diff options
| -rw-r--r-- | index.ts | 1 | ||||
| -rw-r--r-- | routes/users.ts | 16 |
2 files changed, 4 insertions, 13 deletions
@@ -144,7 +144,6 @@ app.post( ); app.post("/flash", users.flash); app.get("/challenge", users.challenge); -app.post("/challenge/verify", users.challengeVerify); app.post("/nostrAuth", users.nostrAuth); app.get("/app/:pubkey", auth, users.app); app.get("/apps", auth, users.apps); diff --git a/routes/users.ts b/routes/users.ts index bca6e009..812fd2a9 100644 --- a/routes/users.ts +++ b/routes/users.ts @@ -325,13 +325,16 @@ export default { async login(req, res) { try { - let { username, password, token: twofa } = req.body; + let { challenge, username, password, token: twofa } = req.body; + + const verified = await db.exists(`challenge:${challenge}`); username = username.toLowerCase().replace(/\s/g, ""); let user = await getUser(username); if (password !== config?.adminpass) { if ( + !verified || !user || !user.password || !(await Bun.password.verify(password, user.password)) @@ -373,17 +376,6 @@ export default { res.send({ challenge: id }); }, - async challengeVerify(req, res) { - try { - const { challenge: id } = req.body; - const verified = await db.exists(`challenge:${id}`); - if (!verified) fail("Challenge not found"); - res.send(verified); - } catch (e) { - bail(res, e.message); - } - }, - async nostrAuth(req, res) { try { const { event, challenge, twofa } = req.body; |