2fa and pin fixes

2 files changed, 37 insertions, 34 deletions

diff --git a/lib/whitelist.js b/lib/whitelist.js
index bbb2a7c2..93e601c7 100644
--- a/lib/whitelist.js
+++ b/lib/whitelist.js
@@ -1,26 +1,25 @@
 export default [
-  "id",
   "account",
   "account_id",
-  "admin",
+  "accounts",
   "address",
-  "fiat",
-  "unit",
-  "username",
-  "symbol",
-  "currency",
+  "admin",
+  "banner",
   "currencies",
-  "twofa",
-  "accounts",
-  "payments",
-  "seed",
-  "keys",
-  "index",
-  "verified",
+  "currency",
   "email",
+  "fiat",
+  "haspin",
+  "id",
+  "index",
+  "keys",
+  "payments",
   "profile",
-  "banner",
+  "seed",
+  "symbol",
   "theme",
-  "haspin",
+  "twofa",
+  "unit",
+  "username",
+  "verified"
 ];
-
diff --git a/routes/users.js b/routes/users.js
index c8a9a810..6181a957 100644
--- a/routes/users.js
+++ b/routes/users.js
@@ -80,25 +80,25 @@ app.post("/register", async (req, res) => {
 });
 
 app.post("/disable2fa", auth, async (req, res) => {
-  let {
-    user,
-    body: { token }
-  } = req;
+  try {
+    let {
+      user,
+      body: { token }
+    } = req;
 
-  if (
-    user.twofa &&
-    (typeof token === "undefined" ||
-      !authenticator.check(token, user.otpsecret))
-  ) {
-    return res.code(401).send("2fa required");
-  }
+    if (user.twofa && !authenticator.check(token, user.otpsecret)) {
+      return res.code(401).send("2fa required");
+    }
 
-  user.twofa = false;
-  await user.save();
-  emit(user.username, "user", user);
-  emit(user.username, "otpsecret", user.otpsecret);
-  l("disabled 2fa", user.username);
-  res.send({});
+    user.twofa = false;
+    await user.save();
+    emit(user.username, "user", user);
+    emit(user.username, "otpsecret", user.otpsecret);
+    l("disabled 2fa", user.username);
+    res.send({});
+  } catch (e) {
+    res.code(500).send("Problem disabling 2fa");
+  }
 });
 
 app.post("/2fa", auth, async (req, res) => {
@@ -186,6 +186,10 @@ app.post("/user", auth, async (req, res) => {
     }
 
     await user.save();
+
+    user = user.get({ plain: true });
+    user.haspin = !!user.pin;
+
     emit(user.username, "user", user);
     res.send({ user, token });
   } catch (e) {