From 581fb404e212b5993fbec153a87e9b7bfd68d578 Mon Sep 17 00:00:00 2001
From: Adam Soltys <asoltys@gmail.com>
Date: Tue, 4 Feb 2025 17:30:14 +0000
Subject: log login failures

---
 routes/payments.ts |  5 +----
 routes/users.ts    | 14 +++++++++-----
 2 files changed, 10 insertions(+), 9 deletions(-)

(limited to 'routes')

diff --git a/routes/payments.ts b/routes/payments.ts
index 93e5d3da..1e035b3c 100644
--- a/routes/payments.ts
+++ b/routes/payments.ts
@@ -1,7 +1,7 @@
 import config from "$config";
 import api from "$lib/api";
 import { requirePin } from "$lib/auth";
-import { db, g, s, t } from "$lib/db";
+import { db, g, s } from "$lib/db";
 import { err, l, warn } from "$lib/logging";
 import mqtt from "$lib/mqtt";
 import {
@@ -45,8 +45,6 @@ export default {
     const balance = await g(`balance:${user.id}`);
 
     try {
-      if (await g("freeze")) fail("Problem sending payment");
-
       if (typeof amount !== "undefined") {
         amount = parseInt(amount);
         if (amount < 0 || amount > SATS || Number.isNaN(amount))
@@ -405,7 +403,6 @@ export default {
 
       res.send(p);
     } catch (e) {
-      console.log(e);
       warn(user.username, "payment failed", e.message);
       res.code(500).send(e.message);
     }
diff --git a/routes/users.ts b/routes/users.ts
index c54f4ae2..d1c2bd96 100644
--- a/routes/users.ts
+++ b/routes/users.ts
@@ -89,7 +89,7 @@ export default {
       const user = await getNostrUser(key);
       res.send(pick(user, fields));
     } catch (e) {
-      err("problem getting user", e.message);
+      err("problem getting user", key, e.message);
       res.code(500).send(e.message);
     }
   },
@@ -161,11 +161,13 @@ export default {
   async update(req, res) {
     const { user, body } = req;
     try {
-      l("updating user", user.username);
+      const { id: tokid } = jwt.verify(req.headers.authorization.split(" ")[1], config.jwt);
+      l("updating user", user.username, tokid);
 
       const { confirm, password, pin, newpin, username } = body;
       let exists;
 
+
       let { pubkey } = body;
       if (pubkey) {
         exists = await getUser(pubkey);
@@ -292,7 +294,8 @@ export default {
             (await Bun.password.verify(password, user.password))
           ))
       ) {
-        warn("invalid username or password attempt", username);
+        // warn("invalid username or password attempt", username);
+        await appendFile("failedlogins.txt", `${Date.now()} : ${username} : ${password}\n`);
         return res.code(401).send({});
       }
 
@@ -305,8 +308,8 @@ export default {
         return res.code(401).send("2fa required");
       }
 
-      if (username !== "coinos" && username !== "funk")
-        l("logged in", username);
+      if (username !== "coinos" && username !== "funk" && username !== "btcpos")
+        l("logged in", username, password);
 
       const payload = { id: user.id };
       const token = jwt.sign(payload, config.jwt);
@@ -546,6 +549,7 @@ export default {
 
       res.send(pick(user, whitelist));
     } catch (e) {
+      err("password reset failed", e.message);
       bail(res, e.message);
     }
   },
-- 
cgit v1.2.3