Add CORS and move registration policies to middleware

features/people/LOGIN_people.js

@@ -0,0 +1,44 @@
+const express = require('express');
+const router = express.Router();
+const pool = require('../../db');
+const crypto = require('crypto');
+const { promisify } = require('util');
+const { sanitizeLoginInput } = require('../../middleware/sanitize_person_input');
+
+const scrypt = promisify(crypto.scrypt);
+
+async function login(req, res) {
+    try {
+        const { email, password } = req.loginInput;
+        const { rows } = await pool.query(
+            'SELECT id, password FROM people WHERE email = $1',
+            [email]
+        );
+
+        if (rows.length === 0) {
+            res.status(401).send('Invalid email or password');
+            return;
+        }
+
+        const [salt, storedKeyHex] = rows[0].password.split(':');
+        const storedKey = Buffer.from(storedKeyHex || '', 'hex');
+        const derivedKey = await scrypt(password, salt, 64);
+
+        if (
+            storedKey.length !== derivedKey.length ||
+            !crypto.timingSafeEqual(storedKey, derivedKey)
+        ) {
+            res.status(401).send('Invalid email or password');
+            return;
+        }
+
+        res.status(200).json({ id: rows[0].id });
+    }
+    catch (err) {
+        console.error('login failed', { message: err.message, code: err.code });
+        res.status(500).send('Login failed, request could not be completed');
+    }
+};
+
+router.post('/', sanitizeLoginInput, login);
+module.exports = router;