lnurl auth

4 files changed, 115 insertions, 23 deletions

diff --git a/routes/lightning/decode.js b/routes/lightning/decode.js
deleted file mode 100644
index b7dba120..00000000
--- a/routes/lightning/decode.js
+++ /dev/null
@@ -1,15 +0,0 @@
-const axios = require('axios');
-const lnurl = require('lnurl');
-
-module.exports = async (req, res) => {
-  let { text } = req.query;
-  const decoded = lnurl.decode(text);
-
-  try {
-    let result = await axios.get(decoded);
-    res.send(result.data);
-  } catch(e) {
-    l.error(e.message);
-    res.status(500).send(e.message);
-  } 
-};
diff --git a/routes/lnurl.js b/routes/lnurl.js
new file mode 100644
index 00000000..e9c1f930
--- /dev/null
+++ b/routes/lnurl.js
@@ -0,0 +1,75 @@
+const axios = require("axios");
+const lnurl = require("lnurl");
+const jwt = require("jsonwebtoken");
+
+logins = {};
+
+lnurlServer = lnurl.createServer(config.lnurl);
+
+app.get("/loginUrl", async (req, res) => {
+  try {
+    const result = await lnurlServer.generateNewUrl("login");
+    const { username } = req.query;
+
+    if (username !== "undefined") {
+      logins[result.secret] = username;
+    }
+
+    res.send(result);
+  } catch (e) {
+    l.error(e.message);
+    res.status(500).send(e.message);
+  }
+});
+
+app.get("/decode", async (req, res) => {
+  const { text } = req.query;
+
+  try {
+    const decoded = lnurl.decode(text);
+    let result = await axios.get(decoded);
+    res.send(result.data);
+  } catch (e) {
+    l.error(e.message);
+    res.status(500).send(e.message);
+  }
+});
+
+lnurlServer.bindToHook("login", async params => {
+  try {
+    const { k1, key } = params;
+
+    const exists = await db.Key.findOne({
+      where: { hex: key },
+      include: [{model: db.User, as: "user" }]
+    });
+
+    let user;
+    if (logins[k1]) {
+      const username = logins[k1];
+      user = await db.User.findOne({
+        where: { username }
+      });
+
+      const k = await db.Key.create({
+        user_id: user.id,
+        hex: key,
+      });
+
+      l.info("added key", username, k);
+      emit(username, 'key', k);
+    } 
+    else if (exists) ({ user } = exists); 
+    else return;
+
+    if (user && user.username) {
+      const payload = { username: user.username };
+      const token = jwt.sign(payload, config.jwt);
+      const ws = sessions[key];
+      if (ws && ws.send)
+        ws.send(JSON.stringify({ type: "token", data: token }));
+    }
+  } catch (e) {
+    l.error(e.message);
+  }
+});
diff --git a/routes/payments.js b/routes/payments.js
index 1840c381..9fa2ce54 100644
--- a/routes/payments.js
+++ b/routes/payments.js
@@ -34,7 +34,6 @@ const { join } = require("path");
       lnb = lnd(config.lnb);
     }
 
-    app.get("/lightning/decode", require("./lightning/decode"));
     app.post("/lightning/channel", auth, require("./lightning/channel"));
     app.post("/lightning/channelRequest", auth, require("./lightning/channelRequest"));
     app.post("/lightning/invoice", auth, require("./lightning/invoice"));
diff --git a/routes/users.js b/routes/users.js
index 9de84b83..13837bd6 100644
--- a/routes/users.js
+++ b/routes/users.js
@@ -207,7 +207,8 @@ app.post("/user", auth, async (req, res) => {
       pin,
       password,
       passconfirm,
-      tokens
+      tokens,
+      seed
     } = req.body;
 
     let exists = await db.User.findOne({
@@ -238,6 +239,7 @@ app.post("/user", auth, async (req, res) => {
     user.tokens = tokens;
     user.twofa = twofa;
     user.pin = pin;
+    user.seed = seed;
 
     if (password && password === passconfirm) {
       user.password = await bcrypt.hash(password, 1);
@@ -247,11 +249,42 @@ app.post("/user", auth, async (req, res) => {
     emit(user.username, "user", user);
     res.send({ user, token });
   } catch (e) {
-    l.error("error updating user", e);
+    l.error("error updating user", e.message);
   }
 });
 
+app.post("/keys", auth, async (req, res) => {
+  const { key: hex } = req.body;
+  const key = await db.Key.create({
+    user_id: req.user.id,
+    hex
+  });
+  emit(req.user.username, "key", key);
+});
+
 app.post("/login", async (req, res) => {
+  const {
+    params,
+    sig,
+    key
+  } = req.body;
+
+  if (sig) {
+    const { callback, k1 } = params;
+    sessions[key] = sessions[k1];
+
+    try {
+      const url = `${callback}&sig=${sig}&key=${key}`;
+      const response = await axios.get(url);
+      res.send(response.data);
+    } catch (e) {
+      l.error(e.message);
+      res.status(500).send(e.message);
+    }
+
+    return;
+  }
+
   let twofa = req.body.token;
   l.info(
     "login attempt",
@@ -286,7 +319,7 @@ app.post("/login", async (req, res) => {
     let payload = { username: user.username };
     let token = jwt.sign(payload, config.jwt);
     res.cookie("token", token, { expires: new Date(Date.now() + 432000000) });
-
+    user.keys = await user.getKeys();
     user = pick(user, ...whitelist);
     res.send({ user, token });
   } catch (e) {
@@ -295,15 +328,16 @@ app.post("/login", async (req, res) => {
   }
 });
 
-
 app.post("/logout", auth, async (req, res) => {
   let { subscription } = req.body;
   l.info("logging out", req.user.username);
   if (!subscription) return res.end();
-  let i = req.user.subscriptions.findIndex(s => JSON.stringify(s) === subscription);
+  let i = req.user.subscriptions.findIndex(
+    s => JSON.stringify(s) === subscription
+  );
   if (i > -1) {
     req.user.subscriptions.splice(i, 1);
-  } 
+  }
   await req.user.save();
   res.end();
 });
@@ -399,4 +433,3 @@ app.post("/subscribe", auth, async function(req, res) {
   await req.user.save();
   res.sendStatus(201);
 });
-