do stuffs

backend/src/auth.rs

@@ -1,13 +1,14 @@
 use crate::auth_persistence::AuthStorage;
+use crate::csrf::{CsrfState, set_csrf_cookie};
 use crate::items;
 use crate::proto_utils::Proto;
 use rocket::State;
 use rocket::futures::lock::Mutex;
+use rocket::http::CookieJar;
 use std::collections::{HashMap, HashSet};
 use uuid::Uuid;
 
 pub struct AuthState {
-    // Map token -> username
     tokens: Mutex<HashMap<String, String>>,
     storage: AuthStorage,
 }
@@ -65,7 +66,6 @@ impl<'r> rocket::request::FromRequest<'r> for Token {
 
         match token {
             Some(token) => {
-                // Check if token starts with "Bearer "
                 if let Some(token) = token.strip_prefix("Bearer ") {
                     let state = request.guard::<&State<AuthState>>().await.unwrap();
                     let tokens = state.tokens.lock().await;
@@ -130,7 +130,9 @@ impl<'r> rocket::request::FromRequest<'r> for AdminToken {
 #[post("/login", data = "<request>")]
 pub async fn login(
     state: &State<AuthState>,
+    csrf_state: &State<CsrfState>,
     user_list: &State<Mutex<Vec<crate::User>>>,
+    jar: &CookieJar<'_>,
     request: Proto<items::LoginRequest>,
 ) -> items::LoginResponse {
     let req = request.into_inner();
@@ -146,6 +148,9 @@ pub async fn login(
         tokens.insert(token.clone(), req.username.clone());
         state.storage.save_tokens(&tokens);
 
+        let csrf_token = csrf_state.generate_token();
+        set_csrf_cookie(jar, &csrf_token);
+
         return items::LoginResponse {
             token,
             success: true,
@@ -186,6 +191,8 @@ pub async fn logout(
 pub async fn get_auth_status(
     state: &State<AuthState>,
     admin_state: &State<AdminState>,
+    csrf_state: &State<CsrfState>,
+    jar: &CookieJar<'_>,
     request: Proto<items::AuthStatusRequest>,
 ) -> items::AuthStatusResponse {
     let req = request.into_inner();
@@ -195,6 +202,9 @@ pub async fn get_auth_status(
         let admins = admin_state.admins.lock().await;
         let is_admin = crate::store::is_admin(username, &admins);
 
+        let csrf_token = csrf_state.generate_token();
+        set_csrf_cookie(jar, &csrf_token);
+
         items::AuthStatusResponse {
             authenticated: true,
             username: username.clone(),