2fa

1 files changed, 65 insertions, 12 deletions

diff --git a/users.js b/users.js
index e9530ecf..3196fc4c 100644
--- a/users.js
+++ b/users.js
@@ -12,12 +12,19 @@ const whitelist = require("./whitelist");
 const fb = "https://graph.facebook.com/";
 const liquid = new BitcoinCore(config.liquid);
 const Sequelize = require("sequelize");
+const authenticator = require("otplib").authenticator;
 
 const pick = (O, ...K) => K.reduce((o, k) => ((o[k] = O[k]), o), {});
 const l = console.log;
 let faucet = 1000;
 const DAY = 24 * 60 * 60 * 1000;
 
+const twofa = (req, res, next) => {
+  let { user, body: { token } } = req;
+  if (!user.twofa || authenticator.check(token, user.otpsecret)) next();
+  else res.status(401).end();
+};
+
 module.exports = (addresses, auth, app, bc, db, emit) => {
   app.get("/liquidate", async (req, res) => {
     let users = await db.User.findAll();
@@ -30,6 +37,11 @@ module.exports = (addresses, auth, app, bc, db, emit) => {
         )).unconfidential;
         await user.save();
       }
+
+      if (!user.otpsecret) {
+        user.otpsecret = authenticator.generateSecret();
+        await user.save();
+      } 
     }
     res.end();
   });
@@ -40,17 +52,17 @@ module.exports = (addresses, auth, app, bc, db, emit) => {
       faucet -= 100;
       const payment = await db.Payment.create({
         user_id: user.id,
-        hash: 'Welcome Gift',
+        hash: "Welcome Gift",
         amount: 100,
         currency: user.currency,
         rate: app.get("rates")[user.currency],
         received: true,
         confirmed: 1,
-        asset: 'GIFT',
+        asset: "GIFT"
       });
       await user.save();
     }
-  } 
+  };
 
   app.post("/register", async (req, res) => {
     let err = m => res.status(500).send(m);
@@ -66,22 +78,27 @@ module.exports = (addresses, auth, app, bc, db, emit) => {
       user.confidential
     )).unconfidential;
     user.name = user.username;
-    let ip = req.headers['x-forwarded-for'] || req.connection.remoteAddress;
+    let ip = req.headers["x-forwarded-for"] || req.connection.remoteAddress;
     let countries = {
       CA: "CAD",
       US: "USD",
       JP: "JPY",
       CN: "CNY",
       AU: "AUD",
-      GB: "GBP",
+      GB: "GBP"
     };
 
-    if (ip === "127.0.0.1")
-      user.currency = "CAD";
-    else 
-      user.currency = countries[(await axios.get(`http://api.ipstack.com/${ip}?access_key=${config.ipstack}`)).data.country_code] || "EUR";
+    if (ip === "127.0.0.1") user.currency = "CAD";
+    else
+      user.currency =
+        countries[
+          (await axios.get(
+            `http://api.ipstack.com/${ip}?access_key=${config.ipstack}`
+          )).data.country_code
+        ] || "EUR";
 
     user.currencies = [user.currency];
+    user.otpsecret = authenticator.generateSecret();
 
     addresses[user.address] = user.username;
     addresses[user.liquid] = user.username;
@@ -141,6 +158,39 @@ module.exports = (addresses, auth, app, bc, db, emit) => {
     res.end();
   });
 
+  app.post("/disable2fa", auth, twofa, async (req, res) => {
+    let { user } = req;
+    user.twofa = false;
+    await user.save();
+    emit(user.username, "user", user);
+    emit(user.username, "otpsecret", user.otpsecret);
+    res.end();
+  });
+
+  app.get("/otpsecret", auth, twofa, async (req, res) => {
+    let { user } = req;
+    emit(user.username, "otpsecret", user.otpsecret);
+    res.end();
+  });
+
+  app.post("/2fa", auth, async (req, res) => {
+    let { user } = req;
+    try {
+      const isValid = authenticator.check(req.body.token, req.user.otpsecret);
+      if (isValid) {
+        user.twofa = true;
+        user.save();
+        emit(user.username, "user", req.user);
+      }
+      else {
+        return res.status(500).send("Invalid token");
+      } 
+    } catch (e) {
+      l(e);
+    }
+    res.end();
+  });
+
   app.post("/user", auth, async (req, res) => {
     try {
       let { user } = req;
@@ -167,7 +217,9 @@ module.exports = (addresses, auth, app, bc, db, emit) => {
         user.username = username;
         addresses[user.address] = username;
         token = jwt.sign({ username }, config.jwt);
-        res.cookie("token", token, { expires: new Date(Date.now() + 432000000) });
+        res.cookie("token", token, {
+          expires: new Date(Date.now() + 432000000)
+        });
       }
 
       if (email && user.email !== email) {
@@ -303,7 +355,8 @@ module.exports = (addresses, auth, app, bc, db, emit) => {
 
       if (
         !user ||
-        (user.password && !(await bcrypt.compare(req.body.password, user.password))) ||
+        (user.password &&
+          !(await bcrypt.compare(req.body.password, user.password))) ||
         (user.twofa && !(await authyVerify(user)))
       ) {
         return res.status(401).end();
@@ -419,5 +472,5 @@ module.exports = (addresses, auth, app, bc, db, emit) => {
     }
   });
 
-  setInterval(() => faucet = 2000, DAY)
+  setInterval(() => (faucet = 2000), DAY);
 };