sync/lib/web/auth.js

328 lines
8.7 KiB
JavaScript
Raw Normal View History

/**
* web/auth.js - Webserver functions for user authentication and registration
*
* @author Calvin Montgomery <cyzon@cyzon.us>
*/
2014-01-20 18:42:20 +00:00
var jade = require("jade");
var path = require("path");
var webserver = require("./webserver");
2014-02-25 00:25:49 +00:00
var cookieall = webserver.cookieall;
2014-01-20 18:42:20 +00:00
var sendJade = require("./jade").sendJade;
var Logger = require("../logger");
var $util = require("../utilities");
var db = require("../database");
2014-02-06 00:05:52 +00:00
var Config = require("../config");
var url = require("url");
/**
* Processes a login request. Sets a cookie upon successful authentication
*/
function handleLogin(req, res) {
var name = req.body.name;
var password = req.body.password;
2014-01-20 18:42:20 +00:00
if (typeof name !== "string" || typeof password !== "string") {
res.send(400);
return;
}
password = password.substring(0, 100);
2013-12-12 23:09:49 +00:00
db.users.verifyLogin(name, password, function (err, user) {
if (err) {
2014-01-20 18:42:20 +00:00
if (err === "Invalid username/password combination") {
2014-01-28 00:37:48 +00:00
Logger.eventlog.log("[loginfail] Login failed (bad password): " + name
2014-01-20 18:42:20 +00:00
+ "@" + webserver.ipForRequest(req));
}
2014-01-20 18:42:20 +00:00
sendJade(res, "login", {
loggedIn: false,
loginError: err
});
} else {
var auth = user.name + ":" + user.hash;
2014-03-03 04:00:24 +00:00
res.cookie("auth", auth, {
expires: new Date(Date.now() + 7*24*60*60*1000),
httpOnly: true
});
res.cookie("auth", auth, {
2014-03-01 23:37:59 +00:00
domain: Config.get("http.root-domain-dotted"),
2014-01-25 22:39:16 +00:00
expires: new Date(Date.now() + 7*24*60*60*1000),
httpOnly: true
});
2014-01-20 18:42:20 +00:00
res.cookie("rank", user.global_rank, {
2014-03-01 23:37:59 +00:00
domain: Config.get("http.root-domain-dotted"),
2014-02-16 05:17:31 +00:00
expires: new Date(Date.now() + 7*24*60*60*1000),
});
2014-01-20 18:42:20 +00:00
// Try to find an appropriate redirect
var ref = req.header("referrer");
if (!ref) {
ref = req.body.redirect;
}
if (typeof ref !== "string") {
ref = "";
}
// Redirect to shim cookie layer if the host doesn't match
try {
var data = url.parse(ref);
if (data.host.indexOf(Config.get("http.root-domain")) === -1) {
var host = data.host.replace(/:\d+$/, "");
if (Config.get("http.alt-domains").indexOf(host) === -1) {
Logger.syslog.log("WARNING: Attempted login from non-approved "+
"domain " + host);
} else {
var dest = "/shimcookie?auth=" + encodeURIComponent(auth) +
"&rank=" + encodeURIComponent(user.global_rank) +
"&redirect=" + encodeURIComponent(ref);
res.redirect(data.protocol + "//" + data.host + dest);
return;
}
}
} catch (e) {
}
2014-01-20 18:42:20 +00:00
if (ref.match(/login|logout/)) {
ref = "";
}
if (ref) {
res.redirect(ref);
} else {
sendJade(res, "login", {
loggedIn: true,
loginName: user.name
});
}
}
});
}
function handleShimCookie(req, res) {
var auth = req.query.auth;
var rank = req.query.rank;
var redirect = req.query.redirect;
if (typeof auth !== "string" || typeof redirect !== "string" ||
typeof rank !== "string") {
res.send(400);
return;
}
res.cookie("auth", auth, {
expires: new Date(Date.now() + 7*24*60*60*1000),
httpOnly: true
});
res.cookie("rank", rank, {
expires: new Date(Date.now() + 7*24*60*60*1000),
});
if (redirect.match(/login|logout/)) {
redirect = "";
}
if (redirect) {
res.redirect(redirect);
} else {
sendJade(res, "login", {
loggedIn: true,
loginName: auth.split(":")[0]
});
}
}
function handleShimLogout(req, res) {
var redirect = req.query.redirect;
if (typeof redirect !== "string") {
res.send(400);
return;
}
res.clearCookie("auth");
res.clearCookie("rank");
2014-03-01 23:37:59 +00:00
res.clearCookie("auth", { domain: Config.get("http.root-domain-dotted") });
res.clearCookie("rank", { domain: Config.get("http.root-domain-dotted") });
if (redirect.match(/login|logout/)) {
redirect = "";
}
if (redirect) {
res.redirect(redirect);
} else {
sendJade(res, "logout", {});
}
}
/**
* Handles a GET request for /login
*/
function handleLoginPage(req, res) {
2014-01-23 03:12:43 +00:00
if (webserver.redirectHttps(req, res)) {
return;
}
if (req.cookies.auth) {
2014-01-20 18:42:20 +00:00
var split = req.cookies.auth.split(":");
if (split.length === 2) {
2014-01-20 18:42:20 +00:00
sendJade(res, "login", {
wasAlreadyLoggedIn: true,
loggedIn: true,
loginName: split[0]
});
return;
}
}
2014-01-20 18:42:20 +00:00
sendJade(res, "login", {
2013-12-27 16:08:03 +00:00
loggedIn: false,
2014-01-20 18:42:20 +00:00
redirect: req.header("Referrer")
});
}
/**
* Handles a request for /logout. Clears auth cookie
*/
function handleLogout(req, res) {
2014-01-20 18:42:20 +00:00
res.clearCookie("auth");
res.clearCookie("rank");
2014-01-20 18:42:20 +00:00
// Try to find an appropriate redirect
var ref = req.header("referrer");
if (!ref) {
ref = req.query.redirect;
2014-01-20 18:42:20 +00:00
}
if (typeof ref !== "string") {
ref = "";
}
var host = req.hostname;
if (host.indexOf(Config.get("http.root-domain")) !== -1) {
2014-03-01 23:37:59 +00:00
res.clearCookie("auth", { domain: Config.get("http.root-domain-dotted") });
res.clearCookie("rank", { domain: Config.get("http.root-domain-dotted") });
} else {
var dest = Config.get("http.full-address") + "/shimlogout?redirect=" +
encodeURIComponent(ref);
res.redirect(dest);
return;
}
2014-01-20 18:42:20 +00:00
if (ref.match(/login|logout/)) {
ref = "";
}
if (ref) {
res.redirect(ref);
} else {
sendJade(res, "logout", {});
}
}
/**
* Handles a GET request for /register
*/
function handleRegisterPage(req, res) {
2014-01-23 03:12:43 +00:00
if (webserver.redirectHttps(req, res)) {
return;
}
if (req.cookies.auth) {
2014-01-20 18:42:20 +00:00
var split = req.cookies.auth.split(":");
if (split.length === 2) {
2014-01-20 18:42:20 +00:00
sendJade(res, "register", {
loggedIn: true,
loginName: split[0]
});
return;
}
}
2014-02-10 01:52:24 +00:00
2014-01-20 18:42:20 +00:00
sendJade(res, "register", {
registered: false,
registerError: false
});
}
/**
* Processes a registration request.
*/
function handleRegister(req, res) {
var name = req.body.name;
var password = req.body.password;
var email = req.body.email;
2014-01-20 18:42:20 +00:00
if (typeof email !== "string") {
email = "";
}
var ip = webserver.ipForRequest(req);
2014-01-20 18:42:20 +00:00
if (typeof name !== "string" || typeof password !== "string") {
res.send(400);
return;
}
if (name.length === 0) {
2014-01-20 18:42:20 +00:00
sendJade(res, "register", {
registerError: "Username must not be empty"
});
return;
}
2014-02-06 00:05:52 +00:00
if (name.match(Config.get("reserved-names.usernames"))) {
sendJade(res, "register", {
registerError: "That username is reserved"
});
return;
}
if (password.length === 0) {
2014-01-20 18:42:20 +00:00
sendJade(res, "register", {
registerError: "Password must not be empty"
});
return;
}
password = password.substring(0, 100);
2013-12-27 03:15:54 +00:00
if (email.length > 0 && !$util.isValidEmail(email)) {
2014-01-20 18:42:20 +00:00
sendJade(res, "register", {
registerError: "Invalid email address"
});
return;
}
2013-12-26 03:30:24 +00:00
db.users.register(name, password, email, ip, function (err) {
if (err) {
2014-01-20 18:42:20 +00:00
sendJade(res, "register", {
registerError: err
});
} else {
2014-01-28 00:37:48 +00:00
Logger.eventlog.log("[register] " + ip + " registered account: " + name +
2014-01-20 18:42:20 +00:00
(email.length > 0 ? " <" + email + ">" : ""));
sendJade(res, "register", {
registered: true,
registerName: name,
redirect: req.body.redirect
});
}
});
}
module.exports = {
/**
* Initializes auth callbacks
*/
init: function (app) {
2014-01-20 18:42:20 +00:00
app.get("/login", handleLoginPage);
app.post("/login", handleLogin);
app.get("/logout", handleLogout);
app.get("/register", handleRegisterPage);
app.post("/register", handleRegister);
app.get("/shimcookie", handleShimCookie);
app.get("/shimlogout", handleShimLogout);
}
};