ctx.account
Massimo Melina committed
Jan 10, 2022 at 10:55 UTC
a79bc7cbde99a865c4ddd2abdcf73e0104052dc3
3 files changed
+21
-10
src/api.auth.ts
+9
-3
@@ -1,4 +1,4 @@
1
-import { getAccount, getCurrentUsername, saveSrpInfo, updateAccount } from './perm'
1
+import { getAccount, saveSrpInfo, updateAccount } from './perm'
2
import { verifyPassword } from './crypt'
3
import { CFG_ALLOW_CLEAR_TEXT_LOGIN, getConfig } from './config'
4
import { ApiHandler } from './apis'
@@ -32,6 +32,8 @@ export const login: ApiHandler = async ({ username, password }, ctx) => {
32
}
33
34
export const loginSrp1: ApiHandler = async ({ username }, ctx) => {
35
+ if (!username)
36
+ return ctx.status = 400
37
username = username.toLocaleLowerCase()
38
const account = getAccount(username)
39
if (!ctx.session)
@@ -81,7 +83,9 @@ export const refresh_session: ApiHandler = async ({}, ctx) => {
83
export const change_password: ApiHandler = async ({ newPassword }, ctx) => {
84
if (!newPassword) // clear text version
85
return Error('missing parameters')
84
- await updateAccount(await getCurrentUsername(ctx), account => {
86
+ if (!ctx.account)
87
+ return ctx.status = 401
88
+ await updateAccount(ctx.account, account => {
89
account.password = newPassword
90
})
91
return true
@@ -92,7 +96,9 @@ export const change_srp: ApiHandler = async ({ salt, verifier }, ctx) => {
96
return ctx.status = 406
97
if (!salt || !verifier)
98
return Error('missing parameters')
95
- await updateAccount(await getCurrentUsername(ctx), account => {
99
+ if (!ctx.account)
100
+ return ctx.status = 401
101
+ await updateAccount(ctx.account, account => {
102
saveSrpInfo(account, salt, verifier)
103
delete account.hashedPassword // remove leftovers
104
})
src/index.ts
+5
@@ -17,6 +17,7 @@ import { frontEndApis } from './frontEndApis'
17
import { log } from './log'
18
import { pluginsMiddleware } from './plugins'
19
import { throttler } from './throttler'
20
+import { getAccount, getCurrentUsername } from './perm'
21
22
const BUILD_TIMESTAMP = ""
23
@@ -32,6 +33,10 @@ app.use(session({
33
rolling: true,
34
maxAge: SESSION_DURATION,
35
}, app))
36
+app.use(async (ctx, next) => {
37
+ ctx.account = getAccount(getCurrentUsername(ctx))
38
+ await next()
39
+})
40
app.use(log())
41
app.use(pluginsMiddleware())
42
app.use(throttler())
src/perm.ts
+7
-7
@@ -21,13 +21,13 @@ interface Accounts { [username:string]: Account }
21
22
let accounts: Accounts = {}
23
24
-export async function getCurrentUsername(ctx: Koa.Context) {
24
+export function getCurrentUsername(ctx: Koa.Context): string {
25
return ctx.session?.username || ''
26
}
27
28
// provides the username and all other usernames it inherits based on the 'belongs' attribute. Useful to check permissions
29
export async function getCurrentUsernameExpanded(ctx: Koa.Context) {
30
- const who = await getCurrentUsername(ctx)
30
+ const who = getCurrentUsername(ctx)
31
if (!who)
32
return []
33
const ret = [who]
@@ -39,8 +39,8 @@ export async function getCurrentUsernameExpanded(ctx: Koa.Context) {
39
return ret
40
}
41
42
-export function getAccount(username:string) : Account {
43
- return accounts[username]
42
+export function getAccount(username:string) : Account | undefined {
43
+ return username ? accounts[username] : undefined
44
}
45
46
export function saveSrpInfo(account:Account, salt:string | bigint, verifier: string | bigint) {
@@ -50,10 +50,10 @@ export function saveSrpInfo(account:Account, salt:string | bigint, verifier: str
50
const srp6aNimbusRoutines = new SRPRoutines(new SRPParameters())
51
52
type Changer = (account:Account)=> void | Promise<void>
53
-export async function updateAccount(username: string, changer?:Changer) {
54
- const account = getAccount(username)
53
+export async function updateAccount(account: Account, changer?:Changer) {
54
const was = JSON.stringify(account)
55
await changer?.(account)
56
+ const { username } = account
57
if (account.password) {
58
console.debug('hashing password for', username)
59
if (getConfig(CFG_ALLOW_CLEAR_TEXT_LOGIN))
@@ -110,6 +110,6 @@ async function applyAccounts(newAccounts:Accounts) {
110
k = lc
111
}
112
setHidden(rec, { username: k })
113
- await updateAccount(k)
113
+ await updateAccount(rec)
114
}))
115
}