Sharkey/src/server/api/private/signin.ts

90 lines
1.8 KiB
TypeScript
Raw Normal View History

2018-04-13 00:06:18 +03:00
import * as Koa from 'koa';
2017-01-18 07:19:50 +02:00
import * as bcrypt from 'bcryptjs';
2017-12-08 15:57:58 +02:00
import * as speakeasy from 'speakeasy';
2018-04-01 22:01:34 +03:00
import User, { ILocalUser } from '../../../models/user';
2018-03-29 14:32:18 +03:00
import Signin, { pack } from '../../../models/signin';
2018-04-02 07:33:46 +03:00
import event from '../../../publishers/stream';
2017-11-23 06:25:33 +02:00
import signin from '../common/signin';
2018-04-02 07:15:53 +03:00
import config from '../../../config';
2016-12-29 00:49:51 +02:00
2018-04-13 00:06:18 +03:00
export default async (ctx: Koa.Context) => {
ctx.set('Access-Control-Allow-Origin', config.url);
ctx.set('Access-Control-Allow-Credentials', 'true');
2016-12-29 00:49:51 +02:00
2018-04-13 03:44:00 +03:00
const username = ctx.request.body['username'];
const password = ctx.request.body['password'];
const token = ctx.request.body['token'];
2016-12-29 00:49:51 +02:00
2017-02-22 12:39:34 +02:00
if (typeof username != 'string') {
2018-04-13 00:06:18 +03:00
ctx.status = 400;
2017-02-22 12:39:34 +02:00
return;
}
if (typeof password != 'string') {
2018-04-13 00:06:18 +03:00
ctx.status = 400;
2017-02-22 12:39:34 +02:00
return;
}
2017-12-08 15:57:58 +02:00
if (token != null && typeof token != 'string') {
2018-04-13 00:06:18 +03:00
ctx.status = 400;
2017-12-08 15:57:58 +02:00
return;
}
2016-12-29 00:49:51 +02:00
// Fetch user
2018-04-01 22:01:34 +03:00
const user = await User.findOne({
2018-03-29 08:48:47 +03:00
usernameLower: username.toLowerCase(),
2018-03-27 10:51:12 +03:00
host: null
2017-02-22 06:08:33 +02:00
}, {
fields: {
data: false,
2018-04-13 00:06:18 +03:00
profile: false
2017-02-22 06:08:33 +02:00
}
2018-04-01 22:01:34 +03:00
}) as ILocalUser;
2016-12-29 00:49:51 +02:00
if (user === null) {
2018-04-13 00:06:18 +03:00
ctx.throw(404, {
2017-03-09 23:42:57 +02:00
error: 'user not found'
});
2016-12-29 00:49:51 +02:00
return;
}
// Compare password
2018-04-07 22:44:59 +03:00
const same = await bcrypt.compare(password, user.password);
2016-12-29 00:49:51 +02:00
if (same) {
2018-04-07 21:58:11 +03:00
if (user.twoFactorEnabled) {
2017-12-08 15:57:58 +02:00
const verified = (speakeasy as any).totp.verify({
2018-04-07 21:58:11 +03:00
secret: user.twoFactorSecret,
2017-12-08 15:57:58 +02:00
encoding: 'base32',
token: token
});
if (verified) {
2018-04-13 05:44:39 +03:00
signin(ctx, user);
2017-12-08 15:57:58 +02:00
} else {
2018-04-13 00:06:18 +03:00
ctx.throw(400, {
2017-12-08 15:57:58 +02:00
error: 'invalid token'
});
}
} else {
2018-04-13 05:44:39 +03:00
signin(ctx, user);
2017-12-08 15:57:58 +02:00
}
2016-12-29 00:49:51 +02:00
} else {
2018-04-13 00:06:18 +03:00
ctx.throw(400, {
2017-03-09 23:42:57 +02:00
error: 'incorrect password'
});
2016-12-29 00:49:51 +02:00
}
// Append signin history
2017-01-17 03:49:27 +02:00
const record = await Signin.insert({
2018-03-29 08:48:47 +03:00
createdAt: new Date(),
userId: user._id,
2018-04-13 00:06:18 +03:00
ip: ctx.ip,
headers: ctx.headers,
2016-12-29 00:49:51 +02:00
success: same
});
// Publish signin event
2018-02-02 01:21:30 +02:00
event(user._id, 'signin', await pack(record));
2016-12-29 00:49:51 +02:00
};