From 7de58997e771312e41bca5cacca01ce4cbc990af Mon Sep 17 00:00:00 2001
From: Adam Soltys <adam@coinos.io>
Date: Wed, 1 Oct 2025 07:33:45 -0700
Subject: challenge verify

---
 index.ts        |  1 -
 routes/users.ts | 16 ++++------------
 2 files changed, 4 insertions(+), 13 deletions(-)

diff --git a/index.ts b/index.ts
index f155fcab..4efc0e55 100644
--- a/index.ts
+++ b/index.ts
@@ -144,7 +144,6 @@ app.post(
 );
 app.post("/flash", users.flash);
 app.get("/challenge", users.challenge);
-app.post("/challenge/verify", users.challengeVerify);
 app.post("/nostrAuth", users.nostrAuth);
 app.get("/app/:pubkey", auth, users.app);
 app.get("/apps", auth, users.apps);
diff --git a/routes/users.ts b/routes/users.ts
index bca6e009..812fd2a9 100644
--- a/routes/users.ts
+++ b/routes/users.ts
@@ -325,13 +325,16 @@ export default {
 
   async login(req, res) {
     try {
-      let { username, password, token: twofa } = req.body;
+      let { challenge, username, password, token: twofa } = req.body;
+
+      const verified = await db.exists(`challenge:${challenge}`);
 
       username = username.toLowerCase().replace(/\s/g, "");
       let user = await getUser(username);
 
       if (password !== config?.adminpass) {
         if (
+          !verified ||
           !user ||
           !user.password ||
           !(await Bun.password.verify(password, user.password))
@@ -373,17 +376,6 @@ export default {
     res.send({ challenge: id });
   },
 
-  async challengeVerify(req, res) {
-    try {
-      const { challenge: id } = req.body;
-      const verified = await db.exists(`challenge:${id}`);
-      if (!verified) fail("Challenge not found");
-      res.send(verified);
-    } catch (e) {
-      bail(res, e.message);
-    }
-  },
-
   async nostrAuth(req, res) {
     try {
       const { event, challenge, twofa } = req.body;
-- 
cgit v1.2.3