Add CORS and move registration policies to middleware

features/people/CREATE_people.js

@@ -1,43 +0,0 @@
-const express = require('express');
-const router = express.Router();
-var driver = require('../../graph_db');
-const pool = require('../../db');
-
-
-
-async function create_people(req, res) {
-    const { name, age, gender } = req.body;
-    try {
-        const { records } = await driver.executeQuery('Create (p:Person {name: $name, age: $age, gender: $gender})', { name: name, age: age, gender: gender }, { database: process.env.GRAPH_DB_NAME});
-    }
-    catch (err) {
-        console.error('database query failed', {
-            message: err.message,
-            code: err.code,
-            detail: err.detail,
-            hint: err.hint,
-            stack: err.stack,
-        });
-        res.status(500).send('Data was not pushed to graph database, request failed');
-    }
-    try {
-        const { rows } = await pool.query('INSERT INTO people (name, age, gender) VALUES ($1, $2, $3)', [name, age, gender]);
-        console.log(rows[0]);
-        res.status(200).send('Data has been pushed to both databases');
-        res.json(rows[0]);
-    }
-    catch (err) {
-        console.error('database query failed', {
-            message: err.message,
-            code: err.code,
-            detail: err.detail,
-            hint: err.hint,
-            stack: err.stack,
-        });
-        res.status(500).send('Data was not pushed to database, request failed');
-    }
-};
-
-
-router.post('/', create_people);
-module.exports = router;

features/people/LOGIN_people.js

@@ -0,0 +1,44 @@
+const express = require('express');
+const router = express.Router();
+const pool = require('../../db');
+const crypto = require('crypto');
+const { promisify } = require('util');
+const { sanitizeLoginInput } = require('../../middleware/sanitize_person_input');
+
+const scrypt = promisify(crypto.scrypt);
+
+async function login(req, res) {
+    try {
+        const { email, password } = req.loginInput;
+        const { rows } = await pool.query(
+            'SELECT id, password FROM people WHERE email = $1',
+            [email]
+        );
+
+        if (rows.length === 0) {
+            res.status(401).send('Invalid email or password');
+            return;
+        }
+
+        const [salt, storedKeyHex] = rows[0].password.split(':');
+        const storedKey = Buffer.from(storedKeyHex || '', 'hex');
+        const derivedKey = await scrypt(password, salt, 64);
+
+        if (
+            storedKey.length !== derivedKey.length ||
+            !crypto.timingSafeEqual(storedKey, derivedKey)
+        ) {
+            res.status(401).send('Invalid email or password');
+            return;
+        }
+
+        res.status(200).json({ id: rows[0].id });
+    }
+    catch (err) {
+        console.error('login failed', { message: err.message, code: err.code });
+        res.status(500).send('Login failed, request could not be completed');
+    }
+};
+
+router.post('/', sanitizeLoginInput, login);
+module.exports = router;

features/people/REGISTER_people.js

@@ -0,0 +1,88 @@
+const express = require('express');
+const router = express.Router();
+var driver = require('../../graph_db');
+const pool = require('../../db');
+var crypto = require('crypto');
+const { promisify } = require('util');
+const { sanitizePersonInput } = require('../../middleware/sanitize_person_input');
+
+const scrypt = promisify(crypto.scrypt);
+
+async function insert_db( name, username, email, password ) {
+    const salt = crypto.randomBytes(16).toString('hex');
+    const derivedKey = await scrypt(password, salt, 64);
+    const hashed_password = `${salt}:${derivedKey.toString('hex')}`;
+
+    try {
+        const { rows } = await pool.query(
+            'INSERT INTO people (name, username, email, password) VALUES ($1, $2, $3, $4) RETURNING id',
+            [name, username, email, hashed_password]
+        );
+
+        return rows[0].id;
+    }
+    catch (err) {
+        console.error('database query failed', {
+            message: err.message,
+            code: err.code,
+            detail: err.detail,
+            hint: err.hint,
+            stack: err.stack,
+        });
+        throw err;
+    }
+};
+
+async function insert_graph_db( name, username, db_id ) {
+    try {
+        await driver.executeQuery(
+            'CREATE (p:Person {db_id: $db_id, name: $name, username: $username})',
+            { db_id, name, username },
+            { database: process.env.GRAPH_DB_NAME }
+        );
+    }
+    catch (err) {
+        console.error('database query failed', {
+            message: err.message,
+            code: err.code,
+            detail: err.detail,
+            hint: err.hint,
+            stack: err.stack,
+        });
+        throw err;
+    }
+};
+
+
+
+
+
+async function create_people(req, res) {
+    const person = req.person;
+    let db_id;
+
+    try {
+        db_id = await insert_db(
+            person.name,
+            person.username,
+            person.email,
+            person.password
+        );
+    }
+    catch (err) {
+        res.status(500).send('Data was not pushed to database, request failed');
+        return;
+    }
+
+    try {
+        await insert_graph_db(person.name, person.username, db_id);
+        res.status(201).json({ id: db_id });
+    }
+    catch (err) {
+        res.status(500).send('Data was not pushed to graph database, request failed');
+    }
+};
+
+
+router.post('/', sanitizePersonInput, create_people);
+module.exports = router;