require pin on certain endpoints

8 files changed, 35 insertions, 14 deletions

diff --git a/routes/bitcoin/broadcast.js b/routes/bitcoin/broadcast.js
index e4c7ba62..85c8cf66 100644
--- a/routes/bitcoin/broadcast.js
+++ b/routes/bitcoin/broadcast.js
@@ -1,7 +1,11 @@
 import { emit } from "$lib/sockets";
 import store from "$lib/store";
+import { requirePin } from "$lib/utils";
+
 export default async (req, res) => {
   try {
+    await requirePin(req);
+
     const { user } = req;
     let hash = await bc.sendRawTransaction(req.body.tx);
 
diff --git a/routes/bitcoin/send.js b/routes/bitcoin/send.js
index 5bf21f1a..c52592ae 100644
--- a/routes/bitcoin/send.js
+++ b/routes/bitcoin/send.js
@@ -5,6 +5,7 @@ import { toSats } from "$lib/utils";
 import store from "$lib/store";
 import config from "$config";
 import { l, warn, err } from "$lib/logging";
+import { requirePin } from "$lib/utils";
 
 const btc = config.liquid.btcasset;
 import {
@@ -14,6 +15,8 @@ import {
 
 export default async (req, res) => {
   try {
+    await requirePin(req);
+
     let { user } = req;
     let { address, memo, tx } = req.body;
     let { hex } = tx;
@@ -85,7 +88,7 @@ export default async (req, res) => {
 
       if (total > account.balance) {
         err("amount exceeds balance", amount, fee, account.balance);
-        throw new Error("low balance");
+        throw new Error("low");
       } else if (total + conversionFee > account.balance) {
         err(
           "total (after conversion fee) exceeds balance",
@@ -93,7 +96,7 @@ export default async (req, res) => {
           fee,
           account.balance
         );
-        throw new Error("low balance (after conversion fee)");
+        throw new Error("low");
       }
 
       await account.decrement(
@@ -179,7 +182,10 @@ export default async (req, res) => {
   } catch (e) {
     if (e.message.includes("Insufficient"))
       e.message =
-        "The coinos server hot wallet has insufficient funds to complete the payment, try again later";
+        "Our server has insufficient funds, try again later";
+
+    if (e.message === "low") e.message = "Insufficient funds in account"
+
     err("error sending bitcoin", e.message);
     console.log(e);
     return res.code(500).send(e.message);
diff --git a/routes/lightning/send.js b/routes/lightning/send.js
index ba88aaf6..b41d5ed0 100644
--- a/routes/lightning/send.js
+++ b/routes/lightning/send.js
@@ -1,20 +1,17 @@
 import { err } from "$lib/logging";
 import send from "$lib/send";
+import { requirePin } from "$lib/utils";
 
 export default async (req, res) => {
   let { amount, route, memo, payreq } = req.body;
   let { user } = req;
 
   try {
+    await requirePin(req);
     res.send(await send(amount, memo, payreq, user));
   } catch (e) {
-    console.log(e)
-    err(
-      "problem sending lightning payment",
-      user.username,
-      payreq,
-      e.message
-    );
+    console.log(e);
+    err("problem sending lightning payment", user.username, payreq, e.message);
     res.code(500).send(e.message);
   }
 };
diff --git a/routes/liquid/broadcast.js b/routes/liquid/broadcast.js
index 03a71b2b..820c0be1 100644
--- a/routes/liquid/broadcast.js
+++ b/routes/liquid/broadcast.js
@@ -1,8 +1,11 @@
 import { emit } from "$lib/sockets";
 import store from "$lib/store";
+import { requirePin } from "$lib/utils";
 
 export default async (req, res) => {
   try {
+    await requirePin(req);
+
     const { user } = req;
     let hash = await lq.sendRawTransaction(req.body.tx);
 
diff --git a/routes/liquid/send.js b/routes/liquid/send.js
index d7a7c7b4..83b5d6ca 100644
--- a/routes/liquid/send.js
+++ b/routes/liquid/send.js
@@ -7,6 +7,7 @@ import config from "$config";
 import { l, warn, err } from "$lib/logging";
 import { liquidTx } from "$routes/liquid/fee";
 import { Transaction } from 'liquidjs-lib';
+import { requirePin } from "$lib/utils";
 
 import {
   computeConversionFee,
@@ -263,6 +264,7 @@ export default async (req, res) => {
   let { user } = req;
 
   try {
+    await requirePin(req);
     let result = await sendLiquid({ ...req.body, user })
     if (result instanceof Error) throw result;
     res.send(result);
diff --git a/routes/payments.js b/routes/payments.js
index d1b2ba4c..7a728daa 100644
--- a/routes/payments.js
+++ b/routes/payments.js
@@ -26,6 +26,8 @@ app.post("/send", auth, send);
 app.post("/sendToTokenHolders", auth, async (req, res, next) => {
   let { asset, amount } = req.body;
 
+
+
   let accounts = await db.Account.findAll({
     where: {
       asset,
diff --git a/routes/send.js b/routes/send.js
index cc277850..591b5ab7 100644
--- a/routes/send.js
+++ b/routes/send.js
@@ -1,8 +1,10 @@
 import { err } from "$lib/logging";
 import sendInternal from "$lib/sendInternal";
+import { requirePin } from "$lib/utils";
 
 export default async (req, res, next) => {
   try {
+    await requirePin(req);
     let payment = await sendInternal(req.body, req.user);
     res.send(payment);
   } catch (e) {
diff --git a/routes/users.js b/routes/users.js
index c270902c..da8dfca0 100644
--- a/routes/users.js
+++ b/routes/users.js
@@ -46,7 +46,8 @@ app.get("/me", auth, async (req, res) => {
     });
     user.accounts = await req.user.getAccounts();
     user.payments = payments;
-    res.send(user);
+    user.haspin = !!user.pin;
+    res.send(pick(user, ...whitelist));
   } catch (e) {
     res.code(500).send(e.message);
   }
@@ -137,6 +138,7 @@ app.post("/user", auth, async (req, res) => {
       email,
       fiat,
       password,
+      newpin,
       pin,
       seed,
       tokens,
@@ -145,6 +147,8 @@ app.post("/user", auth, async (req, res) => {
       username
     } = req.body;
 
+    if (user.pin && !(pin === user.pin)) throw new Error("Pin required");
+
     let exists = await db.User.findOne({
       where: { username }
     });
@@ -152,7 +156,7 @@ app.post("/user", auth, async (req, res) => {
     let token;
     if (user.username !== username && exists) {
       err("username taken", username, user.username, exists.username);
-      return res.code(500).send("Username taken");
+      throw new Error("Username taken");
     } else {
       store.sockets[username] = store.sockets[user.username];
       if (user.username !== username)
@@ -168,15 +172,15 @@ app.post("/user", auth, async (req, res) => {
     if (unit) user.unit = unit;
     user.currency = currency;
     user.currencies = currencies;
-
+    user.pin = newpin;
     user.tokens = tokens;
     user.twofa = twofa;
-    user.pin = pin;
     user.seed = seed;
     user.fiat = fiat;
     user.email = email;
     user.address = address;
 
+
     if (password && password === confirm) {
       user.password = await bcrypt.hash(password, 1);
     }
@@ -186,6 +190,7 @@ app.post("/user", auth, async (req, res) => {
     res.send({ user, token });
   } catch (e) {
     err("error updating user", e.message);
+    res.code(500).send(e.message);
   }
 });