehash != "" { - acc.PasswordHash = auth.rehash - g.saveAccount(acc) - } sess.Account = &player.Account{ Name: acc.Name, PasswordHash: acc.PasswordHash, |