Sven laptop
45 lines
1.4 KiB
JavaScript
45 lines
1.4 KiB
JavaScript
const express = require('express');
|
|
const router = express.Router();
|
|
const pool = require('../../db');
|
|
const crypto = require('crypto');
|
|
const { promisify } = require('util');
|
|
const { sanitizeLoginInput } = require('../../middleware/sanitize_person_input');
|
|
|
|
const scrypt = promisify(crypto.scrypt);
|
|
|
|
async function login(req, res) {
|
|
try {
|
|
const { email, password } = req.loginInput;
|
|
const { rows } = await pool.query(
|
|
'SELECT id, password FROM people WHERE email = $1',
|
|
[email]
|
|
);
|
|
|
|
if (rows.length === 0) {
|
|
res.status(401).send('Invalid email or password');
|
|
return;
|
|
}
|
|
|
|
const [salt, storedKeyHex] = rows[0].password.split(':');
|
|
const storedKey = Buffer.from(storedKeyHex || '', 'hex');
|
|
const derivedKey = await scrypt(password, salt, 64);
|
|
|
|
if (
|
|
storedKey.length !== derivedKey.length ||
|
|
!crypto.timingSafeEqual(storedKey, derivedKey)
|
|
) {
|
|
res.status(401).send('Invalid email or password');
|
|
return;
|
|
}
|
|
|
|
res.status(200).json({ id: rows[0].id });
|
|
}
|
|
catch (err) {
|
|
console.error('login failed', { message: err.message, code: err.code });
|
|
res.status(500).send('Login failed, request could not be completed');
|
|
}
|
|
};
|
|
|
|
router.post('/', sanitizeLoginInput, login);
|
|
module.exports = router;
|