Added token validation to all api calls, esp. checkins. Changed status reports to use better query structure. Added query derived types to the request derived types directly. Requires testing of actual builds.

1 files changed, 39 insertions, 0 deletions

diff --git a/captain/security.f90 b/captain/security.f90
index 2f5fa4c..44d40a6 100644
--- a/captain/security.f90
+++ b/captain/security.f90
@@ -104,4 +104,43 @@ contains
     
     end function validate_titan_token
 
+    ! NOTE: A null() token can be passed, and it might even validate!
+    function validate_query_token(token, player)
+    use captain_db
+    implicit none
+        
+        character(len=:), pointer::token
+        character(len=*), intent(in)::player
+        
+        logical::validate_query_token
+        
+        character(len=:), pointer::dbtoken
+        
+        validate_query_token = .false.
+        
+        if(associated(token)) then
+            allocate(character(len=len(token))::dbtoken)
+        else
+            allocate(character(len=64)::dbtoken)
+        end if
+        
+        dbtoken = ' '
+        
+        call get_player_token_db(player, dbtoken)
+        
+        ! If no token is provided and none is in the db, then we're okay
+        if((.not. associated(token)) .and. len_trim(dbtoken) == 0) then
+            
+            validate_query_token = .true.
+            
+        else if(associated(token)) then
+            
+            validate_query_token = (trim(token) == trim(dbtoken))
+            
+        end if
+        
+        deallocate(dbtoken)
+        
+    end function validate_query_token
+
 end module security
\ No newline at end of file