From 5dce5ffdae8a2f7896c82fe04b983302886718d7 Mon Sep 17 00:00:00 2001
From: Mathis Brossier <mathis.brossier@gmail.com>
Date: Mon, 21 Oct 2024 22:38:24 +0200
Subject: [PATCH] started working on auth

---
 client/src/server/protocol.ts     | 14 ++++--
 client/src/twmap/datafile.ts      |  1 -
 client/src/ui/index.svelte        | 22 +++++++--
 client/src/ui/lib/dialog.ts       | 10 ++++
 client/src/ui/lib/fence.svelte    | 10 ++--
 client/src/ui/lib/util.ts         | 10 +++-
 client/src/ui/routes/edit.svelte  |  3 +-
 client/src/ui/routes/lobby.svelte | 19 ++++++--
 desktop/Cargo.lock                | 43 +++++++++++++++++
 server/Cargo.lock                 | 43 +++++++++++++++++
 server/Cargo.toml                 |  1 +
 server/src/error.rs               |  3 ++
 server/src/map_cfg.rs             | 57 ++++++++++++++++++----
 server/src/protocol.rs            | 34 ++++++++++----
 server/src/room.rs                | 22 ++++-----
 server/src/router.rs              | 39 +++++++++++-----
 server/src/server.rs              | 78 ++++++++++++++++++++++---------
 17 files changed, 327 insertions(+), 82 deletions(-)

diff --git a/client/src/server/protocol.ts b/client/src/server/protocol.ts
index 1287e0c..059dfc0 100644
--- a/client/src/server/protocol.ts
+++ b/client/src/server/protocol.ts
@@ -13,7 +13,9 @@ type Base64 = string
 
 export interface Config {
   name: string
-  access: 'public' | 'unlisted'
+  public: boolean
+  password: string
+  version: 'ddnet06' | 'teeworlds07'
 }
 
 export interface MapDetail {
@@ -74,7 +76,8 @@ export interface AutomapperDiagnostic {
 
 export type MapCreation = {
   version: 'ddnet06' | 'teeworlds07'
-  access: 'public' | 'unlisted'
+  public: boolean
+  password: string
 } & ({
   clone: string
 } | {
@@ -86,6 +89,11 @@ export type MapCreation = {
   upload: Base64
 })
 
+export interface JoinReq {
+  name: string,
+  password: string,
+}
+
 export interface MapGetReq {
   users: undefined
   cursors: undefined
@@ -249,7 +257,7 @@ export interface Send {
   "delete/automapper": MapDelReq['automapper']
   "cursor": Cursor
   "save": undefined
-  "join": string
+  "join": JoinReq
   "leave": string
   "create": EditReq['map']
   "delete": DeleteReq['map']
diff --git a/client/src/twmap/datafile.ts b/client/src/twmap/datafile.ts
index 6776c08..89d1f86 100644
--- a/client/src/twmap/datafile.ts
+++ b/client/src/twmap/datafile.ts
@@ -92,7 +92,6 @@ export class DataFile {
 
     // calculate checksum
     this.crc = crc32(new Uint8Array(this.data))
-    console.info('map crc', this.crc.toString(16))
 
     // we only support datafile version 4
     if (this.version != 4) {
diff --git a/client/src/ui/index.svelte b/client/src/ui/index.svelte
index 17f35d1..512c782 100644
--- a/client/src/ui/index.svelte
+++ b/client/src/ui/index.svelte
@@ -6,29 +6,41 @@
   import storage from '../storage'
   import { WebSocketServer } from '../server/server'
   import { server, serverCfg } from './global'
-  import { serverWsUrl } from '../server/util'
+  import { serverHttpUrl, serverWsUrl } from '../server/util'
+  import { queryConfig } from './lib/util'
 
   export let url = ''
 
-  function joinServer() {
+  async function joinServer(params: { [name: string]: string }) {
     const serverCfgs = storage.load('servers')
     const serverId = storage.load('currentServer')
 
+
     $serverCfg = serverCfgs[serverId]
+    console.log('joining server', $serverCfg)
     const wsUrl = serverWsUrl($serverCfg)
     $server = new WebSocketServer(wsUrl)
 
-    return new Promise((resolve, reject) => {
+    const connected = new Promise((resolve, reject) => {
       $server.socket.addEventListener('open', resolve, { once: true })
       $server.socket.addEventListener('error', () => reject("Failed to connect to the server"), { once: true })
     })
+    await connected
+    let config = await queryConfig(serverHttpUrl($serverCfg), params.mapName)
+
+    if (config.password) {
+      return prompt("enter password")
+    } else {
+      return ''
+    }
   }
 </script>
 
 <Router {url}>
   <Route path="edit/*mapName" let:params>
-    <Fence fullscreen signal={joinServer()} loadText="Connecting to server…">
-      <Edit name={params.mapName} />
+    {@const signal = joinServer(params)}
+    <Fence fullscreen {signal} let:result={password} loadText="Connecting to server…">
+      <Edit name={params.mapName} {password} />
     </Fence>
   </Route>
   <Route path="/">
diff --git a/client/src/ui/lib/dialog.ts b/client/src/ui/lib/dialog.ts
index b62df88..0b88300 100644
--- a/client/src/ui/lib/dialog.ts
+++ b/client/src/ui/lib/dialog.ts
@@ -40,6 +40,16 @@ export function showDialog(
     }, ...dialog.messages]
   })
 
+  if (controls !== 'yesno') {
+    if (type === 'info') {
+      console.info(`[%c%s%c] ${message}`, 'color: green', 'INFO', 'color: unset')
+    } else if (type === 'warning') {
+      console.warn(`[%c%s%c] ${message}`, 'color: orange', 'WARN', 'color: unset')
+    } else if (type === 'error') {
+      console.error(`[%c%s%c] ${message}`, 'color: red', 'ERROR', 'color: unset')
+    }
+  }
+
   if (controls === 'none')
     return id
   else
diff --git a/client/src/ui/lib/fence.svelte b/client/src/ui/lib/fence.svelte
index 3e21487..11c7f49 100644
--- a/client/src/ui/lib/fence.svelte
+++ b/client/src/ui/lib/fence.svelte
@@ -1,7 +1,8 @@
-<script lang="ts">
+<script lang="ts" generics="T">
   import { InlineNotification, Loading } from 'carbon-components-svelte'
+  import { showError } from './dialog'
 
-  export let signal: Promise<unknown>
+  export let signal: Promise<T>
   export let loadText = 'Loading'
   export let errorText = 'Error'
   export let fullscreen = false
@@ -14,9 +15,10 @@
       <div class="text">{loadText}</div>
     </div>
   </div>
-{:then}
-  <slot />
+{:then result}
+  <slot {result} />
 {:catch error}
+  {showError(error) && ''}
   <InlineNotification
     kind="error"
     hideCloseButton
diff --git a/client/src/ui/lib/util.ts b/client/src/ui/lib/util.ts
index 93bfbe8..8f040bc 100644
--- a/client/src/ui/lib/util.ts
+++ b/client/src/ui/lib/util.ts
@@ -4,7 +4,7 @@ import { Image } from '../../twmap/image'
 import { AnyTilesLayer, FrontLayer, GameLayer, SpeedupLayer, SwitchLayer, TeleLayer, TilesLayer, TuneLayer } from '../../twmap/tilesLayer'
 import { TilesLayerFlags } from '../../twmap/types'
 import type { WebSocketServer } from '../../server/server'
-import type { MapCreation, MapDetail } from '../../server/protocol'
+import type { Config, MapCreation, MapDetail } from '../../server/protocol'
 import * as MapDir from '../../twmap/mapdir'
 import { QuadsLayer } from '../../twmap/quadsLayer'
 import { clearDialog, showInfo } from './dialog'
@@ -57,7 +57,7 @@ export async function createMap(httpRoot: string, name: string, create: MapCreat
 }
 
 // export async function uploadImage(httpRoot: string, mapName: string, imageName: string, file: Blob) {
-//   await fetch(`${httpRoot}/maps/${mapName}/map/images/${imageName}`, {
+//   await fetch(`${httpRoot}/maps/${mapName}/images/${imageName}`, {
 //     method: 'POST',
 //     body: file
 //   })
@@ -102,6 +102,12 @@ export async function queryMaps(httpRoot: string): Promise<MapDetail[]> {
   return maps
 }
 
+export async function queryConfig(httpRoot: string, mapName: string): Promise<Config> {
+  const resp = await fetch(`${httpRoot}/maps/${mapName}/config`)
+  const config: Config = await resp.json()
+  return config
+}
+
 export async function queryMap(httpRoot: string, mapName: string): Promise<Map> {
   const resp = await fetch(`${httpRoot}/maps/${mapName}`)
   const data = await resp.arrayBuffer()
diff --git a/client/src/ui/routes/edit.svelte b/client/src/ui/routes/edit.svelte
index 1f4dc10..88fc997 100644
--- a/client/src/ui/routes/edit.svelte
+++ b/client/src/ui/routes/edit.svelte
@@ -10,11 +10,12 @@
   import { serverHttpUrl } from '../../server/util'
 
   export let name: string
+  export let password: string
 
   let loadingSignal = (async () => {
     reset()
 
-    await $server.query('join', name)
+    await $server.query('join', { name, password })
     const httpUrl = serverHttpUrl($serverCfg)
     const map_ = await queryMap(httpUrl, name)
     const ams = await $server.query('get/automappers', undefined)
diff --git a/client/src/ui/routes/lobby.svelte b/client/src/ui/routes/lobby.svelte
index eafd880..318768d 100644
--- a/client/src/ui/routes/lobby.svelte
+++ b/client/src/ui/routes/lobby.svelte
@@ -70,6 +70,7 @@
     open: boolean
     name: string
     public: boolean
+    password: string,
     method: 'upload' | 'blank' | 'clone'
     clone: number | undefined
     cloneItems: { id: number; text: string }[]
@@ -82,6 +83,7 @@
     open: false,
     name: 'My Map',
     public: true,
+    password: '',
     method: 'upload',
     clone: undefined,
     cloneItems: [],
@@ -231,7 +233,6 @@
 
   async function onCreateMap() {
     const { name, method } = modalCreateMap
-    const access = modalCreateMap.public ? 'public' : 'unlisted'
 
     const id = showInfo('Querying the server…', 'none')
 
@@ -242,7 +243,8 @@
       else if (method === 'blank') {
         await createMap(httpUrl, name, {
           version: 'ddnet06', // TODO
-          access,
+          public: modalCreateMap.public,
+          password: modalCreateMap.password,
           blank: {
             w: modalCreateMap.blankWidth,
             h: modalCreateMap.blankHeight,
@@ -252,13 +254,14 @@
       else if (method === 'clone' && modalCreateMap.clone !== undefined) {
         await createMap(httpUrl, name, {
           version: 'ddnet06',
-          access,
+          public: modalCreateMap.public,
+          password: modalCreateMap.password,
           clone: maps[modalCreateMap.clone].name
         })
       }
 
       clearDialog(id)
-      if (access === 'unlisted') {
+      if (!modalCreateMap.public) {
         showWarning("You created a map that won't be publicly listed. To access it in the future, use the access key '" + name + "'.")
       }
       navigate('/edit/' + name)
@@ -275,6 +278,10 @@
   }
 </script>
 
+<svelte:head>
+  <title>DDNet Map Editor</title>
+</svelte:head>
+
 <div id="header">
   <div class="left" />
   <div class="middle">
@@ -510,6 +517,10 @@
       labelB="public"
       bind:toggled={modalCreateMap.public}
     />
+    <TextInput
+      labelText="Password (leave blank for public maps)"
+      bind:value={modalCreateMap.password}
+    />
   </div>
 </Modal>
 
diff --git a/desktop/Cargo.lock b/desktop/Cargo.lock
index 12c5bfa..980d814 100644
--- a/desktop/Cargo.lock
+++ b/desktop/Cargo.lock
@@ -344,6 +344,19 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
+[[package]]
+name = "bcrypt"
+version = "0.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e65938ed058ef47d92cf8b346cc76ef48984572ade631927e9937b5ffc7662c7"
+dependencies = [
+ "base64 0.22.1",
+ "blowfish",
+ "getrandom 0.2.15",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "bindgen"
 version = "0.69.5"
@@ -412,6 +425,16 @@ dependencies = [
  "objc2",
 ]
 
+[[package]]
+name = "blowfish"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e412e2cd0f2b2d93e02543ceae7917b3c70331573df19ee046bcbc35e45e87d7"
+dependencies = [
+ "byteorder",
+ "cipher",
+]
+
 [[package]]
 name = "brotli"
 version = "6.0.0"
@@ -613,6 +636,16 @@ dependencies = [
  "windows-targets 0.52.6",
 ]
 
+[[package]]
+name = "cipher"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+dependencies = [
+ "crypto-common",
+ "inout",
+]
+
 [[package]]
 name = "clang-sys"
 version = "1.8.1"
@@ -2055,6 +2088,15 @@ dependencies = [
  "cfb",
 ]
 
+[[package]]
+name = "inout"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a0c10553d664a4d0bcff9f4215d0aac67a639cc68ef660840afe309b807bc9f5"
+dependencies = [
+ "generic-array",
+]
+
 [[package]]
 name = "instant"
 version = "0.1.13"
@@ -4950,6 +4992,7 @@ dependencies = [
  "axum-extra",
  "axum-server",
  "base64 0.21.7",
+ "bcrypt",
  "clap",
  "either",
  "env_logger 0.11.5",
diff --git a/server/Cargo.lock b/server/Cargo.lock
index 86ffd0e..028aff8 100644
--- a/server/Cargo.lock
+++ b/server/Cargo.lock
@@ -300,6 +300,19 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
+[[package]]
+name = "bcrypt"
+version = "0.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e65938ed058ef47d92cf8b346cc76ef48984572ade631927e9937b5ffc7662c7"
+dependencies = [
+ "base64 0.22.1",
+ "blowfish",
+ "getrandom",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "bindgen"
 version = "0.69.5"
@@ -350,6 +363,16 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "blowfish"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e412e2cd0f2b2d93e02543ceae7917b3c70331573df19ee046bcbc35e45e87d7"
+dependencies = [
+ "byteorder",
+ "cipher",
+]
+
 [[package]]
 name = "bumpalo"
 version = "3.16.0"
@@ -427,6 +450,16 @@ dependencies = [
  "windows-targets 0.52.6",
 ]
 
+[[package]]
+name = "cipher"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+dependencies = [
+ "crypto-common",
+ "inout",
+]
+
 [[package]]
 name = "clang-sys"
 version = "1.8.1"
@@ -1210,6 +1243,15 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "inout"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a0c10553d664a4d0bcff9f4215d0aac67a639cc68ef660840afe309b807bc9f5"
+dependencies = [
+ "generic-array",
+]
+
 [[package]]
 name = "is_terminal_polyfill"
 version = "1.70.1"
@@ -2442,6 +2484,7 @@ dependencies = [
  "axum-extra",
  "axum-server",
  "base64 0.21.7",
+ "bcrypt",
  "clap",
  "either",
  "env_logger",
diff --git a/server/Cargo.toml b/server/Cargo.toml
index 01af8bf..a4c4aee 100644
--- a/server/Cargo.toml
+++ b/server/Cargo.toml
@@ -42,6 +42,7 @@ either = "1.9.0"
 itertools = "0.11.0"
 tower_governor = { version = "0.4.3", features = ["axum"] }
 tokio-tungstenite = { version = "0.24.0", features = ["rustls-tls-webpki-roots"] }
+bcrypt = "0.15.1"
 
 
 [lib]
diff --git a/server/src/error.rs b/server/src/error.rs
index 98bebeb..0181cd8 100644
--- a/server/src/error.rs
+++ b/server/src/error.rs
@@ -54,6 +54,7 @@ pub enum Error {
 
     AlreadyJoined,
     NotJoined,
+    Password,
 
     Map(String),
     Automapper(String),
@@ -117,6 +118,7 @@ impl Display for Error {
             Error::BridgeClosed => write!(f, "connection with the remote server closed"),
             Error::AlreadyJoined => write!(f, "already joined"),
             Error::NotJoined => write!(f, "not joined"),
+            Error::Password => write!(f, "incorrect password"),
             Error::Map(x) => write!(f, "twmap error: {x}"),
             Error::Automapper(x) => write!(f, "automapper error: {x}"),
             Error::BadRequest(x) => write!(f, "bad request: {x}"),
@@ -191,6 +193,7 @@ impl IntoResponse for Error {
             Error::BridgeClosed => StatusCode::BAD_GATEWAY,
             Error::AlreadyJoined => StatusCode::BAD_REQUEST,
             Error::NotJoined => StatusCode::BAD_REQUEST,
+            Error::Password => StatusCode::BAD_REQUEST,
             Error::Map(_) => StatusCode::BAD_REQUEST,
             Error::Automapper(_) => StatusCode::BAD_REQUEST,
             Error::BadRequest(_) => StatusCode::BAD_REQUEST,
diff --git a/server/src/map_cfg.rs b/server/src/map_cfg.rs
index a3b3a17..49889a0 100644
--- a/server/src/map_cfg.rs
+++ b/server/src/map_cfg.rs
@@ -1,15 +1,56 @@
+use std::{fs::File, path::Path};
+
 use serde::{Deserialize, Serialize};
 
-#[derive(Default, PartialEq, Clone, Debug, Serialize, Deserialize)]
-#[serde(rename_all = "lowercase")]
-pub enum MapAccess {
-    #[default]
-    Public,
-    Unlisted,
+// I updated the content of MapConfig, so this is to convert from the old format
+#[derive(Deserialize)]
+struct MapConfigOld {
+    name: String,
+    access: String,
 }
 
-#[derive(Clone, Debug, Serialize, Deserialize, Default)]
+#[derive(Clone, Debug, Serialize, Deserialize)]
 pub struct MapConfig {
     pub name: String,
-    pub access: MapAccess,
+    pub public: bool,
+    pub password: Option<String>,
+    pub version: twmap::Version,
+}
+
+impl Default for MapConfig {
+    fn default() -> Self {
+        Self {
+            name: Default::default(),
+            public: Default::default(),
+            password: Default::default(),
+            version: twmap::Version::DDNet06,
+        }
+    }
+}
+
+pub fn read_map_config(path: &Path) -> Option<MapConfig> {
+    File::open(path)
+        .ok()
+        .and_then(|file| serde_json::from_reader(file).ok())
+        .or_else(|| {
+            File::open(path)
+                .ok()
+                .and_then(|file| serde_json::from_reader(file).ok())
+                .map(|old: MapConfigOld| {
+                    let new = MapConfig {
+                        name: old.name,
+                        public: old.access == "public",
+                        password: None,
+                        version: twmap::Version::DDNet06,
+                    };
+                    log::info!(
+                        "converting config.json file to new format: {}",
+                        path.display()
+                    );
+                    File::create(path)
+                        .ok()
+                        .and_then(|f| serde_json::to_writer(f, &new).ok());
+                    new
+                })
+        })
 }
diff --git a/server/src/protocol.rs b/server/src/protocol.rs
index c4ffb91..47d6e43 100644
--- a/server/src/protocol.rs
+++ b/server/src/protocol.rs
@@ -9,7 +9,7 @@ use serde_with::{
 use twmap::{AutomapperConfig, EnvPoint, Position, Volume};
 use vek::{Extent2, Rect, Rgba, Uv, Vec2};
 
-use crate::{base64::Base64, error::Error, map_cfg::MapAccess};
+use crate::{base64::Base64, error::Error};
 
 // Some documentation about the communication between clients and the server:
 // ----------
@@ -32,10 +32,11 @@ use crate::{base64::Base64, error::Error, map_cfg::MapAccess};
 // system similar to how databases handle concurrent modifications.
 
 #[derive(Clone, Debug, Serialize, Deserialize)]
-pub struct MapConfig {
+pub struct Config {
     pub name: String,
-    pub access: MapAccess,
-    pub version: Option<twmap::Version>,
+    pub public: bool,
+    pub password: bool,
+    pub version: twmap::Version,
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize)]
@@ -129,7 +130,8 @@ pub struct Cursor {
 #[serde(default)]
 pub struct PartialConfig {
     pub name: Option<String>,
-    pub access: Option<MapAccess>,
+    pub public: Option<String>,
+    pub password: Option<String>,
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize)]
@@ -152,7 +154,9 @@ pub struct MapCreation {
     #[serde(default)]
     pub version: Option<Version>,
     #[serde(default)]
-    pub access: Option<MapAccess>,
+    pub public: Option<bool>,
+    #[serde(default)]
+    pub password: Option<String>,
     #[serde(flatten)]
     pub method: CreationMethod,
 }
@@ -303,6 +307,12 @@ pub struct HttpReq {
     pub body: String,
 }
 
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct JoinReq {
+    pub name: String,
+    pub password: Option<String>,
+}
+
 #[derive(Clone, Debug, Serialize, Deserialize)]
 #[serde(tag = "type", content = "content")]
 pub enum GetReq {
@@ -312,6 +322,10 @@ pub enum GetReq {
     Users,
     #[serde(rename = "get/cursors")]
     Cursors,
+    #[serde(rename = "get/config")]
+    Config,
+    #[serde(rename = "get/info")]
+    Info,
     #[serde(rename = "get/images")]
     Images,
     #[serde(rename = "get/image")]
@@ -425,7 +439,7 @@ pub enum Request {
     #[serde(rename = "list")]
     ListMaps,
     #[serde(rename = "join")]
-    JoinMap(String),
+    JoinMap(JoinReq),
     #[serde(rename = "leave")]
     LeaveMap(String),
     #[serde(rename = "get")]
@@ -457,6 +471,10 @@ pub enum Response {
     Ok,
     Maps(Vec<MapDetail>),
     Map(Base64),
+    Users(usize),
+    Cursors(HashMap<String, Cursor>),
+    Config(Box<Config>),
+    Info(Box<twmap::Info>),
     Images(Vec<String>),
     Image(Base64),
     Envelopes(Vec<String>),
@@ -470,8 +488,6 @@ pub enum Response {
     Automappers(Vec<AutomapperDetail>),
     AutomapperDiagnostics(Vec<AutomapperDiagnostic>),
     Automapper(String),
-    Users(usize),
-    Cursors(HashMap<String, Cursor>),
 }
 
 // Messages that are sent unrequested from the client.
diff --git a/server/src/room.rs b/server/src/room.rs
index a06d875..3647211 100644
--- a/server/src/room.rs
+++ b/server/src/room.rs
@@ -15,7 +15,11 @@ use futures::channel::mpsc::UnboundedSender;
 
 use uuid::Uuid;
 
-use crate::{error::Error, map_cfg::MapConfig, protocol::*};
+use crate::{
+    error::Error,
+    map_cfg::{read_map_config, MapConfig},
+    protocol::*,
+};
 
 type Tx = UnboundedSender<WebSocketMessage>;
 
@@ -47,7 +51,7 @@ impl LazyMap {
 
     fn unload(&self) {
         *self.map.lock() = None;
-        log::debug!("map unloaded `{}`", self.path.display());
+        log::debug!("map `{}` unloaded", self.path.display());
     }
 
     pub fn get(&self) -> MappedMutexGuard<twmap::TwMap> {
@@ -55,7 +59,7 @@ impl LazyMap {
         let mut map = self.map.lock();
         if map.is_none() {
             *map = load_map(&self.path).ok();
-            log::debug!("map loaded `{}`", self.path.display());
+            log::debug!("map `{}` loaded", self.path.display());
         }
         match *map {
             Some(_) => MutexGuard::map(map, |m| m.as_mut().unwrap()),
@@ -120,7 +124,7 @@ impl Room {
 
         let name = dir_path.file_name()?.to_string_lossy().to_string();
 
-        let config = Self::read_cfg(&cfg_path).unwrap_or_else(|| MapConfig {
+        let config = read_map_config(&cfg_path).unwrap_or_else(|| MapConfig {
             name,
             ..Default::default()
         });
@@ -139,12 +143,6 @@ impl Room {
         })
     }
 
-    fn read_cfg(path: &Path) -> Option<MapConfig> {
-        File::open(path)
-            .ok()
-            .and_then(|file| serde_json::from_reader(file).ok())
-    }
-
     pub fn new_from_files(
         map_path: PathBuf,
         cfg_path: Option<PathBuf>,
@@ -154,7 +152,7 @@ impl Room {
 
         let config = cfg_path
             .as_ref()
-            .and_then(|path| Self::read_cfg(path))
+            .and_then(|path| read_map_config(path))
             .unwrap_or_else(|| MapConfig {
                 name,
                 ..Default::default()
@@ -276,7 +274,7 @@ impl Room {
             Ok(())
         })()?;
 
-        log::debug!("map saved `{}`", self.map.path.display());
+        log::debug!("map `{}` saved", self.map.path.display());
         Ok(())
     }
 }
diff --git a/server/src/router.rs b/server/src/router.rs
index 57424d9..605e0ef 100644
--- a/server/src/router.rs
+++ b/server/src/router.rs
@@ -45,36 +45,37 @@ impl Router {
                     .post(route_post_map)
                     .delete(route_delete_map),
             )
-            .route("/maps/:map/map/images", get(route_get_images))
-            .route("/maps/:map/map/images/:image", get(route_get_image))
             .route(
-                "/maps/:map/map/info",
-                get(route_get_info).post(route_post_info),
+                "/maps/:map/config",
+                get(route_get_config).post(route_post_config),
             )
+            .route("/maps/:map/info", get(route_get_info).post(route_post_info))
+            .route("/maps/:map/images", get(route_get_images))
+            .route("/maps/:map/images/:image", get(route_get_image))
             .route(
-                "/maps/:map/map/envelopes",
+                "/maps/:map/envelopes",
                 get(route_get_envelopes).put(route_put_envelope),
             )
             .route(
-                "/maps/:map/map/envelopes/:envelope",
+                "/maps/:map/envelopes/:envelope",
                 get(route_get_envelope)
                     .post(route_post_envelope)
                     .delete(route_delete_envelope),
             )
             .route(
-                "/maps/:map/map/groups",
+                "/maps/:map/groups",
                 get(route_get_groups).put(route_put_group),
             )
             .route(
-                "/maps/:map/map/groups/:group",
+                "/maps/:map/groups/:group",
                 post(route_post_group).delete(route_delete_group),
             )
             .route(
-                "/maps/:map/map/groups/:group/layers",
+                "/maps/:map/groups/:group/layers",
                 get(route_get_layers).put(route_put_layer),
             )
             .route(
-                "/maps/:map/map/groups/:group/layers/:layer",
+                "/maps/:map/groups/:group/layers/:layer",
                 delete(route_delete_layer),
             );
         // .route(
@@ -194,7 +195,8 @@ async fn route_put_map(
 ) -> impl IntoResponse {
     let content = MapCreation {
         version: Default::default(),
-        access: Default::default(),
+        public: Default::default(),
+        password: Default::default(),
         method: CreationMethod::Upload(Base64(file.to_vec())),
     };
     server.create_map(&map, content)
@@ -229,6 +231,21 @@ async fn route_get_image(
     server.get_image(&map, image)
 }
 
+async fn route_get_config(
+    State(server): State<Arc<Server>>,
+    Path(map): Path<String>,
+) -> impl IntoResponse {
+    server.get_config(&map).map(Json)
+}
+
+async fn route_post_config(
+    State(server): State<Arc<Server>>,
+    Path(map): Path<String>,
+    Json(part_config): Json<PartialConfig>,
+) -> impl IntoResponse {
+    server.edit_config(&map, part_config)
+}
+
 async fn route_get_info(
     State(server): State<Arc<Server>>,
     Path(map): Path<String>,
diff --git a/server/src/server.rs b/server/src/server.rs
index 95ad169..4b96e7f 100644
--- a/server/src/server.rs
+++ b/server/src/server.rs
@@ -18,7 +18,6 @@ use crate::{
     checks::PartialCheck,
     cli::Cli,
     error::Error,
-    map_cfg::MapAccess,
     protocol::*,
     room::{Peer, Room},
     twmap_map_checks::InternalMapChecking,
@@ -166,6 +165,12 @@ impl Server {
                 GetReq::Users => self.get_users(map_name?).map(Response::Users),
                 GetReq::Cursors => self.get_cursors(map_name?, peer).map(Response::Cursors),
                 GetReq::Map => self.get_map(map_name?).map(|r| Response::Map(Base64(r))),
+                GetReq::Config => self
+                    .get_config(map_name?)
+                    .map(|r| Response::Config(Box::new(r))),
+                GetReq::Info => self
+                    .get_info(map_name?)
+                    .map(|r| Response::Info(Box::new(r))),
                 GetReq::Images => self.get_images(map_name?).map(Response::Images),
                 GetReq::Image(i) => self
                     .get_image(map_name?, i)
@@ -251,10 +256,10 @@ impl Server {
         Server::send(peer, packet.id, Message::Response(resp.clone()));
         if resp.is_ok() {
             match &packet.content {
-                Request::LeaveMap(map_name) | Request::JoinMap(map_name) => self
+                Request::LeaveMap(name) | Request::JoinMap(JoinReq { name, .. }) => self
                     .broadcast_to_others(
                         peer,
-                        Message::Broadcast(Broadcast::Users(self.get_users(map_name).unwrap_or(0))),
+                        Message::Broadcast(Broadcast::Users(self.get_users(name).unwrap_or(0))),
                     ),
                 Request::CreateMap(map_name, _) => {
                     self.broadcast_to_lobby(Message::Broadcast(Broadcast::MapCreated(
@@ -331,7 +336,7 @@ impl Server {
 
         self.broadcast_users(&peer);
 
-        log::info!("client disconnected {}", &addr);
+        log::info!("client {} disconnected", &addr);
 
         let peers = self.peer_count.fetch_sub(1, atomic::Ordering::Relaxed) - 1;
         log::debug!("simultaneous connections: {peers}/{}", self.max_peers);
@@ -342,7 +347,7 @@ impl Server {
     pub fn get_maps(&self) -> Vec<MapDetail> {
         self.rooms()
             .iter()
-            .filter(|(_, v)| v.config.access == MapAccess::Public)
+            .filter(|(_, v)| v.config.public)
             .map(|(k, v)| MapDetail {
                 name: k.to_owned(),
                 users: v.peer_count(),
@@ -406,7 +411,7 @@ impl Server {
             }
         };
 
-        let room = if let Some(maps_dir) = self.maps_dir.as_ref() {
+        let mut room = if let Some(maps_dir) = self.maps_dir.as_ref() {
             let path = maps_dir.join(map_name);
             let map_path = path.join("map.map");
 
@@ -416,12 +421,7 @@ impl Server {
             map.save(&mut map_file)
                 .map_err(|e| Error::Map(e.to_string()))?;
 
-            let mut room =
-                Room::new_from_dir(path).ok_or(Error::Internal("map creation failed".into()))?;
-
-            room.config.access = creation.access.unwrap_or(MapAccess::Public);
-            room.save_config()?;
-            room
+            Room::new_from_dir(path).ok_or(Error::Internal("map creation failed".into()))?
         } else if let Some(data_dir) = self.data_dir.as_ref() {
             let mut map_path = data_dir.join("maps").join(map_name);
             map_path.set_extension("map");
@@ -436,15 +436,21 @@ impl Server {
             map.save(&mut map_file)
                 .map_err(|e| Error::Map(e.to_string()))?;
 
-            let mut room = Room::new_from_files(map_path, None, Some(am_path))
-                .ok_or(Error::Internal("map creation failed".into()))?;
-
-            room.config.access = creation.access.unwrap_or(MapAccess::Public);
-            room
+            Room::new_from_files(map_path, None, Some(am_path))
+                .ok_or(Error::Internal("map creation failed".into()))?
         } else {
             return Err(Error::BadRequest("missing map path".into()));
         };
 
+        room.config.public = creation.public.unwrap_or(true);
+        if let Some(pwd) = &creation.password {
+            if !pwd.is_empty() {
+                room.config.password =
+                    Some(bcrypt::hash(pwd, bcrypt::DEFAULT_COST).map_err(|_| Error::Password)?);
+            }
+        }
+        room.save_config()?;
+
         // lock the rooms: this is blocking the whole server but prevents TOCTOU bugs.
         {
             let mut rooms = self.rooms();
@@ -455,7 +461,6 @@ impl Server {
                 rooms.insert(map_name.to_owned(), Arc::new(room));
             }
         }
-
         log::info!("map created `{}`", map_name);
         Ok(())
     }
@@ -491,6 +496,16 @@ impl Server {
         Ok(())
     }
 
+    pub fn get_config(&self, map_name: &str) -> Result<Config, Error> {
+        let map_cfg = self.room(map_name)?.config.clone();
+        Ok(Config {
+            name: map_cfg.name,
+            public: map_cfg.public,
+            password: map_cfg.password.is_some(),
+            version: map_cfg.version,
+        })
+    }
+
     pub fn edit_config(&self, _map_name: &str, _part_conf: PartialConfig) -> Result<(), Error> {
         // let room = self.room(map_name)?.clone();
         // apply_partial!(part_conf => room.config, name, access);
@@ -1702,14 +1717,33 @@ impl Server {
         room.save_map(self.max_map_size)
     }
 
-    pub fn peer_join(&self, peer: &mut Peer, map_name: &str) -> Result<(), Error> {
+    pub fn peer_join(&self, peer: &mut Peer, join: &JoinReq) -> Result<(), Error> {
         if peer.room.is_some() {
             return Err(Error::AlreadyJoined);
         }
 
-        let room = self.room(map_name)?;
-        room.add_peer(peer);
-        peer.room = Some(room);
+        // we clone the pwd hash because bcrypt::verify() is costly and we don't want to
+        // lock the room mutex.
+        let pwd_hash = self.room(&join.name)?.config.password.clone();
+        match (&join.password, &pwd_hash) {
+            (Some(pwd), Some(hash)) => {
+                if !bcrypt::verify(pwd, &hash).map_err(|_| Error::Password)? {
+                    return Err(Error::Password);
+                }
+            }
+            (Some(pwd), None) if pwd == "" => (),
+            (Some(_), None) | (None, Some(_)) => {
+                return Err(Error::Password);
+            }
+            (None, None) => (),
+        };
+
+        {
+            let room = self.room(&join.name)?;
+
+            room.add_peer(peer);
+            peer.room = Some(room);
+        }
         Ok(())
     }