Base 32 email tokens now

src/helpers.rs

···
 use chrono::Utc;
 use lettre::message::{MultiPart, SinglePart, header};
 use lettre::{AsyncTransport, Message};
+use rand::Rng;
 use rand::distr::{Alphabetic, Alphanumeric, SampleString};
 use serde::de::DeserializeOwned;
 use serde_json::{Map, Value};
+use sha2::{Digest, Sha256};
 use sqlx::SqlitePool;
 use tracing::{error, log};
+
+///Used to generate the email 2fa code
+const UPPERCASE_BASE32_CHARS: &[u8] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
 
 /// The result of a proxied call that attempts to parse JSON.
 pub enum ProxiedResult<T> {
···
         .map_err(|_| StatusCode::BAD_REQUEST)
 }
 
+/// Build a JSON error response with the required Content-Type header
+/// Content-Type: application/json (oauth endpoint does not like utf ending)
+/// Body shape: { "error": string, "error_description": string }
 pub fn oauth_json_error_response(
     status: StatusCode,
     error: impl Into<String>,
···
 }
 
 /// Creates a random token of 10 characters for email 2FA
-pub fn get_random_token(oauth: bool) -> String {
-    let full_code = match oauth {
-        true => Alphabetic.sample_string(&mut rand::rng(), 10),
-        false => Alphanumeric.sample_string(&mut rand::rng(), 10),
-    };
+pub fn get_random_token() -> String {
+    let mut rng = rand::rng();
+
+    let mut full_code = String::with_capacity(10);
+    for _ in 0..10 {
+        let idx = rng.random_range(0..UPPERCASE_BASE32_CHARS.len());
+        full_code.push(UPPERCASE_BASE32_CHARS[idx] as char);
+    }
+
     //The PDS implementation creates in lowercase, then converts to uppercase.
     //Just going a head and doing uppercase here.
     let slice_one = &full_code[0..5].to_ascii_uppercase();
···
     }
 }
 
+/// Creates a hex string from the password and salt to find app passwords
 fn scrypt_hex(password: &str, salt: &str) -> anyhow::Result<String> {
     let params = scrypt::Params::new(14, 8, 1, 64)?;
     let mut derived = [0u8; 64];
···
     Ok(hex::encode(derived))
 }
 
+/// Hashes the app password. did is used as the salt.
 pub fn hash_app_password(did: &str, password: &str) -> anyhow::Result<String> {
-    use sha2::{Digest, Sha256};
     let mut hasher = Sha256::new();
     hasher.update(did.as_bytes());
     let sha = hasher.finalize();
···
         let verified = verify_password(password, &password_scrypt).await?;
         if !verified {
             if oauth {
+                //OAuth does not allow app password logins so just go ahead and send it along it's way
                 return Ok(AuthResult::WrongIdentityOrPassword);
             }
             //Theres a chance it could be an app password so check that as well
···
         if two_factor_required {
             //Two factor is required and a taken was provided
             if let Some(two_factor_code) = two_factor_code {
-                //It seems it sends over a empty on login without it set? As in no input is shown on the ui for the first login try
+                //if the two_factor_code is set need to see if we have a valid token
                 if !two_factor_code.is_empty() {
                     return match assert_valid_token(
                         &state.account_pool,
···
                 }
             }
 
-            return match create_two_factor_token(&state.account_pool, did, oauth).await {
+            return match create_two_factor_token(&state.account_pool, did).await {
                 Ok(code) => {
                     let mut email_data = Map::new();
                     email_data.insert("token".to_string(), Value::from(code.clone()));
···
 pub async fn create_two_factor_token(
     account_db: &SqlitePool,
     did: String,
-    oauth: bool,
 ) -> anyhow::Result<String> {
     let purpose = "2fa_code";
 
-    let token = get_random_token(oauth);
+    let token = get_random_token();
     let right_now = Utc::now();
 
     let res = sqlx::query(

src/oauth_provider.rs

···
 use crate::AppState;
-use crate::helpers::{
-    AuthResult, TokenCheckError, json_error_response, oauth_json_error_response, preauth_check,
-};
+use crate::helpers::{AuthResult, TokenCheckError, oauth_json_error_response, preauth_check};
 use axum::body::Body;
 use axum::extract::State;
 use axum::http::header::CONTENT_TYPE;
···
 
                 Ok(proxied)
             }
-            AuthResult::TokenCheckFailed(err) => match err {
-                TokenCheckError::InvalidToken => oauth_json_error_response(
-                    StatusCode::BAD_REQUEST,
-                    "InvalidToken",
-                    "Token is invalid",
-                ),
-                TokenCheckError::ExpiredToken => oauth_json_error_response(
-                    StatusCode::BAD_REQUEST,
-                    "ExpiredToken",
-                    "Token is expired",
-                ),
-            },
+            AuthResult::TokenCheckFailed(err) => oauth_json_error_response(
+                StatusCode::BAD_REQUEST,
+                "invalid_request",
+                "Unable to sign-in due to an unexpected server error",
+            ),
         },
         Err(err) => {
             log::error!(
                 "Error during pre-auth check. This happens on the create_session endpoint when trying to decide if the user has access\n {err}"
             );
-            json_error_response(
+            //TODO throw a hard error and test this
+            oauth_json_error_response(
                 StatusCode::INTERNAL_SERVER_ERROR,
                 "InternalServerError",
                 "This error was not generated by the PDS, but PDS Gatekeeper. Please contact your PDS administrator for help and for them to review the server logs.",