login challenge

3 files changed, 15 insertions, 16 deletions

diff --git a/src/lib/utils.ts b/src/lib/utils.ts
index ad95f29a..28a219e1 100644
--- a/src/lib/utils.ts
+++ b/src/lib/utils.ts
@@ -488,5 +488,3 @@ export const register = async (user, ip, cookies, loginRedirect) => {
 	if (error) return svelteFail(400, { error });
 	redirect(303, loginRedirect || `/${user.username}`);
 };
-
-export const captchas = new Set();
diff --git a/src/routes/(static)/login/+page.server.ts b/src/routes/(static)/login/+page.server.ts
index f75b88d8..788c938e 100644
--- a/src/routes/(static)/login/+page.server.ts
+++ b/src/routes/(static)/login/+page.server.ts
@@ -1,26 +1,28 @@
-import { randomUUID } from "crypto";
 import { PUBLIC_COINOS_URL } from "$env/static/public";
-import { fd, get, login } from "$lib/utils";
+import { fd, get, login, post } from "$lib/utils";
 import { fail, redirect } from "@sveltejs/kit";
 
-const captchas = new Set();
 export const load = async ({ parent }) => {
 	const { user } = await parent();
 	if (user?.pubkey) redirect(307, `/${user.username}`);
 	const { challenge } = await get("/challenge");
-	const captcha = randomUUID();
-	captchas.add(captcha);
-	setTimeout(() => captchas.delete(captcha), 120000);
-	return { challenge, captcha };
+	return { challenge };
 };
 
 export const actions = {
 	login: async ({ cookies, request }) => {
 		const form = await fd(request);
-		let { username, password, token, loginRedirect, captcha } = form;
-		console.log(captchas, captchas.has(captcha), captcha);
-		if (!captchas.has(captcha))
-			return fail(400, { error: "Login form expired", message: "Login form expired", ...form });
+		let { username, password, token, loginRedirect, challenge } = form;
+
+		try {
+			await post("/challenge/verify", { challenge });
+		} catch (e) {
+			return fail(400, {
+				error: "Login form expired",
+				message: "Login form expired",
+				...form,
+			});
+		}
 
 		const user = {
 			username,
diff --git a/src/routes/(static)/login/+page.svelte b/src/routes/(static)/login/+page.svelte
index dc43e76d..09b5258b 100644
--- a/src/routes/(static)/login/+page.svelte
+++ b/src/routes/(static)/login/+page.svelte
@@ -36,7 +36,7 @@
     if (lang) document.cookie = `lang=${lang} ;`;
   });
 
-  let { challenge, captcha } = $derived(data);
+  let { challenge } = $derived(data);
   let token = $state("");
 
   let cancel = () => (need2fa = false);
@@ -107,7 +107,6 @@
       formData.append("loginRedirect", redirect);
       formData.append("token", token);
       formData.append("event", JSON.stringify(signedEvent));
-      formData.append("challenge", challenge);
 
       let response = await fetch("/login?/nostr", {
         method: "POST",
@@ -142,7 +141,7 @@
   >
     <input type="hidden" name="loginRedirect" value={redirect} />
     <input type="hidden" name="token" value={token} />
-    <input type="hidden" name="captcha" value={captcha} />
+    <input type="hidden" name="challenge" value={challenge} />
 
     <input
       name="username"