From 7de58997e771312e41bca5cacca01ce4cbc990af Mon Sep 17 00:00:00 2001
From: Adam Soltys <adam@coinos.io>
Date: Wed, 1 Oct 2025 07:33:45 -0700
Subject: challenge verify

---
 routes/users.ts | 16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

(limited to 'routes')

diff --git a/routes/users.ts b/routes/users.ts
index bca6e009..812fd2a9 100644
--- a/routes/users.ts
+++ b/routes/users.ts
@@ -325,13 +325,16 @@ export default {
 
   async login(req, res) {
     try {
-      let { username, password, token: twofa } = req.body;
+      let { challenge, username, password, token: twofa } = req.body;
+
+      const verified = await db.exists(`challenge:${challenge}`);
 
       username = username.toLowerCase().replace(/\s/g, "");
       let user = await getUser(username);
 
       if (password !== config?.adminpass) {
         if (
+          !verified ||
           !user ||
           !user.password ||
           !(await Bun.password.verify(password, user.password))
@@ -373,17 +376,6 @@ export default {
     res.send({ challenge: id });
   },
 
-  async challengeVerify(req, res) {
-    try {
-      const { challenge: id } = req.body;
-      const verified = await db.exists(`challenge:${id}`);
-      if (!verified) fail("Challenge not found");
-      res.send(verified);
-    } catch (e) {
-      bail(res, e.message);
-    }
-  },
-
   async nostrAuth(req, res) {
     try {
       const { event, challenge, twofa } = req.body;
-- 
cgit v1.2.3