Log in with a hashed password

Task: let a user sign in with an e-mail and a password, where the database keeps only a hash of the password, and show a page only to signed-in users.

The table stores a bcrypt hash (made with hashPassword, as in the sign-up recipe), never the password:

# Recipe: sign in against a password hash, and a page only a signed-in user sees.
paths:
  components: ./components
  migrations: ./migrations

datasources:
  db:
    driver: sqlite
    database: ./data/users.db

CREATE TABLE users (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    email TEXT NOT NULL UNIQUE,
    name TEXT NOT NULL,
    role TEXT NOT NULL DEFAULT 'member',
    password_hash TEXT NOT NULL
);

-- The password is "correct horse battery"; only its bcrypt hash is stored
-- (made with hashPassword, see the sign-up recipe).
INSERT INTO users (email, name, role, password_hash) VALUES
    ('ana@example.com', 'Ana', 'admin',
     '$2b$12$I4TEFfyLIaWrYBSQnyB1cuE1nkqh3CS4qpXmtZcUPUokfv/cOZNnC');

The sign-in action looks the user up and checks the password with verifyPassword. It is false, never an error, for a wrong password, a missing user or an empty field. On success it sets the session variables that require_auth and require_role read. session.sessionExpiry is required: a session without it counts as expired.

<q:component name="Login">
  <q:action name="signin" method="POST">
    <q:param name="email" type="email" required="true" />
    <q:param name="password" required="true" />

    <q:query name="user" datasource="db">
      SELECT id, name, role, password_hash FROM users WHERE email = :email
      <q:param name="email" value="{email}" type="string" />
    </q:query>

    <q:if condition="user_result.recordCount == 1 and verifyPassword(password, user[0].password_hash)">
      <q:set name="session.authenticated" value="true" type="boolean" />
      <q:set name="session.userId" value="{user[0].id}" />
      <q:set name="session.userName" value="{user[0].name}" />
      <q:set name="session.userRole" value="{user[0].role}" />
      <q:set name="session.sessionExpiry" value="{dateAdd('h', 8)}" />
      <q:redirect url="/" flash="Welcome, {user[0].name}!" />
    </q:if>
    <!-- The same message whether the address or the password is wrong. -->
    <q:redirect url="/login" flash="Wrong e-mail or password." flashType="error" />
  </q:action>

  <h1>Sign in</h1>
  <q:if condition="flash"><p class="flash-{flashType}">{flash}</p></q:if>
  <form method="POST">
    <input name="email" type="email" placeholder="E-mail" />
    <input name="password" type="password" placeholder="Password" />
    <button>Sign in</button>
  </form>
</q:component>

The home page asks for a signed-in session with require_auth="true":

<q:component name="Home" require_auth="true">
  <q:if condition="flash"><p>{flash}</p></q:if>
  <h1>Hello, {session.userName}</h1>
  <p>You are signed in as {session.userRole}.</p>
</q:component>

A wrong address and a wrong password get the same message, so the form does not tell a stranger which addresses have an account:

<q:test name="a visitor who is not signed in is sent to sign in" page="/">
  <test:visit />
  <test:expect text="Sign in" />
  <test:expect no-text="Hello," />
</q:test>

<q:test name="the right password signs in" page="/login">
  <test:submit action="signin" email="ana@example.com" password="correct horse battery" />
  <test:expect redirect="/" flash="Welcome, Ana!" />
  <test:expect text="Hello, Ana" />
  <test:expect text="You are signed in as admin." />
</q:test>

<q:test name="a wrong password is refused, with the same message as an unknown address" page="/login">
  <test:submit action="signin" email="ana@example.com" password="guess" />
  <test:expect redirect="/login" flash="Wrong e-mail or password." />
  <test:submit action="signin" email="nobody@example.com" password="guess" />
  <test:expect redirect="/login" flash="Wrong e-mail or password." />
</q:test>

tests/login.test.q
  PASS  a visitor who is not signed in is sent to sign in
  PASS  the right password signs in
  PASS  a wrong password is refused, with the same message as an unknown address
3 passed, 0 failed

More in the Authentication guide.