added better database get api

CMakeLists.txt

@@ -78,7 +78,7 @@ add_executable(${TARGET_NAME}
 
 target_compile_definitions(${TARGET_NAME} PRIVATE APPLICATION_NAME="${TARGET_NAME}")
 
-target_link_libraries(${TARGET_NAME} pthread sqlite3)
+target_link_libraries(${TARGET_NAME} pthread sqlite3 sodium)
 
 # Optional: Print build type at configuration time
 message(STATUS "Configuring build type: ${CMAKE_BUILD_TYPE}")

src/database/database.cpp

@@ -1,6 +1,7 @@
 #include "crow.h"
 #include "utils.hpp"
 #include "database.hpp"
+#include <optional>
 
 using namespace std;
 
@@ -36,9 +37,29 @@ bool Database::exec(const std::string& sqlQuery){
     return exec(sqlQuery.c_str());
 }
 
-map<string, string> Database::getStrMap(const string& sql){
-    sqlite3_stmt* stmt = prepareStmt(sql);
+sqlite3_stmt* Database::bind(const std::string sql, const Database::QueryData& data) {
+    sqlite3_stmt* stmt = nullptr;
+    if (sqlite3_prepare_v2(m_db, sql.c_str(), -1, &stmt, nullptr) != SQLITE_OK) {
+        CROW_LOG_ERROR << "Failed to prepare statement: " << sqlite3_errmsg(m_db);
+        return nullptr;
+    }
+    for (int i = 0; i < data.size(); i++) {
+        std::visit([stmt, i](auto&& val) {
+            using T = std::decay_t<decltype(val)>;
+            if constexpr (std::is_same_v<T, int64_t>)
+                sqlite3_bind_int64(stmt, i + 1, val);
+            else if constexpr (std::is_same_v<T, double>)
+                sqlite3_bind_double(stmt, i + 1, val);
+            else if constexpr (std::is_same_v<T, std::string>)
+                sqlite3_bind_text(stmt, i + 1, val.c_str(), -1, SQLITE_TRANSIENT);                
+        }, data[i]);
+    }
+    return stmt;
+}
+
+map<string, string> Database::getStrMap(const std::string sql, const Database::QueryData& data){
     map<string, string> map;
+    sqlite3_stmt* stmt = bind(sql, data);
     if (stmt == nullptr)
         return map; 
 
@@ -52,18 +73,6 @@ map<string, string> Database::getStrMap(const string& sql){
     return map;
 }
 
-string Database::getStr(const string& sql){
-    sqlite3_stmt* stmt = prepareStmt(sql);
-    string str;
-    if (stmt == nullptr)
-        return str; 
-
-    str = reinterpret_cast<const char*>(sqlite3_column_text(stmt, 0));
-    
-    sqlite3_finalize(stmt);
-    return str;
-}
-
 set<string> Database::getStrSet(const string& sql){
     sqlite3_stmt* stmt = prepareStmt(sql);
     set<string> vec;
@@ -79,20 +88,6 @@ set<string> Database::getStrSet(const string& sql){
     return vec;
 }
 
-std::optional<int64_t> Database::getInt(const char* sql) {
-    sqlite3_stmt* stmt = prepareStmt(sql);
-    if (stmt == nullptr)
-        return {}; 
-
-    std::optional<int64_t> id;
-    if (sqlite3_step(stmt) == SQLITE_ROW) {
-        id = sqlite3_column_int64(stmt, 0); 
-    }
-
-    sqlite3_finalize(stmt);
-    return id;
-}
-
 std::optional<int64_t> Database::insert(const char* sql) {
     sqlite3_stmt* stmt = prepareStmt(sql);
     if (stmt == nullptr)

src/database/database.hpp

@@ -3,12 +3,16 @@
 
 #include "sqlite3.h"
 #include <string>
+#include <vector>
+#include <variant>
 #include <optional>
 #include <set>
 #include <map>
 
 class Database {
 
+    typedef std::vector<std::variant<int64_t, std::string>> QueryData;
+
 public:
     Database();
     ~Database();
@@ -17,16 +21,31 @@ public:
     bool exec(const char* sqlQuery);
     bool exec(const std::string& sqlQuery);
 
-    /// returns true if the sql statment returns at least one row 
-    std::optional<int64_t> getInt(const char* sql);
-
     std::optional<int64_t> insert(const char* sql);
 
     std::set<std::string> getStrSet(const std::string& sql);
 
-    string getStr(const string& sql)
+    template <typename T>
+    std::optional<T> get(const std::string sql, const QueryData& data){
+        sqlite3_stmt* stmt = bind(sql, data);
+        T ret;
+        if ((stmt == nullptr) || (sqlite3_step(stmt) != SQLITE_ROW))
+            return {}; 
 
-    std::map<std::string, std::string> getStrMap(const std::string& sql);
+        if constexpr (std::is_same_v<T, int>) {
+            ret = sqlite3_column_int64(stmt, 0); 
+        }
+        else if constexpr (std::is_same_v<T, std::string>){
+            ret = reinterpret_cast<const char*>(sqlite3_column_text(stmt, 0));
+        }
+        
+        sqlite3_finalize(stmt);
+        return ret;
+    }
+
+    sqlite3_stmt* bind(const std::string sql, const QueryData& data);
+
+    std::map<std::string, std::string> getStrMap(const std::string sql, const QueryData& data);
 
 private:
     sqlite3_stmt* prepareStmt(const std::string& sql);

src/login/login.cpp

@@ -13,7 +13,7 @@ struct Session {
 
 std::unordered_map<std::string, Session> sessions;
 
-bool verifyHashWithPassword(std::string& const hash, std::string const& password)
+bool verifyHashWithPassword(const std::string& hash, std::string const& password)
 {
     if (crypto_pwhash_str_verify(hash.c_str(), password.c_str(), password.size()) == 0) {
         return true;
@@ -22,7 +22,7 @@ bool verifyHashWithPassword(std::string& const hash, std::string const& password
     }
 }
 
-std::string hashPassword(std::string& const password)
+std::string hashPassword(const std::string& password)
 {
     // Allocate storage for the hash
     char hash[crypto_pwhash_STRBYTES];
@@ -41,21 +41,6 @@ std::string hashPassword(std::string& const password)
     return hash;
 }
 
-std::string generate_session_id(size_t bytes = 32) {
-    std::vector<unsigned char> buf(bytes);
-    randombytes_buf(buf.data(), buf.size());
-
-    // Convert to hex
-    std::string hex;
-    hex.reserve(bytes * 2);
-    static const char *hexmap = "0123456789abcdef";
-    for (unsigned char b : buf) {
-        hex.push_back(hexmap[b >> 4]);
-        hex.push_back(hexmap[b & 0xF]);
-    }
-    return hex;
-}
-
 std::string get_session_id(const crow::request& req) {
     auto cookie_header = req.get_header_value("Cookie");
     std::string prefix = "session_id=";
@@ -103,21 +88,19 @@ auto login_required = [](auto handler){
 
 bool loginUser(const std::string& username, const std::string& password)
 {
-    auto sql = format("SELECT password_hash FROM users HERE username = '{}' LIMIT 1;", username);
+    auto sql = "SELECT id password_hash FROM users WHERE username = '?' LIMIT 1;";
     auto db = Database();
     
     if (!db.open())
         return false;
 
-    auto opt_str = db.getStr(sql.c_str());
+    auto opt_str = db.get<std::string>(sql, {username});
     if (opt_str.has_value()) {
         return verifyHashWithPassword(opt_str.value(), password); 
     } else {
         return false;
    }
 }
-}
-
 
 bool initDB()
 {
@@ -191,16 +174,18 @@ bool initLogin(crow::SimpleApp& app)
 
         if (csrf_token != session.csrf_token) return crow::response(403, "CSRF failed");
 
-        bool ok = loginUser(); 
+        bool ok = loginUser(username, password); 
 
         if (!ok) return crow::response(401, "Invalid credentials");
 
         // regenerate session, mark as logged in
-        sessions[session_id].user_id = generate_session_id(); // user ID
+        sessions[session_id].user_id = "123"; // user ID
 
         crow::response res;
         res.add_header("HX-Redirect", "/dashboard"); // htmx redirect
         return res;
     });
+
+    return true;
 }
 }

src/main.cpp

@@ -108,7 +108,10 @@ int main() {
     }
 
     shadowrun::initApi(app);
-    login::initLogin(app);
+    if(!login::initLogin(app))
+    {
+        CROW_LOG_ERROR << "Failed to init Login API";
+    }
 
     app.loglevel(crow::LogLevel::INFO);
     app.port(httpPort).multithreaded().run();

src/shadowrun/ShadowrunDb.cpp

@@ -41,13 +41,13 @@ bool initDb() {
 }
 
 int64_t getKeyOfCharacter(const string& name){
-    auto sql = format("SELECT id FROM shadowrun_characters WHERE name = '{}' LIMIT 1;", name);
+    std::string sql = "SELECT id FROM shadowrun_characters WHERE name = ? LIMIT 1;";
     auto db = Database();
     
     if (!db.open())
         return -1;
 
-    auto opt_int = db.getInt(sql.c_str());
+    auto opt_int = db.get<int>(sql, {name});
     if (opt_int.has_value()) {
         return opt_int.value();
     } else {
@@ -99,12 +99,12 @@ std::set<std::string> getCharacters(){
 }
 
 std::map<std::string, std::string> getCharacterData(int64_t characterKey) {
-    auto sql = format("SELECT name, value FROM shadowrun_data WHERE character_id = {};", characterKey);
+    std::string sql = "SELECT name, value FROM shadowrun_data WHERE character_id = ?;";
     auto db = Database();
     if (!db.open())
         return std::map<std::string, std::string>();
 
-    return db.getStrMap(sql);
+    return db.getStrMap(sql, {characterKey});
 }
 
 }