lfk/backend
2
0
Fork 0
Code Issues 1 Pull Requests Actions Projects Releases 40 Activity

Merge branch 'feature/12-jwt-creation' into dev

Browse Source 
close #12
This commit is contained in:
Philipp Dormann 2020-12-09 19:01:17 +01:00
commit 18ef8df3a9
2 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/models/actions/CreateAuth.ts
View File

@ -28,13 +28,14 @@ export class CreateAuth {
if (!this.password) { if (!this.password) {
throw new PasswordNeededError() throw new PasswordNeededError()
} }
const found_users = await getConnectionManager().get().getRepository(User).find({ where: [{ username: this.username }, { email: this.email }] }); const found_users = await getConnectionManager().get().getRepository(User).find({ relations: ['groups', 'permissions'], where: [{ username: this.username }, { email: this.email }] });
if (found_users.length === 0) { if (found_users.length === 0) {
throw new UserNotFoundError() throw new UserNotFoundError()
} else { } else {
const found_user = found_users[0] const found_user = found_users[0]
if (await argon2.verify(found_user.password, this.password + found_user.uuid)) { if (await argon2.verify(found_user.password, this.password + found_user.uuid)) {
const timestamp_accesstoken_expiry = Math.floor(Date.now() / 1000) + 5 * 60 const timestamp_accesstoken_expiry = Math.floor(Date.now() / 1000) + 5 * 60
found_user.permissions = found_user.permissions || []
delete found_user.password; delete found_user.password;
newAuth.access_token = jsonwebtoken.sign({ newAuth.access_token = jsonwebtoken.sign({
userdetails: found_user, userdetails: found_user,

3
src/models/actions/RefreshAuth.ts
View File

@ -21,13 +21,14 @@ export class RefreshAuth {
} catch (error) { } catch (error) {
throw new IllegalJWTError() throw new IllegalJWTError()
} }
const found_user = await getConnectionManager().get().getRepository(User).findOne({ id: decoded["userid"] }); const found_user = await getConnectionManager().get().getRepository(User).findOne({ id: decoded["userid"] }, { relations: ['groups', 'permissions'] });
if (!found_user) { if (!found_user) {
throw new UserNotFoundError() throw new UserNotFoundError()
} }
if (found_user.refreshTokenCount !== decoded["refreshtokencount"]) { if (found_user.refreshTokenCount !== decoded["refreshtokencount"]) {
throw new RefreshTokenCountInvalidError() throw new RefreshTokenCountInvalidError()
} }
found_user.permissions = found_user.permissions || []
delete found_user.password; delete found_user.password;
const timestamp_accesstoken_expiry = Math.floor(Date.now() / 1000) + 5 * 60 const timestamp_accesstoken_expiry = Math.floor(Date.now() / 1000) + 5 * 60
delete found_user.password; delete found_user.password;