strip spaces from usernames

1 files changed, 12 insertions, 8 deletions

diff --git a/lib/passport.js b/lib/passport.js
index 9b88f27c..eafc8179 100644
--- a/lib/passport.js
+++ b/lib/passport.js
@@ -1,5 +1,6 @@
 const Passport = require("passport");
 const jwt = require("passport-jwt");
+const { Op } = require("sequelize");
 
 function cookieExtractor(req) {
   if (req && req.cookies) {
@@ -13,20 +14,23 @@ passport = Passport.use(
     {
       jwtFromRequest: jwt.ExtractJwt.fromExtractors([
         jwt.ExtractJwt.fromAuthHeaderAsBearerToken(),
-        cookieExtractor
+        cookieExtractor,
       ]),
-      secretOrKey: config.jwt
+      secretOrKey: config.jwt,
     },
     async (payload, next) => {
-      const { username } = payload;
       try {
+        let { username } = payload;
         let user = await db.User.findOne({
-          where: { username },
-          include: { model: db.Account, as: "account" }
+          where: {
+            username: { [Op.or]: [username, username.replace(/ /g, "")] },
+          },
+          include: { model: db.Account, as: "account" },
         });
         if (user.locked) throw new Error("account is locked");
         next(null, user);
       } catch (e) {
+        console.log(e);
         l.error("problem logging in", e);
         next(null, { username: "guest" });
       }
@@ -36,15 +40,15 @@ passport = Passport.use(
 
 auth = passport.authenticate("jwt", { session: false });
 
-optionalAuth = function(req, res, next) {
-  passport.authenticate("jwt", { session: false }, function(err, user, info) {
+optionalAuth = function (req, res, next) {
+  passport.authenticate("jwt", { session: false }, function (err, user, info) {
     req.user = user;
     next();
   })(req, res, next);
 };
 
 adminAuth = (req, res, next) => {
-  passport.authenticate("jwt", { session: false }, function(err, user, info) {
+  passport.authenticate("jwt", { session: false }, function (err, user, info) {
     if (!(user && user.admin)) throw new Error("restricted");
     req.user = user;
     next();