Sharkey/src/api/private/signin.ts

88 lines
1.8 KiB
TypeScript
Raw Normal View History

2016-12-29 00:49:51 +02:00
import * as express from 'express';
2017-01-18 07:19:50 +02:00
import * as bcrypt from 'bcryptjs';
2017-12-08 15:57:58 +02:00
import * as speakeasy from 'speakeasy';
2017-09-16 11:31:37 +03:00
import { default as User, IUser } from '../models/user';
2016-12-29 00:49:51 +02:00
import Signin from '../models/signin';
import serialize from '../serializers/signin';
import event from '../event';
2017-11-23 06:25:33 +02:00
import signin from '../common/signin';
2016-12-29 00:49:51 +02:00
export default async (req: express.Request, res: express.Response) => {
res.header('Access-Control-Allow-Credentials', 'true');
const username = req.body['username'];
const password = req.body['password'];
2017-12-08 15:57:58 +02:00
const token = req.body['token'];
2016-12-29 00:49:51 +02:00
2017-02-22 12:39:34 +02:00
if (typeof username != 'string') {
res.sendStatus(400);
return;
}
if (typeof password != 'string') {
res.sendStatus(400);
return;
}
2017-12-08 15:57:58 +02:00
if (token != null && typeof token != 'string') {
res.sendStatus(400);
return;
}
2016-12-29 00:49:51 +02:00
// Fetch user
2017-09-16 11:31:37 +03:00
const user: IUser = await User.findOne({
2016-12-29 00:49:51 +02:00
username_lower: username.toLowerCase()
2017-02-22 06:08:33 +02:00
}, {
fields: {
data: false,
profile: false
}
2016-12-29 00:49:51 +02:00
});
if (user === null) {
2017-03-09 23:42:57 +02:00
res.status(404).send({
error: 'user not found'
});
2016-12-29 00:49:51 +02:00
return;
}
// Compare password
2017-11-08 07:58:48 +02:00
const same = await bcrypt.compare(password, user.password);
2016-12-29 00:49:51 +02:00
if (same) {
2017-12-08 15:57:58 +02:00
if (user.two_factor_enabled) {
const verified = (speakeasy as any).totp.verify({
secret: user.two_factor_secret,
encoding: 'base32',
token: token
});
if (verified) {
signin(res, user, false);
} else {
res.status(400).send({
error: 'invalid token'
});
}
} else {
signin(res, user, false);
}
2016-12-29 00:49:51 +02:00
} else {
2017-03-09 23:42:57 +02:00
res.status(400).send({
error: 'incorrect password'
});
2016-12-29 00:49:51 +02:00
}
// Append signin history
2017-01-17 03:49:27 +02:00
const record = await Signin.insert({
2016-12-29 00:49:51 +02:00
created_at: new Date(),
user_id: user._id,
ip: req.ip,
headers: req.headers,
success: same
});
// Publish signin event
event(user._id, 'signin', await serialize(record));
};