From 2d7352ed9642ceea8beb32723191eb16d56830a6 Mon Sep 17 00:00:00 2001
From: Adam Soltys <asoltys@gmail.com>
Date: Tue, 25 Oct 2022 13:55:28 -0700
Subject: require pin on certain endpoints

---
 lib/sockets.js   | 7 ++++++-
 lib/utils.js     | 7 +++++++
 lib/whitelist.js | 4 +++-
 3 files changed, 16 insertions(+), 2 deletions(-)

(limited to 'lib')

diff --git a/lib/sockets.js b/lib/sockets.js
index 22072dd0..87cf7116 100644
--- a/lib/sockets.js
+++ b/lib/sockets.js
@@ -116,6 +116,8 @@ app.register(async function(app) {
 
             let user = await getUser(username);
 
+            let { haspin } = user;
+
             if (user.locked) throw new Error("Account is locked");
             let payments = await user.getPayments({
               where: {
@@ -142,9 +144,12 @@ app.register(async function(app) {
             user.accounts = accounts;
             user.keys = keys;
             user.payments = payments;
+            user.haspin = haspin;
 
             ws.user = user;
-            ws.send(JSON.stringify({ type: "login", data: user }));
+            ws.send(
+              JSON.stringify({ type: "login", data: pick(user, ...whitelist) })
+            );
             ws.send(
               JSON.stringify({ type: "version", data: config.clientVersion })
             );
diff --git a/lib/utils.js b/lib/utils.js
index 2941bf9d..b4eb7ae4 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -10,6 +10,11 @@ import ln from "$lib/ln";
 
 const { Op } = sequelize;
 
+export const requirePin = async ({ body, user }) => {
+  if (user && user.pin && user.pin !== body.pin)
+    throw new Error("Invalid pin");
+};
+
 export const getUser = async (username, transaction) => {
   let params = {
     include: [
@@ -31,6 +36,8 @@ export const getUser = async (username, transaction) => {
   let user = await db.User.findOne(params);
   if (!user) throw new Error(`User ${username} not found`);
 
+  user.haspin = !!user.pin;
+
   return user;
 };
 
diff --git a/lib/whitelist.js b/lib/whitelist.js
index d3e361d1..ffe99dac 100644
--- a/lib/whitelist.js
+++ b/lib/whitelist.js
@@ -19,5 +19,7 @@ export default [
   "email",
   "profile",
   "banner",
-  "theme"
+  "theme",
+  "haspin",
 ];
+
-- 
cgit v1.2.3