account locking mechanism

5 files changed, 27 insertions, 6 deletions

diff --git a/db/models/users.js b/db/models/users.js
index 48384767..2a83eca8 100644
--- a/db/models/users.js
+++ b/db/models/users.js
@@ -10,6 +10,15 @@ const attributes = {
     comment: null,
     field: "id"
   },
+  locked: {
+    type: DataTypes.BOOLEAN,
+    allowNull: true,
+    defaultValue: false,
+    primaryKey: false,
+    autoIncrement: false,
+    comment: null,
+    field: "locked"
+  },
   verified: {
     type: DataTypes.STRING,
     allowNull: true,
diff --git a/lib/passport.js b/lib/passport.js
index b26b445e..70e002b9 100644
--- a/lib/passport.js
+++ b/lib/passport.js
@@ -4,7 +4,7 @@ const jwt = require("passport-jwt");
 function cookieExtractor(req) {
   if (req && req.cookies) {
     return req.cookies["token"];
-  } 
+  }
   return null;
 }
 
@@ -20,9 +20,14 @@ passport = Passport.use(
     async (payload, next) => {
       const { username } = payload;
       try {
-        next(null, await db.User.findOne({ where: { username }, include: { model: db.Account, as: 'account' } }));
+        let user = await db.User.findOne({
+          where: { username },
+          include: { model: db.Account, as: "account" }
+        });
+        if (user.locked) throw new Error("account is locked");
+        next(null, user);
       } catch (e) {
-        l.error("error finding user for session", e);
+        l.error("problem logging in", e);
         next(null, { username: "guest" });
       }
     }
@@ -31,8 +36,8 @@ passport = Passport.use(
 
 auth = passport.authenticate("jwt", { session: false });
 
-optionalAuth = function (req, res, next) {
-  passport.authenticate("jwt", { session: false }, function (err, user, info) {
+optionalAuth = function(req, res, next) {
+  passport.authenticate("jwt", { session: false }, function(err, user, info) {
     req.user = user;
     next();
   })(req, res, next);
diff --git a/lib/send.js b/lib/send.js
index 232d6054..b4fc9ac9 100644
--- a/lib/send.js
+++ b/lib/send.js
@@ -65,6 +65,7 @@ send = async (amount, memo, hash, user) => {
       total = parseInt(total);
       fee = parseInt(fee);
 
+      await new Promise((resolve) => setTimeout(resolve, 5000));
       account.balance -= total;
       await account.save({ transaction });
 
diff --git a/lib/sockets.js b/lib/sockets.js
index 1ed18610..25f8aed8 100644
--- a/lib/sockets.js
+++ b/lib/sockets.js
@@ -106,6 +106,7 @@ wss.on("connection", function(ws, req) {
           names[id] = username;
 
           let user = await getUser(username);
+          if (user.locked) throw new Error("Account is locked");
           let payments = await user.getPayments({
             where: {
               account_id: user.account_id
@@ -131,9 +132,13 @@ wss.on("connection", function(ws, req) {
           );
         } catch (e) {
           l.error("caught socket error", e.message);
+          if (e.message.includes("locked")) {
+            ws.send(JSON.stringify({ type: "locked" }));
+            ws.send(JSON.stringify({ type: "logout" }));
+          } 
           if (e.message.includes("not found"))
             ws.send(JSON.stringify({ type: "logout" }));
-          setTimeout(ws.close, 1000);
+          setTimeout(() => ws && ws.close(), 1000);
         }
         break;
       case "token":
diff --git a/routes/users.js b/routes/users.js
index e7aec50e..c9d60585 100644
--- a/routes/users.js
+++ b/routes/users.js
@@ -157,6 +157,7 @@ app.post(
 
       let token;
       if (user.username !== username && exists) {
+        l.error("username taken", username, user.username, exists.username);
         return res.status(500).send("Username taken");
       } else {
         sockets[username] = sockets[user.username];