From 6f5602d112b68adb7452abf3047f20c32e7725b6 Mon Sep 17 00:00:00 2001
From: Adam Soltys <asoltys@gmail.com>
Date: Mon, 6 Feb 2023 16:42:02 -0800
Subject: auth middleware for disable2fa

---
 docker-compose.yml |  2 +-
 index.js           |  2 +-
 routes/payments.js | 12 ++++++------
 routes/users.js    |  4 ++--
 4 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index 70d12c24..9958458f 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -72,4 +72,4 @@ services:
       - "./data/nostr/data:/usr/src/app/db" 
       - "./data/nostr/config.toml:/usr/src/app/config.toml" 
     ports:
-      - '8080:8080'
+      - '8082:8080'
diff --git a/index.js b/index.js
index 9e380334..da7e6319 100644
--- a/index.js
+++ b/index.js
@@ -65,7 +65,7 @@ app.post("/bitcoin/send", auth, payments.send);
 app.get("/me", auth, users.me);
 app.get("/users/:key", users.get);
 app.post("/register", users.create);
-app.post("/disable2fa", users.disable2fa);
+app.post("/disable2fa", auth, users.disable2fa);
 app.post("/2fa", auth, users.enable2fa);
 app.post("/user", auth, users.update);
 app.post("/upload/:type", auth, users.upload);
diff --git a/routes/payments.js b/routes/payments.js
index 37f4c953..1043959c 100644
--- a/routes/payments.js
+++ b/routes/payments.js
@@ -240,19 +240,19 @@ export default {
     res.send({ txid });
   },
 
-  async del({ params: { username }, headers: { authorization }}, res) {
-if (!authorization.includes(config.admin)) return res.code(401).send("unauthorized")
+  async del({ params: { username }, headers: { authorization } }, res) {
+    if (!authorization.includes(config.admin))
+      return res.code(401).send("unauthorized");
     let { id, pubkey } = await g(`user:${await g(`user:${username}`)}`);
     let invoices = await db.lRange(`${id}:invoices`, 0, -1);
     let payments = await db.lRange(`${id}:payments`, 0, -1);
 
-    for (let {id} of invoices) db.del(`invoice:${id}`);
-    for (let {id} of payments) db.del(`payment:${id}`);
+    for (let { id } of invoices) db.del(`invoice:${id}`);
+    for (let { id } of payments) db.del(`payment:${id}`);
     db.del(`user:${username}`);
     db.del(`user:${id}`);
     db.del(`user:${pubkey}`);
 
     res.send({});
-  } 
+  }
 };
-
diff --git a/routes/users.js b/routes/users.js
index 4fcc50df..17d4e1da 100644
--- a/routes/users.js
+++ b/routes/users.js
@@ -134,7 +134,7 @@ export default {
 
     if (user.pin && !(pin === user.pin)) throw new Error("Pin required");
     if (typeof newpin !== "undefined") user.pin = newpin;
-    if (!user.pin) user.pin = null;
+    if (!user.pin || user.pin === "undefined") delete user.pin;
 
     let exists;
     if (username) exists = await g(`user:${username}`);
@@ -237,7 +237,7 @@ export default {
               if (!p.with) continue;
 
               let id = await g(`user:${p.with.username}`);
-              let u = id && await g(`user:${id}`);
+              let u = id && (await g(`user:${id}`));
 
               if (!u) {
                 u = await got(`${classic}/admin/migrate/${p.with.username}`, {
-- 
cgit v1.2.3