Added liking and security measures

features/people/LOGIN_people.js

@@ -9,15 +9,20 @@ const { signToken } = require('../../middleware/authenticate_token');
 
 const scrypt = promisify(crypto.scrypt);
 
+// Fixed salt for unknown emails: the scrypt work is still performed so the
+// response time does not reveal whether the email address exists.
+const DUMMY_SALT = '00000000000000000000000000000000';
+
 async function login(req, res) {
     try {
         const { email, password } = req.loginInput;
         const { rows } = await pool.query(
-            'SELECT id, password FROM people WHERE email = $1',
+            'SELECT id, password, token_version FROM people WHERE email = $1',
             [email]
         );
 
         if (rows.length === 0) {
+            await scrypt(password, DUMMY_SALT, 64);
             res.status(401).send('Invalid email or password');
             return;
         }
@@ -34,7 +39,17 @@ async function login(req, res) {
             return;
         }
 
-        const { token, expiresAt } = signToken(rows[0].id);
+        const sessionId = crypto.randomUUID();
+        const deviceName = (req.headers['user-agent'] || 'unknown').slice(0, 255);
+        await pool.query(
+            'INSERT INTO sessions (id, user_id, device_name) VALUES ($1, $2, $3)',
+            [sessionId, rows[0].id, deviceName],
+        );
+
+        const { token, expiresAt } = signToken(rows[0].id, {
+            jti: sessionId,
+            tokenVersion: rows[0].token_version,
+        });
         res.cookie('fc_session_token', token, {
             httpOnly: true,
             secure: true,