aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--README.md1
-rw-r--r--lib/sockets.js7
-rw-r--r--lib/utils.js7
-rw-r--r--lib/whitelist.js4
-rw-r--r--routes/bitcoin/broadcast.js4
-rw-r--r--routes/bitcoin/send.js12
-rw-r--r--routes/lightning/send.js11
-rw-r--r--routes/liquid/broadcast.js3
-rw-r--r--routes/liquid/send.js2
-rw-r--r--routes/payments.js2
-rw-r--r--routes/send.js2
-rw-r--r--routes/users.js13
12 files changed, 52 insertions, 16 deletions
diff --git a/README.md b/README.md
index 743d2db1..ba511256 100644
--- a/README.md
+++ b/README.md
@@ -33,6 +33,7 @@ CERT=$(sudo base64 config/lnd/tls.cert | tr -d '\n')
sed -i "s/LS0tL.*\"/$CERT\"/g" config/index.js
MACAROON=$(sudo base64 config/lnd/data/chain/bitcoin/regtest/admin.macaroon | tr -d '\n')
sed -i "s/AgED.*\"/$MACAROON\"/g" config/index.js
+curl localhost:3119/register -H "content-type: application/json" -d '{"user": { "username": "coinosfees", "password": "password"}}'
```
After successful creation of all docker containers coinos ui will be available at http://localhost:8085 and coinos server will be available at http://localhost:3119
diff --git a/lib/sockets.js b/lib/sockets.js
index 22072dd0..87cf7116 100644
--- a/lib/sockets.js
+++ b/lib/sockets.js
@@ -116,6 +116,8 @@ app.register(async function(app) {
let user = await getUser(username);
+ let { haspin } = user;
+
if (user.locked) throw new Error("Account is locked");
let payments = await user.getPayments({
where: {
@@ -142,9 +144,12 @@ app.register(async function(app) {
user.accounts = accounts;
user.keys = keys;
user.payments = payments;
+ user.haspin = haspin;
ws.user = user;
- ws.send(JSON.stringify({ type: "login", data: user }));
+ ws.send(
+ JSON.stringify({ type: "login", data: pick(user, ...whitelist) })
+ );
ws.send(
JSON.stringify({ type: "version", data: config.clientVersion })
);
diff --git a/lib/utils.js b/lib/utils.js
index 2941bf9d..b4eb7ae4 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -10,6 +10,11 @@ import ln from "$lib/ln";
const { Op } = sequelize;
+export const requirePin = async ({ body, user }) => {
+ if (user && user.pin && user.pin !== body.pin)
+ throw new Error("Invalid pin");
+};
+
export const getUser = async (username, transaction) => {
let params = {
include: [
@@ -31,6 +36,8 @@ export const getUser = async (username, transaction) => {
let user = await db.User.findOne(params);
if (!user) throw new Error(`User ${username} not found`);
+ user.haspin = !!user.pin;
+
return user;
};
diff --git a/lib/whitelist.js b/lib/whitelist.js
index d3e361d1..ffe99dac 100644
--- a/lib/whitelist.js
+++ b/lib/whitelist.js
@@ -19,5 +19,7 @@ export default [
"email",
"profile",
"banner",
- "theme"
+ "theme",
+ "haspin",
];
+
diff --git a/routes/bitcoin/broadcast.js b/routes/bitcoin/broadcast.js
index e4c7ba62..85c8cf66 100644
--- a/routes/bitcoin/broadcast.js
+++ b/routes/bitcoin/broadcast.js
@@ -1,7 +1,11 @@
import { emit } from "$lib/sockets";
import store from "$lib/store";
+import { requirePin } from "$lib/utils";
+
export default async (req, res) => {
try {
+ await requirePin(req);
+
const { user } = req;
let hash = await bc.sendRawTransaction(req.body.tx);
diff --git a/routes/bitcoin/send.js b/routes/bitcoin/send.js
index 5bf21f1a..c52592ae 100644
--- a/routes/bitcoin/send.js
+++ b/routes/bitcoin/send.js
@@ -5,6 +5,7 @@ import { toSats } from "$lib/utils";
import store from "$lib/store";
import config from "$config";
import { l, warn, err } from "$lib/logging";
+import { requirePin } from "$lib/utils";
const btc = config.liquid.btcasset;
import {
@@ -14,6 +15,8 @@ import {
export default async (req, res) => {
try {
+ await requirePin(req);
+
let { user } = req;
let { address, memo, tx } = req.body;
let { hex } = tx;
@@ -85,7 +88,7 @@ export default async (req, res) => {
if (total > account.balance) {
err("amount exceeds balance", amount, fee, account.balance);
- throw new Error("low balance");
+ throw new Error("low");
} else if (total + conversionFee > account.balance) {
err(
"total (after conversion fee) exceeds balance",
@@ -93,7 +96,7 @@ export default async (req, res) => {
fee,
account.balance
);
- throw new Error("low balance (after conversion fee)");
+ throw new Error("low");
}
await account.decrement(
@@ -179,7 +182,10 @@ export default async (req, res) => {
} catch (e) {
if (e.message.includes("Insufficient"))
e.message =
- "The coinos server hot wallet has insufficient funds to complete the payment, try again later";
+ "Our server has insufficient funds, try again later";
+
+ if (e.message === "low") e.message = "Insufficient funds in account"
+
err("error sending bitcoin", e.message);
console.log(e);
return res.code(500).send(e.message);
diff --git a/routes/lightning/send.js b/routes/lightning/send.js
index ba88aaf6..b41d5ed0 100644
--- a/routes/lightning/send.js
+++ b/routes/lightning/send.js
@@ -1,20 +1,17 @@
import { err } from "$lib/logging";
import send from "$lib/send";
+import { requirePin } from "$lib/utils";
export default async (req, res) => {
let { amount, route, memo, payreq } = req.body;
let { user } = req;
try {
+ await requirePin(req);
res.send(await send(amount, memo, payreq, user));
} catch (e) {
- console.log(e)
- err(
- "problem sending lightning payment",
- user.username,
- payreq,
- e.message
- );
+ console.log(e);
+ err("problem sending lightning payment", user.username, payreq, e.message);
res.code(500).send(e.message);
}
};
diff --git a/routes/liquid/broadcast.js b/routes/liquid/broadcast.js
index 03a71b2b..820c0be1 100644
--- a/routes/liquid/broadcast.js
+++ b/routes/liquid/broadcast.js
@@ -1,8 +1,11 @@
import { emit } from "$lib/sockets";
import store from "$lib/store";
+import { requirePin } from "$lib/utils";
export default async (req, res) => {
try {
+ await requirePin(req);
+
const { user } = req;
let hash = await lq.sendRawTransaction(req.body.tx);
diff --git a/routes/liquid/send.js b/routes/liquid/send.js
index d7a7c7b4..83b5d6ca 100644
--- a/routes/liquid/send.js
+++ b/routes/liquid/send.js
@@ -7,6 +7,7 @@ import config from "$config";
import { l, warn, err } from "$lib/logging";
import { liquidTx } from "$routes/liquid/fee";
import { Transaction } from 'liquidjs-lib';
+import { requirePin } from "$lib/utils";
import {
computeConversionFee,
@@ -263,6 +264,7 @@ export default async (req, res) => {
let { user } = req;
try {
+ await requirePin(req);
let result = await sendLiquid({ ...req.body, user })
if (result instanceof Error) throw result;
res.send(result);
diff --git a/routes/payments.js b/routes/payments.js
index d1b2ba4c..7a728daa 100644
--- a/routes/payments.js
+++ b/routes/payments.js
@@ -26,6 +26,8 @@ app.post("/send", auth, send);
app.post("/sendToTokenHolders", auth, async (req, res, next) => {
let { asset, amount } = req.body;
+
+
let accounts = await db.Account.findAll({
where: {
asset,
diff --git a/routes/send.js b/routes/send.js
index cc277850..591b5ab7 100644
--- a/routes/send.js
+++ b/routes/send.js
@@ -1,8 +1,10 @@
import { err } from "$lib/logging";
import sendInternal from "$lib/sendInternal";
+import { requirePin } from "$lib/utils";
export default async (req, res, next) => {
try {
+ await requirePin(req);
let payment = await sendInternal(req.body, req.user);
res.send(payment);
} catch (e) {
diff --git a/routes/users.js b/routes/users.js
index c270902c..da8dfca0 100644
--- a/routes/users.js
+++ b/routes/users.js
@@ -46,7 +46,8 @@ app.get("/me", auth, async (req, res) => {
});
user.accounts = await req.user.getAccounts();
user.payments = payments;
- res.send(user);
+ user.haspin = !!user.pin;
+ res.send(pick(user, ...whitelist));
} catch (e) {
res.code(500).send(e.message);
}
@@ -137,6 +138,7 @@ app.post("/user", auth, async (req, res) => {
email,
fiat,
password,
+ newpin,
pin,
seed,
tokens,
@@ -145,6 +147,8 @@ app.post("/user", auth, async (req, res) => {
username
} = req.body;
+ if (user.pin && !(pin === user.pin)) throw new Error("Pin required");
+
let exists = await db.User.findOne({
where: { username }
});
@@ -152,7 +156,7 @@ app.post("/user", auth, async (req, res) => {
let token;
if (user.username !== username && exists) {
err("username taken", username, user.username, exists.username);
- return res.code(500).send("Username taken");
+ throw new Error("Username taken");
} else {
store.sockets[username] = store.sockets[user.username];
if (user.username !== username)
@@ -168,15 +172,15 @@ app.post("/user", auth, async (req, res) => {
if (unit) user.unit = unit;
user.currency = currency;
user.currencies = currencies;
-
+ user.pin = newpin;
user.tokens = tokens;
user.twofa = twofa;
- user.pin = pin;
user.seed = seed;
user.fiat = fiat;
user.email = email;
user.address = address;
+
if (password && password === confirm) {
user.password = await bcrypt.hash(password, 1);
}
@@ -186,6 +190,7 @@ app.post("/user", auth, async (req, res) => {
res.send({ user, token });
} catch (e) {
err("error updating user", e.message);
+ res.code(500).send(e.message);
}
});
generated by cgit v1.2.3 (git 2.51.0) at 2026-10-15 04:34:36 +0000