username checks

4 files changed, 41 insertions, 13 deletions

diff --git a/lib/app.ts b/lib/app.ts
index df696bc6..1beedcd4 100644
--- a/lib/app.ts
+++ b/lib/app.ts
@@ -22,8 +22,23 @@ const app = fastify({
 const reqLogger = pino(pino.destination("req"));
 const resLogger = pino(pino.destination("res"));
 
-app.addHook("onRequest", async (req) => {
-  reqLogger.info({ url: req.raw.url, id: req.id });
+// app.addHook("onRequest", async (req) => {
+//   reqLogger.info({ url: req.raw.url, id: req.id });
+// });
+//
+
+app.addHook("preHandler", async (req) => {
+  const url = req.raw.url;
+  const ignore = ["/login","/ws","/me","/confirm","/public"];
+  if (req.method === "GET" || ignore.some(path => url.startsWith(path))) return;
+
+  reqLogger.info({
+    method: req.method,
+    url,
+    headers: req.headers,
+    body: req.body,
+    id: req.id
+  });
 });
 
 app.addHook("onResponse", async (req, reply) => {
diff --git a/lib/payments.ts b/lib/payments.ts
index 437db14f..cbff6dd3 100644
--- a/lib/payments.ts
+++ b/lib/payments.ts
@@ -299,6 +299,7 @@ export const completePayment = async (inv, p, user) => {
   if (p.confirmed) {
     if (autowithdraw) {
       try {
+        fail("autowithdrawals disabled");
         const to = destination.trim();
         const balance = await g(`balance:${id}`);
         const amount = balance - reserve;
diff --git a/lib/register.ts b/lib/register.ts
index c1c73a38..107be6ea 100644
--- a/lib/register.ts
+++ b/lib/register.ts
@@ -23,7 +23,7 @@ export default async (user, ip) => {
   const id = v4();
   user.id = id;
 
-  const exists = await getUser(username);
+  const exists = await db.exists(`user:${username}`);
   if (exists) fail(`Username ${username} taken`);
 
   if (password) {
diff --git a/routes/users.ts b/routes/users.ts
index 776c2562..7f080cb9 100644
--- a/routes/users.ts
+++ b/routes/users.ts
@@ -192,16 +192,22 @@ export default {
         config.jwt,
       );
       l("updating user", user.username, tokid);
+      if (user.id !== tokid) fail("unauthorized");
+
+      const { confirm, password, pin, newpin } = body;
+      let username = body?.username?.toLowerCase().replace(/\s/g,"");
+      const valid = /^[\p{L}\p{N}]{2,24}$/u;
+      if (!valid.test(username)) fail("Usernames can only have letters and numbers");
 
-      const { confirm, password, pin, newpin, username } = body;
       let exists;
 
       let { pubkey } = body;
       if (pubkey) {
         pubkey = pubkey.trim();
         exists = await getUser(pubkey);
-        if (exists && ![username].includes(exists.username)) {
-          warn("key in use", pubkey, exists.username);
+        let existingUsername = exists.username.toLowerCase().replace(/\s/g,"");
+        if (exists && ![username].includes(existingUsername)) {
+          warn("key in use", pubkey, existingUsername);
           if (exists.anon) await db.del(`user:${pubkey}`);
           else fail("Key in use by another account");
         }
@@ -228,16 +234,17 @@ export default {
       if (user.pin === "delete") user.pin = undefined;
 
       if (username) {
-        exists = await getUser(username);
+        exists = await db.exists(`user:${username}`);
+        let currentUsername = user.username.replace(/\s/g,"").toLowerCase()
 
-        if (user.username.toLowerCase() !== username.toLowerCase() && exists) {
-          err("username taken", username, user.username, exists.username);
+        if (currentUsername !== username && exists) {
+          err("username taken", username, currentUsername);
           fail("Username taken");
         } else if (username) {
-          if (user.username.toLowerCase() !== username.toLowerCase())
-            l("changing username", user.username, username);
+          if (currentUsername !== username)
+            l("changing username", currentUsername, username);
 
-          await db.del(`user:${user.username}`);
+          await db.del(`user:${currentUsername}`);
           user.username = username;
         }
       }
@@ -387,7 +394,12 @@ export default {
       }
 
       const { username } = user;
-      l("logging in", username, ip);
+      if (await db.sIsMember("compromised", username.replace(/\s/g,"").toLowerCase())) {
+        warn("compromised nostr auth attempt");
+        fail("unauthorized");
+      }
+
+      l("nostr login", username, ip);
 
       const payload = { id: user.id };
       const token = jwt.sign(payload, config.jwt);