286 lines
8.8 KiB
TypeScript
Executable File
286 lines
8.8 KiB
TypeScript
Executable File
"use strict";
|
|
|
|
import express from "express";
|
|
import config from "config";
|
|
import { sendVerifyMail, sendPasswordChangedMail } from "../lib/mail";
|
|
import crypto from "crypto";
|
|
|
|
const router = express.Router();
|
|
|
|
let userDB: any;
|
|
|
|
import("../db/users.js").then(function(db: any) {
|
|
userDB = db;
|
|
});
|
|
|
|
router.get("/", function(req: express.Request, res: express.Response/*, next*/) {
|
|
console.log("/users/");
|
|
return getSessionUser(req).then((user) => {
|
|
return res.status(200).send(user);
|
|
}).catch((error) => {
|
|
console.log("User not logged in: " + error);
|
|
return res.status(200).send({});
|
|
});
|
|
});
|
|
|
|
router.put("/password", function(req: express.Request, res: express.Response) {
|
|
console.log("/users/password");
|
|
const q = req.query as any;
|
|
const changes = {
|
|
currentPassword: q.c || req.body.c,
|
|
newPassword: q.n || req.body.n
|
|
};
|
|
|
|
if (!changes.currentPassword || !changes.newPassword) {
|
|
return res.status(400).send("Missing current password and/or new password.");
|
|
}
|
|
|
|
if (changes.currentPassword == changes.newPassword) {
|
|
return res.status(400).send("Attempt to set new password to current password.");
|
|
}
|
|
|
|
return getSessionUser(req).then(function(user: any) {
|
|
return userDB.sequelize.query("SELECT id FROM users " +
|
|
"WHERE uid=:username AND password=:password", {
|
|
replacements: {
|
|
username: user.username,
|
|
password: crypto.createHash('sha256').update(changes.currentPassword).digest('base64')
|
|
},
|
|
type: userDB.Sequelize.QueryTypes.SELECT,
|
|
raw: true
|
|
}).then(function(users: any) {
|
|
if (users.length != 1) {
|
|
return null;
|
|
}
|
|
return user;
|
|
});
|
|
}).then(function(user: any) {
|
|
if (!user) {
|
|
console.log("Invalid password");
|
|
/* Invalid password */
|
|
res.status(401).send("Invalid password");
|
|
return null;
|
|
}
|
|
|
|
return userDB.sequelize.query("UPDATE users SET password=:password WHERE uid=:username", {
|
|
replacements: {
|
|
username: user.username,
|
|
password: crypto.createHash('sha256').update(changes.newPassword).digest('base64')
|
|
}
|
|
}).then(function() {
|
|
console.log("Password changed for user " + user.username + " to '" + changes.newPassword + "'.");
|
|
|
|
res.status(200).send(user);
|
|
user.id = req.session.userId;
|
|
return sendPasswordChangedMail(userDB, req, user);
|
|
});
|
|
});
|
|
});
|
|
|
|
router.post("/create", function(req: express.Request, res: express.Response) {
|
|
console.log("/users/create");
|
|
const q = req.query as any;
|
|
const user = {
|
|
uid: q.m || req.body.m,
|
|
displayName: q.n || req.body.n || "",
|
|
password: q.p || req.body.p || "",
|
|
mail: q.m || req.body.m,
|
|
notes: q.w || req.body.w || ""
|
|
};
|
|
|
|
if (!user.uid || !user.password || !user.displayName || !user.notes) {
|
|
return res.status(400).send("Missing email address, password, name, and/or who you know.");
|
|
}
|
|
|
|
user.password = crypto.createHash('sha256').update(user.password).digest('base64');
|
|
|
|
return userDB.sequelize.query("SELECT * FROM users WHERE uid=:uid", {
|
|
replacements: user,
|
|
type: userDB.Sequelize.QueryTypes.SELECT,
|
|
raw: true
|
|
}).then(function(results: any) {
|
|
if (results.length != 0) {
|
|
return res.status(400).send("Email address already used.");
|
|
}
|
|
|
|
let re = /^(([^<>()\[\]\\.,;:\s@\"]+(\.[^<>()\[\]\\.,;:\s@\"]+)*)|(\".+\"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/;
|
|
if (!re.exec(user.mail)) {
|
|
console.log("Invalid email address: " + user.mail);
|
|
throw "Invalid email address.";
|
|
}
|
|
return;
|
|
}).then(function() {
|
|
return userDB.sequelize.query("INSERT INTO users " +
|
|
"(uid,displayName,password,mail,memberSince,authenticated,notes) " +
|
|
"VALUES(:uid,:displayName,:password,:mail,CURRENT_TIMESTAMP,0,:notes)", {
|
|
replacements: user
|
|
}).spread(function(_results: any, metadata: any) {
|
|
req.session.userId = metadata.lastID;
|
|
}).then(function() {
|
|
return getSessionUser(req).then(function(user: any) {
|
|
res.status(200).send(user);
|
|
user.id = req.session.userId;
|
|
return sendVerifyMail(userDB, req, user);
|
|
});
|
|
}).catch(function(error: any) {
|
|
console.log("Error creating account: ", error);
|
|
return res.status(401).send(error);
|
|
});
|
|
});
|
|
});
|
|
|
|
const getSessionUser = function(req: express.Request): Promise<any> {
|
|
return Promise.resolve().then(function() {
|
|
if (!req.session || !req.session.userId) {
|
|
throw "Unauthorized. You must be logged in.";
|
|
}
|
|
|
|
let query = "SELECT " +
|
|
"uid AS username,displayName,mailVerified,authenticated,memberSince AS name,mail " +
|
|
"FROM users WHERE id=:id";
|
|
return userDB.sequelize.query(query, {
|
|
replacements: {
|
|
id: req.session.userId
|
|
},
|
|
type: userDB.Sequelize.QueryTypes.SELECT,
|
|
raw: true
|
|
}).then(function(results: any) {
|
|
if (results.length != 1) {
|
|
throw "Invalid account.";
|
|
}
|
|
|
|
let user = results[0];
|
|
|
|
if (!user.mailVerified) {
|
|
user.restriction = user.restriction || "Email address not verified.";
|
|
return user;
|
|
}
|
|
|
|
if (!user.authenticated) {
|
|
user.restriction = user.restriction || "Accout not authorized.";
|
|
return user;
|
|
}
|
|
|
|
return user;
|
|
});
|
|
}).then(function(user: any) {
|
|
req.user = user;
|
|
|
|
/* If the user already has a restriction, or there are no album user restrictions,
|
|
* return the user to the next promise */
|
|
if (user.restriction || !config.has("restrictions")) {
|
|
return user;
|
|
}
|
|
|
|
let allowed: any = config.get("restrictions");
|
|
if (!Array.isArray(allowed)) {
|
|
allowed = [ allowed ];
|
|
}
|
|
for (let i = 0; i < allowed.length; i++) {
|
|
if (allowed[i] == user.username) {
|
|
return user;
|
|
}
|
|
}
|
|
console.log("Unauthorized (logged in) access by user: " + user.username);
|
|
user.restriction = "Unauthorized access attempt to restricted album.";
|
|
|
|
return user;
|
|
}).then(function(user) {
|
|
/* If there are maintainers on this album, check if this user is a maintainer */
|
|
if (config.has("maintainers")) {
|
|
let maintainers: any = config.get("maintainers");
|
|
if (Array.isArray(maintainers) && maintainers.indexOf(user.username) != -1) {
|
|
user.maintainer = true;
|
|
if (user.restriction) {
|
|
console.warn("User " + user.username + " is a maintainer AND has a restriction which will be ignored: " + user.restriction);
|
|
delete user.restriction;
|
|
}
|
|
}
|
|
}
|
|
|
|
return user;
|
|
}).then(function(user) {
|
|
/* Strip out any fields that shouldn't be there. The allowed fields are: */
|
|
let allowed = [
|
|
"maintainer", "username", "displayName", "mailVerified", "authenticated", "name", "mail", "restriction"
|
|
];
|
|
for (let field in user) {
|
|
if (allowed.indexOf(field) == -1) {
|
|
delete user[field];
|
|
}
|
|
}
|
|
return user;
|
|
});
|
|
}
|
|
|
|
router.post("/login", function(req: express.Request, res: express.Response) {
|
|
console.log("/users/login");
|
|
const q = req.query as any;
|
|
|
|
let username = q.u || req.body.u || "",
|
|
password = q.p || req.body.p || "";
|
|
|
|
console.log("Login attempt");
|
|
|
|
if (!username || !password) {
|
|
return res.status(400).send("Missing username and/or password");
|
|
}
|
|
|
|
return new Promise((resolve, _reject) => {
|
|
console.log("Looking up user in DB.");
|
|
let query = "SELECT " +
|
|
"id,mailVerified,authenticated,uid AS username,displayName AS name,mail " +
|
|
"FROM users WHERE uid=:username AND password=:password";
|
|
return userDB.sequelize.query(query, {
|
|
replacements: {
|
|
username: username,
|
|
password: crypto.createHash('sha256').update(password).digest('base64')
|
|
},
|
|
type: userDB.Sequelize.QueryTypes.SELECT
|
|
}).then(function(users: any) {
|
|
if (users.length != 1) {
|
|
return resolve(null);
|
|
}
|
|
let user = users[0];
|
|
req.session.userId = user.id;
|
|
return resolve(user);
|
|
});
|
|
}).then(function(user: any) {
|
|
if (!user) {
|
|
console.log(username + " not found (or invalid password.)");
|
|
req.session.userId = null;
|
|
return res.status(401).send("Invalid login credentials");
|
|
}
|
|
|
|
let message = "Logged in as " + user.username + " (" + user.id + ")";
|
|
if (!user.mailVerified) {
|
|
console.log(message + ", who is not verified email.");
|
|
} else if (!user.authenticated) {
|
|
console.log(message + ", who is not authenticated.");
|
|
} else {
|
|
console.log(message);
|
|
}
|
|
|
|
return getSessionUser(req).then(function(user: any) {
|
|
return res.status(200).send(user);
|
|
});
|
|
}).catch(function(error) {
|
|
console.log(error);
|
|
return res.status(403).send(error);
|
|
});
|
|
});
|
|
|
|
router.get("/logout", function(req, res) {
|
|
console.log("/users/logout");
|
|
|
|
if (req.session && req.session.userId) {
|
|
req.session.userId = null;
|
|
}
|
|
res.status(200).send({});
|
|
});
|
|
|
|
export {
|
|
router,
|
|
getSessionUser
|
|
};
|