account locking mechanism

1 files changed, 10 insertions, 5 deletions

diff --git a/lib/passport.js b/lib/passport.js
index b26b445e..70e002b9 100644
--- a/lib/passport.js
+++ b/lib/passport.js
@@ -4,7 +4,7 @@ const jwt = require("passport-jwt");
 function cookieExtractor(req) {
   if (req && req.cookies) {
     return req.cookies["token"];
-  } 
+  }
   return null;
 }
 
@@ -20,9 +20,14 @@ passport = Passport.use(
     async (payload, next) => {
       const { username } = payload;
       try {
-        next(null, await db.User.findOne({ where: { username }, include: { model: db.Account, as: 'account' } }));
+        let user = await db.User.findOne({
+          where: { username },
+          include: { model: db.Account, as: "account" }
+        });
+        if (user.locked) throw new Error("account is locked");
+        next(null, user);
       } catch (e) {
-        l.error("error finding user for session", e);
+        l.error("problem logging in", e);
         next(null, { username: "guest" });
       }
     }
@@ -31,8 +36,8 @@ passport = Passport.use(
 
 auth = passport.authenticate("jwt", { session: false });
 
-optionalAuth = function (req, res, next) {
-  passport.authenticate("jwt", { session: false }, function (err, user, info) {
+optionalAuth = function(req, res, next) {
+  passport.authenticate("jwt", { session: false }, function(err, user, info) {
     req.user = user;
     next();
   })(req, res, next);