From 214d12f6cb1309833f25072b4ba8957bb2df496a Mon Sep 17 00:00:00 2001
From: Claudio Ortolina <cloud8421@gmail.com>
Date: Mon, 21 Oct 2024 08:54:46 +0100
Subject: [PATCH] Use password from environment

---
 config/config.exs                                     |  2 ++
 config/runtime.exs                                    |  8 ++++++++
 .../controllers/session_controller.ex                 | 11 +++++++----
 3 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/config/config.exs b/config/config.exs
index ca1b2075..913ff29e 100644
--- a/config/config.exs
+++ b/config/config.exs
@@ -11,6 +11,8 @@ config :music_library,
   ecto_repos: [MusicLibrary.Repo],
   generators: [timestamp_type: :utc_datetime, binary_id: true]
 
+config :music_library, MusicLibraryWeb, auth_password: "change me"
+
 # Configures the endpoint
 config :music_library, MusicLibraryWeb.Endpoint,
   url: [host: "localhost"],
diff --git a/config/runtime.exs b/config/runtime.exs
index 33995ebd..91818a04 100644
--- a/config/runtime.exs
+++ b/config/runtime.exs
@@ -44,9 +44,17 @@ if config_env() == :prod do
       You can generate one by calling: mix phx.gen.secret
       """
 
+  auth_password =
+    System.get_env("AUTH_PASSWORD") ||
+      raise """
+      environment variable AUTH_PASSWORD is missing.
+      """
+
   host = System.get_env("PHX_HOST") || "example.com"
   port = String.to_integer(System.get_env("PORT") || "4000")
 
+  config :music_library, MusicLibraryWeb, auth_password: auth_password
+
   config :music_library, :dns_cluster_query, System.get_env("DNS_CLUSTER_QUERY")
 
   config :music_library, MusicLibraryWeb.Endpoint,
diff --git a/lib/music_library_web/controllers/session_controller.ex b/lib/music_library_web/controllers/session_controller.ex
index 2e5f9ac2..993967b0 100644
--- a/lib/music_library_web/controllers/session_controller.ex
+++ b/lib/music_library_web/controllers/session_controller.ex
@@ -7,10 +7,8 @@ defmodule MusicLibraryWeb.SessionController do
     conn |> render(:new, form: @empty_form, layout: {MusicLibraryWeb.Layouts, "unauthenticated"})
   end
 
-  def create(conn, params) do
-    password = params["password"]
-
-    if password == "password" do
+  def create(conn, %{"password" => request_password}) do
+    if Plug.Crypto.secure_compare(password(), request_password) do
       conn
       |> put_session(:logged_in, true)
       |> redirect(to: "/")
@@ -20,4 +18,9 @@ defmodule MusicLibraryWeb.SessionController do
       |> redirect(to: ~p"/login")
     end
   end
+
+  def password do
+    Application.get_env(:music_library, MusicLibraryWeb)
+    |> Keyword.fetch!(:auth_password)
+  end
 end