require pin on certain endpoints

12 files changed, 52 insertions, 16 deletions

diff --git a/README.md b/README.md
index 743d2db1..ba511256 100644
--- a/README.md
+++ b/README.md
@@ -33,6 +33,7 @@ CERT=$(sudo base64 config/lnd/tls.cert | tr -d '\n')
 sed -i "s/LS0tL.*\"/$CERT\"/g" config/index.js
 MACAROON=$(sudo base64 config/lnd/data/chain/bitcoin/regtest/admin.macaroon | tr -d '\n') 
 sed -i "s/AgED.*\"/$MACAROON\"/g" config/index.js
+curl localhost:3119/register -H "content-type: application/json" -d '{"user": { "username": "coinosfees", "password": "password"}}'
 ```
 
 After successful creation of all docker containers coinos ui will be available at http://localhost:8085 and coinos server will be available at http://localhost:3119
diff --git a/lib/sockets.js b/lib/sockets.js
index 22072dd0..87cf7116 100644
--- a/lib/sockets.js
+++ b/lib/sockets.js
@@ -116,6 +116,8 @@ app.register(async function(app) {
 
             let user = await getUser(username);
 
+            let { haspin } = user;
+
             if (user.locked) throw new Error("Account is locked");
             let payments = await user.getPayments({
               where: {
@@ -142,9 +144,12 @@ app.register(async function(app) {
             user.accounts = accounts;
             user.keys = keys;
             user.payments = payments;
+            user.haspin = haspin;
 
             ws.user = user;
-            ws.send(JSON.stringify({ type: "login", data: user }));
+            ws.send(
+              JSON.stringify({ type: "login", data: pick(user, ...whitelist) })
+            );
             ws.send(
               JSON.stringify({ type: "version", data: config.clientVersion })
             );
diff --git a/lib/utils.js b/lib/utils.js
index 2941bf9d..b4eb7ae4 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -10,6 +10,11 @@ import ln from "$lib/ln";
 
 const { Op } = sequelize;
 
+export const requirePin = async ({ body, user }) => {
+  if (user && user.pin && user.pin !== body.pin)
+    throw new Error("Invalid pin");
+};
+
 export const getUser = async (username, transaction) => {
   let params = {
     include: [
@@ -31,6 +36,8 @@ export const getUser = async (username, transaction) => {
   let user = await db.User.findOne(params);
   if (!user) throw new Error(`User ${username} not found`);
 
+  user.haspin = !!user.pin;
+
   return user;
 };
 
diff --git a/lib/whitelist.js b/lib/whitelist.js
index d3e361d1..ffe99dac 100644
--- a/lib/whitelist.js
+++ b/lib/whitelist.js
@@ -19,5 +19,7 @@ export default [
   "email",
   "profile",
   "banner",
-  "theme"
+  "theme",
+  "haspin",
 ];
+
diff --git a/routes/bitcoin/broadcast.js b/routes/bitcoin/broadcast.js
index e4c7ba62..85c8cf66 100644
--- a/routes/bitcoin/broadcast.js
+++ b/routes/bitcoin/broadcast.js
@@ -1,7 +1,11 @@
 import { emit } from "$lib/sockets";
 import store from "$lib/store";
+import { requirePin } from "$lib/utils";
+
 export default async (req, res) => {
   try {
+    await requirePin(req);
+
     const { user } = req;
     let hash = await bc.sendRawTransaction(req.body.tx);
 
diff --git a/routes/bitcoin/send.js b/routes/bitcoin/send.js
index 5bf21f1a..c52592ae 100644
--- a/routes/bitcoin/send.js
+++ b/routes/bitcoin/send.js
@@ -5,6 +5,7 @@ import { toSats } from "$lib/utils";
 import store from "$lib/store";
 import config from "$config";
 import { l, warn, err } from "$lib/logging";
+import { requirePin } from "$lib/utils";
 
 const btc = config.liquid.btcasset;
 import {
@@ -14,6 +15,8 @@ import {
 
 export default async (req, res) => {
   try {
+    await requirePin(req);
+
     let { user } = req;
     let { address, memo, tx } = req.body;
     let { hex } = tx;
@@ -85,7 +88,7 @@ export default async (req, res) => {
 
       if (total > account.balance) {
         err("amount exceeds balance", amount, fee, account.balance);
-        throw new Error("low balance");
+        throw new Error("low");
       } else if (total + conversionFee > account.balance) {
         err(
           "total (after conversion fee) exceeds balance",
@@ -93,7 +96,7 @@ export default async (req, res) => {
           fee,
           account.balance
         );
-        throw new Error("low balance (after conversion fee)");
+        throw new Error("low");
       }
 
       await account.decrement(
@@ -179,7 +182,10 @@ export default async (req, res) => {
   } catch (e) {
     if (e.message.includes("Insufficient"))
       e.message =
-        "The coinos server hot wallet has insufficient funds to complete the payment, try again later";
+        "Our server has insufficient funds, try again later";
+
+    if (e.message === "low") e.message = "Insufficient funds in account"
+
     err("error sending bitcoin", e.message);
     console.log(e);
     return res.code(500).send(e.message);
diff --git a/routes/lightning/send.js b/routes/lightning/send.js
index ba88aaf6..b41d5ed0 100644
--- a/routes/lightning/send.js
+++ b/routes/lightning/send.js
@@ -1,20 +1,17 @@
 import { err } from "$lib/logging";
 import send from "$lib/send";
+import { requirePin } from "$lib/utils";
 
 export default async (req, res) => {
   let { amount, route, memo, payreq } = req.body;
   let { user } = req;
 
   try {
+    await requirePin(req);
     res.send(await send(amount, memo, payreq, user));
   } catch (e) {
-    console.log(e)
-    err(
-      "problem sending lightning payment",
-      user.username,
-      payreq,
-      e.message
-    );
+    console.log(e);
+    err("problem sending lightning payment", user.username, payreq, e.message);
     res.code(500).send(e.message);
   }
 };
diff --git a/routes/liquid/broadcast.js b/routes/liquid/broadcast.js
index 03a71b2b..820c0be1 100644
--- a/routes/liquid/broadcast.js
+++ b/routes/liquid/broadcast.js
@@ -1,8 +1,11 @@
 import { emit } from "$lib/sockets";
 import store from "$lib/store";
+import { requirePin } from "$lib/utils";
 
 export default async (req, res) => {
   try {
+    await requirePin(req);
+
     const { user } = req;
     let hash = await lq.sendRawTransaction(req.body.tx);
 
diff --git a/routes/liquid/send.js b/routes/liquid/send.js
index d7a7c7b4..83b5d6ca 100644
--- a/routes/liquid/send.js
+++ b/routes/liquid/send.js
@@ -7,6 +7,7 @@ import config from "$config";
 import { l, warn, err } from "$lib/logging";
 import { liquidTx } from "$routes/liquid/fee";
 import { Transaction } from 'liquidjs-lib';
+import { requirePin } from "$lib/utils";
 
 import {
   computeConversionFee,
@@ -263,6 +264,7 @@ export default async (req, res) => {
   let { user } = req;
 
   try {
+    await requirePin(req);
     let result = await sendLiquid({ ...req.body, user })
     if (result instanceof Error) throw result;
     res.send(result);
diff --git a/routes/payments.js b/routes/payments.js
index d1b2ba4c..7a728daa 100644
--- a/routes/payments.js
+++ b/routes/payments.js
@@ -26,6 +26,8 @@ app.post("/send", auth, send);
 app.post("/sendToTokenHolders", auth, async (req, res, next) => {
   let { asset, amount } = req.body;
 
+
+
   let accounts = await db.Account.findAll({
     where: {
       asset,
diff --git a/routes/send.js b/routes/send.js
index cc277850..591b5ab7 100644
--- a/routes/send.js
+++ b/routes/send.js
@@ -1,8 +1,10 @@
 import { err } from "$lib/logging";
 import sendInternal from "$lib/sendInternal";
+import { requirePin } from "$lib/utils";
 
 export default async (req, res, next) => {
   try {
+    await requirePin(req);
     let payment = await sendInternal(req.body, req.user);
     res.send(payment);
   } catch (e) {
diff --git a/routes/users.js b/routes/users.js
index c270902c..da8dfca0 100644
--- a/routes/users.js
+++ b/routes/users.js
@@ -46,7 +46,8 @@ app.get("/me", auth, async (req, res) => {
     });
     user.accounts = await req.user.getAccounts();
     user.payments = payments;
-    res.send(user);
+    user.haspin = !!user.pin;
+    res.send(pick(user, ...whitelist));
   } catch (e) {
     res.code(500).send(e.message);
   }
@@ -137,6 +138,7 @@ app.post("/user", auth, async (req, res) => {
       email,
       fiat,
       password,
+      newpin,
       pin,
       seed,
       tokens,
@@ -145,6 +147,8 @@ app.post("/user", auth, async (req, res) => {
       username
     } = req.body;
 
+    if (user.pin && !(pin === user.pin)) throw new Error("Pin required");
+
     let exists = await db.User.findOne({
       where: { username }
     });
@@ -152,7 +156,7 @@ app.post("/user", auth, async (req, res) => {
     let token;
     if (user.username !== username && exists) {
       err("username taken", username, user.username, exists.username);
-      return res.code(500).send("Username taken");
+      throw new Error("Username taken");
     } else {
       store.sockets[username] = store.sockets[user.username];
       if (user.username !== username)
@@ -168,15 +172,15 @@ app.post("/user", auth, async (req, res) => {
     if (unit) user.unit = unit;
     user.currency = currency;
     user.currencies = currencies;
-
+    user.pin = newpin;
     user.tokens = tokens;
     user.twofa = twofa;
-    user.pin = pin;
     user.seed = seed;
     user.fiat = fiat;
     user.email = email;
     user.address = address;
 
+
     if (password && password === confirm) {
       user.password = await bcrypt.hash(password, 1);
     }
@@ -186,6 +190,7 @@ app.post("/user", auth, async (req, res) => {
     res.send({ user, token });
   } catch (e) {
     err("error updating user", e.message);
+    res.code(500).send(e.message);
   }
 });