121 lines
5.1 KiB
JavaScript
121 lines
5.1 KiB
JavaScript
/*Canopy - The next generation of stoner streaming software
|
|
Copyright (C) 2024-2025 Rainbownapkin and the TTN Community
|
|
|
|
This program is free software: you can redistribute it and/or modify
|
|
it under the terms of the GNU Affero General Public License as
|
|
published by the Free Software Foundation, either version 3 of the
|
|
License, or (at your option) any later version.
|
|
|
|
This program is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
GNU Affero General Public License for more details.
|
|
|
|
You should have received a copy of the GNU Affero General Public License
|
|
along with this program. If not, see <https://www.gnu.org/licenses/>.*/
|
|
|
|
//Config
|
|
const config = require('../../../../config.json');
|
|
|
|
//npm imports
|
|
const {validationResult, matchedData} = require('express-validator');
|
|
|
|
//local imports
|
|
const migrationModel = require('../../../schemas/user/migrationSchema.js');
|
|
const rememberMeModel = require('../../../schemas/user/rememberMeSchema.js');
|
|
const sessionUtils = require('../../../utils/sessionUtils');
|
|
const hashUtils = require('../../../utils/hashUtils.js');
|
|
const {exceptionHandler, errorHandler} = require('../../../utils/loggerUtils');
|
|
|
|
//api account functions
|
|
module.exports.post = async function(req, res){
|
|
try{
|
|
//Check validation results
|
|
const validResult = validationResult(req);
|
|
|
|
//if we don't have errors
|
|
if(validResult.isEmpty()){
|
|
//Pull sanatzied/validated data
|
|
const data = matchedData(req);
|
|
|
|
//try to authenticate the session, throwing an error and breaking the current code block if user is un-authorized
|
|
const userDB = await sessionUtils.authenticateSession(data.user, data.pass, req);
|
|
|
|
//If the user already has a remember me token
|
|
if(data.rememberme != null && data.rememberme.id != null){
|
|
//Fucking nuke the bitch
|
|
await rememberMeModel.deleteOne({id: data.rememberme.id})
|
|
|
|
//Tell the client to drop the token
|
|
res.clearCookie("rememberme.id");
|
|
res.clearCookie("rememberme.token");
|
|
}
|
|
|
|
//If the user requested a rememberMe token (I'm not validation checking a fucking boolean)
|
|
if(req.body.rememberMe){
|
|
//Gen user token
|
|
//requires second DB call, but this enforces password requirement for toke generation while ensuring we only
|
|
//need one function in the userModel for authentication, even if the second woulda just been a wrapper.
|
|
//Less attack surface is less attack surface, and this isn't something thats going to be getting constantly called
|
|
const authToken = await rememberMeModel.genToken(userDB, data.pass);
|
|
|
|
//If we properly authed
|
|
if(authToken != null){
|
|
//Check config for protocol
|
|
const secure = config.protocol.toLowerCase() == "https";
|
|
|
|
//Create expiration date for cookies (180 days)
|
|
const expires = new Date(Date.now() + (1000 * 60 * 60 * 24 * 180));
|
|
|
|
//Set remember me ID and token as browser-side cookies for safe-keeping
|
|
res.cookie("rememberme.id", authToken.id, {sameSite: 'strict', httpOnly: true, secure, expires});
|
|
//This should be the servers last interaction with the plaintext token before saving the hashed copy, and dropping it out of RAM
|
|
res.cookie("rememberme.token", authToken.token, {sameSite: 'strict', httpOnly: true, secure, expires});
|
|
}
|
|
}
|
|
|
|
//Tell the browser everything is dandy
|
|
return res.sendStatus(200);
|
|
}else{
|
|
res.status(400);
|
|
return res.send({errors: validResult.array()})
|
|
}
|
|
}catch(err){
|
|
//Check validation results
|
|
const validResult = validationResult(req);
|
|
|
|
//if we don't have errors
|
|
if(validResult.isEmpty()){
|
|
//Get login attempts for current user
|
|
const {user, pass} = matchedData(req);
|
|
|
|
//Look for the username in the migration DB
|
|
const migrationDB = await migrationModel.findOne({user});
|
|
|
|
//If we found a migration profile
|
|
if(migrationDB != null){
|
|
//If the user has a good password
|
|
if(hashUtils.compareLegacyPassword(pass, migrationDB.pass)){
|
|
//Redirect to migrate
|
|
return res.sendStatus(301);
|
|
}
|
|
}
|
|
|
|
//Get login attempts
|
|
const attempts = sessionUtils.getLoginAttempts(user)
|
|
|
|
//if we've gone over max attempts
|
|
if(attempts != null && attempts.count > sessionUtils.throttleAttempts){
|
|
//tell client it needs a captcha
|
|
return res.sendStatus(429);
|
|
}else{
|
|
//Scream about any un-caught errors
|
|
return exceptionHandler(res, err);
|
|
}
|
|
}else{
|
|
res.status(400);
|
|
return res.send({errors: validResult.array()})
|
|
}
|
|
}
|
|
|
|
} |