fix: compliance of api methods
Massimo Melina committed
Jan 11, 2022 at 14:59 UTC
f87dd3c611056c3dd7d0377d57e1d2a4e8af0e72
2 files changed
+20
-12
src/api.auth.ts
+18
-11
@@ -26,8 +26,9 @@ export const login: ApiHandler = async ({ username, password }, ctx) => {
26
return new ApiError(406)
27
if (!await verifyPassword(acc.hashed_password, password))
28
return new ApiError(401)
29
- if (ctx.session)
30
- ctx.session.username = username
29
+ if (!ctx.session)
30
+ return new ApiError(500)
31
+ ctx.session.username = username
32
return makeExp()
33
}
34
@@ -37,7 +38,7 @@ export const loginSrp1: ApiHandler = async ({ username }, ctx) => {
38
username = username.toLocaleLowerCase()
39
const account = getAccount(username)
40
if (!ctx.session)
40
- return ctx.throw(500)
41
+ return new ApiError(500)
42
if (!account) // TODO simulate fake account to prevent knowing valid usernames
43
return new ApiError(401)
44
if (!account.srp)
@@ -55,7 +56,7 @@ export const loginSrp1: ApiHandler = async ({ username }, ctx) => {
56
57
export const loginSrp2: ApiHandler = async ({ pubKey, proof }, ctx) => {
58
if (!ctx.session)
58
- return ctx.throw(500)
59
+ return new ApiError(500)
60
const { username, sid } = ctx.session.login
61
const step1 = ongoingLogins[sid]
62
try {
@@ -66,17 +67,23 @@ export const loginSrp2: ApiHandler = async ({ pubKey, proof }, ctx) => {
67
catch(e) {
68
return new ApiError(401, String(e))
69
}
70
+ finally {
71
+ delete ongoingLogins[sid]
72
+ delete ctx.session.login
73
+ }
74
}
75
76
export const logout: ApiHandler = async ({}, ctx) => {
72
- if (ctx.session)
73
- ctx.session.username = undefined
74
- ctx.status = 200
75
- return true
77
+ if (!ctx.session)
78
+ return new ApiError(500)
79
+ delete ctx.session.username
80
+ return {}
81
}
82
83
export const refresh_session: ApiHandler = async ({}, ctx) => {
79
- return { username: ctx.session?.username, ...makeExp() }
84
+ if (!ctx.session)
85
+ return new ApiError(500)
86
+ return { username: ctx.session.username, ...makeExp() }
87
}
88
89
export const change_password: ApiHandler = async ({ newPassword }, ctx) => {
@@ -87,7 +94,7 @@ export const change_password: ApiHandler = async ({ newPassword }, ctx) => {
94
await updateAccount(ctx.account, account => {
95
account.password = newPassword
96
})
90
- return true
97
+ return {}
98
}
99
100
export const change_srp: ApiHandler = async ({ salt, verifier }, ctx) => {
@@ -101,6 +108,6 @@ export const change_srp: ApiHandler = async ({ salt, verifier }, ctx) => {
108
saveSrpInfo(account, salt, verifier)
109
delete account.hashed_password // remove leftovers
110
})
104
- return true
111
+ return {}
112
}
113
todo.md
+2
-1
@@ -3,8 +3,9 @@
3
- update tests to SRP login
4
- anti-csrf
5
- upload
6
-- delete
6
+- upload unzipping (while streaming?)
7
- https
8
+- delete
9
- updater (stop,unzip,start)
10
- search and login dialogs should push to history so that mobile can use back button to close them
11
- node.comment