feat: add support for logging in using an email & password

Cargo.toml

@@ -7,6 +7,7 @@ edition = "2024"
 serve-static = ["dep:actix-files"]
 
 [dependencies]
+argon2 = "0.6.0"
 actix-cors = "0.7"
 actix-files = { version = "0.7", optional = true }
 actix-multipart = "0.8"
@@ -16,10 +17,27 @@ anyhow = "1.0"
 bytes = "1.11"
 chrono = { version = "0.4", features = ["serde"] }
 clap = { version = "4.5", features = ["derive"] }
+constant_time_eq = "0.6.0"
 dotenvy = "0.15"
 futures = "0.3"
-image = "0.25"
+html2text = "0.17.1"
+lettre = { version = "0.11.23", default-features = false, features = [
+    "builder",
+    "hostname",
+    "smtp-transport",
+    "pool",
+    "tokio1-rustls-tls",
+    "rustls-platform-verifier",
+    "tracing",
+] }
+image = { version = "0.25", default-features = false, features = [
+    "png",
+    "jpeg",
+    "webp",
+    "rayon",
+] }
 moka = { version = "0.12.13", features = ["future"] }
+parking_lot = "0.12.5"
 regex = "1.10"
 reqwest = { version = "0.13", features = [
     "gzip",
@@ -61,9 +79,11 @@ rust-s3 = { git = "https://github.com/w4nderlust/rust-s3", rev = "2936eb7", defa
     "tokio-rustls-tls",
     "fail-on-err",
 ] }
+maud = "0.27.0"
+phc = "0.6.1"
+idna = "1.1.0"
 
 [profile.release]
-opt-level = 's'
 lto = true
 
 [target.'cfg(target_env = "musl")'.dependencies]

migrations/20260714181725_create_developer_login_info_table.down.sql

@@ -0,0 +1,3 @@
+-- Add down migration script here
+
+DROP TABLE IF EXISTS developer_login_info;

migrations/20260714181725_create_developer_login_info_table.up.sql

@@ -0,0 +1,11 @@
+-- Add up migration script here
+
+CREATE TABLE IF NOT EXISTS developer_login_info (
+    developer_id INTEGER NOT NULL PRIMARY KEY,
+    email TEXT NOT NULL,
+    email_verified_at TIMESTAMPTZ,
+    password TEXT NOT NULL,
+
+    FOREIGN KEY (developer_id) REFERENCES developers(id) ON DELETE CASCADE
+);
+

migrations/20260810163519_add_unique_to_developer_login_infos.down.sql

@@ -0,0 +1,3 @@
+-- Add down migration script here
+
+DROP INDEX developer_login_info_email_lower_idx;

migrations/20260810163519_add_unique_to_developer_login_infos.up.sql

@@ -0,0 +1,4 @@
+-- Add up migration script here
+
+CREATE UNIQUE INDEX developer_login_info_email_lower_idx
+ON developer_login_info(LOWER(email));

migrations/20260810163645_add_email_setup_requests_table.down.sql

@@ -0,0 +1,3 @@
+-- Add down migration script here
+
+DROP TABLE email_setup_requests;

migrations/20260810163645_add_email_setup_requests_table.up.sql

@@ -0,0 +1,12 @@
+-- Add up migration script here
+
+CREATE TABLE email_setup_requests (
+    developer_id INTEGER NOT NULL PRIMARY KEY,
+    token UUID NOT NULL UNIQUE DEFAULT gen_random_uuid(),
+    email TEXT NOT NULL,
+    password TEXT NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    expires_at TIMESTAMPTZ NOT NULL,
+
+    FOREIGN KEY (developer_id) REFERENCES developers(id) ON DELETE CASCADE
+);

migrations/20260810163652_add_email_change_requests_table.down.sql

@@ -0,0 +1,4 @@
+-- Add down migration script here
+
+DROP TABLE email_change_history;
+DROP TABLE email_change_requests;

migrations/20260810163652_add_email_change_requests_table.up.sql

@@ -0,0 +1,21 @@
+-- Add up migration script here
+
+CREATE TABLE email_change_requests (
+    developer_id INTEGER NOT NULL PRIMARY KEY,
+    token UUID NOT NULL UNIQUE DEFAULT gen_random_uuid(),
+    new_email TEXT NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    expires_at TIMESTAMPTZ NOT NULL,
+
+    FOREIGN KEY (developer_id) REFERENCES developers(id) ON DELETE CASCADE
+);
+
+CREATE TABLE email_change_history (
+    id BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+    developer_id INTEGER NOT NULL,
+    old_email TEXT NOT NULL,
+    new_email TEXT NOT NULL,
+    changed_at TIMESTAMPTZ NOT NULL,
+
+    FOREIGN KEY (developer_id) REFERENCES developers(id) ON DELETE CASCADE
+);

src/auth/mod.rs

@@ -1,4 +1,5 @@
 pub mod github;
+pub mod password;
 
 #[derive(thiserror::Error, Debug)]
 pub enum AuthenticationError {

src/auth/password.rs

@@ -0,0 +1,71 @@
+use std::sync::OnceLock;
+
+use argon2::{Algorithm, Argon2, Params, PasswordHasher, PasswordVerifier, Version};
+use phc::PasswordHash;
+
+
+#[derive(Debug, thiserror::Error)]
+pub enum PasswordError {
+    #[error("stored password hash is malformed")]
+    MalformedHash(String),
+    #[error("password verification failed")]
+    Verify(String),
+    #[error("password task panicked")]
+    Join(#[from] tokio::task::JoinError)
+}
+
+pub async fn verify(hash: String, password: String, pepper: Option<String>) -> Result<bool, PasswordError> {
+    tokio::task::spawn_blocking(move || verify_blocking(&hash, &password, pepper.as_ref()))
+    .await
+    .inspect_err(|e| tracing::error!("tokio join error: {e}"))?
+}
+
+/// Used to prevent timing attacks: still hash-check something,
+/// but discard the result after
+pub async fn verify_or_dummy(hash: Option<String>, password: String, pepper: Option<String>) -> Result<bool, PasswordError> {
+    tokio::task::spawn_blocking(move || {
+        let exists = hash.is_some();
+        let hash = hash.as_deref().unwrap_or_else(|| dummy_hash(pepper.as_ref()));
+
+        Ok(verify_blocking(hash, &password, pepper.as_ref())? && exists)
+    })
+    .await
+    .inspect_err(|e| tracing::error!("tokio join error: {e}"))?
+}
+
+pub fn argon2(pepper: Option<&String>) -> Argon2<'_> {
+    match pepper {
+        Some(pepper) => Argon2::new_with_secret(
+            pepper.as_bytes(),
+            Algorithm::default(),
+            Version::default(),
+            Params::default(),
+        )
+        .unwrap(), // This only fails if the secret is too long, it'll be fine!
+        None => Argon2::default(),
+    }
+}
+
+fn verify_blocking(hash: &str, password: &str, pepper: Option<&String>) -> Result<bool, PasswordError> {
+    let parsed_hash = PasswordHash::new(hash)
+        .inspect_err(|e| tracing::error!("failed to parse password hash - pretty bad: {e}"))
+        .map_err(|_| PasswordError::MalformedHash(hash.into()))?;
+
+    match argon2(pepper).verify_password(password.as_bytes(), &parsed_hash) {
+        Ok(()) => Ok(true),
+        Err(argon2::password_hash::Error::PasswordInvalid) => Ok(false),
+        Err(e) => Err(PasswordError::Verify(e.to_string()))
+    }
+}
+
+fn dummy_hash(pepper: Option<&String>) -> &'static str {
+    static HASH: OnceLock<String> = OnceLock::new();
+
+    HASH.get_or_init(|| {
+        argon2(pepper)
+            .hash_password(b"soggymod")
+            .expect("hashing a static str can't fail")
+            .to_string()
+    })
+}
+

src/config.rs

@@ -1,4 +1,6 @@
 use std::{
+    path::PathBuf,
+    str::FromStr,
     sync::{Arc, OnceLock},
     time::Duration,
 };
@@ -9,6 +11,9 @@ use tokio::sync::mpsc::Sender;
 use crate::{
     auth::github::GithubClient,
     dns::ValidateDnsResolver,
+    email::{
+        SmtpConfig, SmtpSecurity, blocklist::Blocklist, lettre::LettreBackend, mailer::Mailer,
+    },
     endpoints::mods::IndexQueryParams,
     s3_worker::S3WorkerTask,
     storage::{LocalBackend, PrivateDisk, PublicDisk, S3Backend, S3Configuration},
@@ -34,10 +39,13 @@ pub struct AppData {
     max_download_mb: u32,
     port: u16,
     debug: bool,
+    password_hash_pepper: Option<String>,
 
     mods_cache: Cache<IndexQueryParams, ApiResponse<PaginatedData<Mod>>>,
     http_client: reqwest::Client,
     check_dns_http_client: reqwest::Client,
+    mailer: Option<Mailer>,
+    email_blocklist: Option<Blocklist>,
 
     s3_sender: OnceLock<Sender<S3WorkerTask>>,
 }
@@ -60,6 +68,14 @@ pub async fn build_config() -> anyhow::Result<AppData> {
     let github_client = dotenvy::var("GITHUB_CLIENT_ID").unwrap_or("".to_string());
     let github_secret = dotenvy::var("GITHUB_CLIENT_SECRET").unwrap_or("".to_string());
     let webhook_url = dotenvy::var("DISCORD_WEBHOOK_URL").unwrap_or("".to_string());
+    let password_hash_pepper = dotenvy::var("PASSWORD_HASH_PEPPER").ok();
+
+    if password_hash_pepper.is_none() {
+        tracing::warn!(
+            "IMPORTANT: no password hash pepper found, password storage will be LESS secure. Check https://en.wikipedia.org/wiki/Pepper_(cryptography) for more information."
+        );
+    }
+
     let index_admin_webhook_url =
         dotenvy::var("INDEX_ADMIN_DISCORD_WEBHOOK_URL").unwrap_or("".to_string());
     let disable_downloads =
@@ -89,6 +105,26 @@ pub async fn build_config() -> anyhow::Result<AppData> {
         .timeout(Duration::from_secs(30))
         .build()?;
 
+    let smtp_config = SmtpConfig::from_env()?;
+
+    if !debug
+        && smtp_config
+            .as_ref()
+            .is_some_and(|x| x.security == SmtpSecurity::None)
+    {
+        tracing::warn!(
+            "You are using no SMTP security for sending emails with APP_DEBUG=0. You have been warned."
+        );
+    }
+
+    let blocklist = if smtp_config.is_some() {
+        let env_var = dotenvy::var("EMAIL_BLOCKLIST_PATH").unwrap_or("./blocklist.conf".into());
+        let path = PathBuf::from_str(&env_var).ok();
+
+        path.map(Blocklist::load)
+    } else {
+        None
+    };
     let http_client = reqwest::Client::builder()
         .pool_max_idle_per_host(4)
         .connect_timeout(Duration::from_secs(10))
@@ -116,9 +152,20 @@ pub async fn build_config() -> anyhow::Result<AppData> {
         max_download_mb,
         port,
         debug,
+        password_hash_pepper,
         mods_cache,
         http_client,
         check_dns_http_client,
+        mailer: smtp_config
+            .and_then(|config| match LettreBackend::new(&config) {
+                Ok(backend) => Some(Arc::new(backend)),
+                Err(e) => {
+                    tracing::warn!("failed to create SMTP backend: {e}");
+                    None
+                }
+            })
+            .map(|backend| Mailer::new(backend)),
+        email_blocklist: blocklist,
         s3_sender: OnceLock::new(),
     })
 }
@@ -164,6 +211,10 @@ impl AppData {
         self.debug
     }
 
+    pub fn password_hash_pepper(&self) -> Option<&String> {
+        self.password_hash_pepper.as_ref()
+    }
+
     pub fn static_storage(&self) -> &PublicDisk {
         &self.static_storage
     }
@@ -188,6 +239,14 @@ impl AppData {
         &self.http_client
     }
 
+    pub fn mailer(&self) -> Option<&Mailer> {
+        self.mailer.as_ref()
+    }
+
+    pub fn email_blocklist(&self) -> Option<&Blocklist> {
+        self.email_blocklist.as_ref()
+    }
+
     /// Client that validates passed host, denies all private resolved IP addresses.
     /// Useful for preventing Server Side Request Forgery.
     ///