fix 2fa

11 files changed, 36 insertions, 50 deletions

diff --git a/src/lib/invoice.js b/src/lib/invoice.js
index e280a1a1..4da3c9b4 100644
--- a/src/lib/invoice.js
+++ b/src/lib/invoice.js
@@ -5,12 +5,11 @@ export default async ({ cookies, request }) => {
 	let form = await request.formData();
 
 	let rates = await get('/rates');
-  let amount = 
-		parseInt(form.get('amount'));
+	let amount = parseInt(form.get('amount'));
 	let requester = form.get('requester');
 
 	let invoice = {
-    amount,
+		amount,
 		tip: parseInt(form.get('tip')),
 		network: 'lightning',
 		prompt: form.get('prompt') === 'true',
diff --git a/src/routes/(app)/+layout.svelte b/src/routes/(app)/+layout.svelte
index 67caf131..3d03e199 100644
--- a/src/routes/(app)/+layout.svelte
+++ b/src/routes/(app)/+layout.svelte
@@ -46,7 +46,7 @@
 	let checkSocket = () => {
 		counter++;
 		lost = Date.now() - $last > 15000;
-    if (lost) connect(token);
+		if (lost) connect(token);
 		if (counter > 5) {
 			send('heartbeat');
 			counter = 0;
diff --git a/src/routes/(app)/[username]/+page.svelte b/src/routes/(app)/[username]/+page.svelte
index 04b28b01..960cf897 100644
--- a/src/routes/(app)/[username]/+page.svelte
+++ b/src/routes/(app)/[username]/+page.svelte
@@ -52,16 +52,15 @@
 					</button>
 				</a>
 
-        {#if user}
-				<a href={`/${subject.username}/request`}>
-					<button class="rounded-full border py-2 px-5 font-bold hover:opacity-80 w-full mb-2"
-						>Ask to pay</button
-					>
-				</a>
-        {/if}
+				{#if user}
+					<a href={`/${subject.username}/request`}>
+						<button class="rounded-full border py-2 px-5 font-bold hover:opacity-80 w-full mb-2"
+							>Ask to pay</button
+						>
+					</a>
+				{/if}
 			</div>
 		{/if}
-
 	</div>
 
 	<div class="space-y-5 mt-5 sm:mt-20 mx-auto max-w-lg">
diff --git a/src/routes/(app)/[username]/request/+page.server.js b/src/routes/(app)/[username]/request/+page.server.js
index 18d3bbab..f32c118c 100644
--- a/src/routes/(app)/[username]/request/+page.server.js
+++ b/src/routes/(app)/[username]/request/+page.server.js
@@ -2,7 +2,6 @@ import { redirect } from '@sveltejs/kit';
 import { auth, post } from '$lib/utils';
 
 export let load = ({ locals }) => {
-  console.log("HERE", locals.user)
 	if (!locals.user) throw redirect(307, '/login');
 };
 
diff --git a/src/routes/(app)/[username]/settings/+page.server.js b/src/routes/(app)/[username]/settings/+page.server.js
index 713841c2..482b70b1 100644
--- a/src/routes/(app)/[username]/settings/+page.server.js
+++ b/src/routes/(app)/[username]/settings/+page.server.js
@@ -1,16 +1,5 @@
 import { invalid } from '@sveltejs/kit';
 import { auth, get, post } from '$lib/utils';
-import Qr from 'qrcode-base64';
-
-export async function load({ locals: { user } }) {
-	return {
-		otpQr: Qr.drawImg(
-			`otpauth://totp/coinos:${user.username}?secret=${user.otpsecret}&period=30&digits=6&algorithm=SHA1&issuer=coinos`,
-			{ size: 600 }
-		)
-	};
-}
-
 export const actions = {
 	default: async ({ cookies, locals, request }) => {
 		let form = Object.fromEntries(await request.formData());
diff --git a/src/routes/(app)/[username]/settings/+page.svelte b/src/routes/(app)/[username]/settings/+page.svelte
index f4660fab..250087c1 100644
--- a/src/routes/(app)/[username]/settings/+page.svelte
+++ b/src/routes/(app)/[username]/settings/+page.svelte
@@ -15,11 +15,11 @@
 	export let data;
 	export let form;
 
-	let { user, rates, token } = data;
+	let { user, token } = data;
 	$: update(data);
-	let update = () => ({ user, rates, token } = data);
+	let update = () => ({ user, token } = data);
 
-	$: form && ({ user } = form);
+	$: form?.user && ({ user } = form);
 
 	$: if (form?.message?.startsWith('Pin')) {
 		failure('Wrong pin, try again');
@@ -39,7 +39,6 @@
 	let loading, submit;
 	let save = async (msg) => {
 		loading = true;
-		if (typeof msg !== 'string') msg = 'Settings saved';
 
 		try {
 			if ($avatarUpload) {
@@ -49,8 +48,6 @@
 			if ($bannerUpload) {
 				await upload($bannerUpload.file, $bannerUpload.type, $bannerUpload.progress, token);
 			}
-
-			success(msg);
 		} catch (e) {
 			console.log(e);
 			failure('Something went wrong');
@@ -85,7 +82,7 @@
 			{/each}
 		</div>
 
-		<svelte:component this={comp} {user} {rates} {submit} />
+		<svelte:component this={comp} {user} {submit} />
 	</div>
 
 	<div
diff --git a/src/routes/(app)/[username]/settings/_pos.svelte b/src/routes/(app)/[username]/settings/_pos.svelte
index cf4a5ece..ccbeeff4 100644
--- a/src/routes/(app)/[username]/settings/_pos.svelte
+++ b/src/routes/(app)/[username]/settings/_pos.svelte
@@ -2,9 +2,9 @@
 	import { Icon, Toggle } from '$comp';
 	import { t } from '$lib/translations';
 	import { success, failure } from '$lib/utils';
+	import { page } from '$app/stores';
 
-	export let rates, user;
-
+	let { rates, user } = $page.data;
 	const fiats = Object.keys(rates);
 </script>
 
@@ -16,12 +16,3 @@
 		{/each}
 	</select>
 </div>
-
-<!-- TODO
-<div>
-	<label for="unit" class="font-bold block mb-1">{$t('user.settings.btcUnit')}</label>
-	<select disabled name="unit" class="select-styles block py-3 w-full" bind:value={user.unit}>
-		<option value="SAT">{$t('user.settings.satoshis')} (SAT)</option>
-		<option value="BTC">{$t('user.settings.bitcoin')} (BTC)</option>
-	</select>
-</div> -->
diff --git a/src/routes/(app)/[username]/settings/_security.svelte b/src/routes/(app)/[username]/settings/_security.svelte
index 98b9b503..4bdb00d4 100644
--- a/src/routes/(app)/[username]/settings/_security.svelte
+++ b/src/routes/(app)/[username]/settings/_security.svelte
@@ -5,9 +5,10 @@
 	import { Pincode, PincodeInput } from 'svelte-pincode';
 	import { post, success, failure } from '$lib/utils';
 	import { pin as current } from '$lib/store';
+	import { invalidate } from '$app/navigation';
+	import { page } from '$app/stores';
 
 	export let user, submit;
-
 	let settingPin, setting2fa, disabling2fa;
 
 	let token = '';
@@ -23,6 +24,12 @@
 
 	$: pin = pinCode.join('');
 
+	let otp;
+	$: pinChange($current);
+	let pinChange = async (pin) => {
+		otp = await post('/otpsecret', { pin });
+	};
+
 	let locked;
 	$: verifyCode.join('').length > 5 && checkPin();
 	let checkPin = async () => {
@@ -108,8 +115,6 @@
 			failure('Failed to disable 2FA, try again');
 		}
 	};
-
-	$: otpUri = `otpauth://totp/coinos:${user.username}?secret=${user.otpsecret}&period=30&digits=6&algorithm=SHA1&issuer=coinos`;
 </script>
 
 <div>
@@ -172,13 +177,13 @@
 		{$t('user.settings.twofaDescription')}
 	</p>
 	{#if setting2fa}
-		<a href={otpUri}>
-			<Qr text={otpUri} />
+		<a href={otp.uri}>
+			<Qr src={otp.qr} />
 		</a>
 
 		<div class="text-center my-4">
 			{$t('user.settings.accountId')}<br />
-			<b>{user.otpsecret}</b>
+			<b>{otp.secret}</b>
 		</div>
 
 		<div class="text-center my-4">
diff --git a/src/routes/(app)/invoice/[id]/+page.svelte b/src/routes/(app)/invoice/[id]/+page.svelte
index 6c86efde..f8ae91f1 100644
--- a/src/routes/(app)/invoice/[id]/+page.svelte
+++ b/src/routes/(app)/invoice/[id]/+page.svelte
@@ -73,7 +73,7 @@
 				<a href="/{username}" class="text-black font-semibold hover:opacity-80">
 					<div class="flex my-auto">
 						<Avatar user={username} size={12} />
-            <div class="my-auto">{username}</div>
+						<div class="my-auto">{username}</div>
 					</div>
 				</a>
 			</div>
diff --git a/src/routes/(app)/otpsecret/+server.js b/src/routes/(app)/otpsecret/+server.js
new file mode 100644
index 00000000..8dec7778
--- /dev/null
+++ b/src/routes/(app)/otpsecret/+server.js
@@ -0,0 +1,8 @@
+import { auth, post } from '$lib/utils';
+import Qr from 'qrcode-base64';
+
+export async function POST({ cookies, locals, request }) {
+	let { secret } = await post('/otpsecret', await request.json(), auth(cookies));
+	let uri = `otpauth://totp/coinos:${locals.user.username}?secret=${secret}&period=30&digits=6&algorithm=SHA1&issuer=coinos`;
+	return new Response(JSON.stringify({ secret, uri, qr: Qr.drawImg(uri, { size: 600 }) }));
+}
diff --git a/src/routes/(app)/send/[...text]/+page.server.js b/src/routes/(app)/send/[...text]/+page.server.js
index 5e274c67..77eea61f 100644
--- a/src/routes/(app)/send/[...text]/+page.server.js
+++ b/src/routes/(app)/send/[...text]/+page.server.js
@@ -46,7 +46,6 @@ let parse = async (t, r) => {
 		} catch (e) {
 			let r = `/send/bitcoin/${t}`;
 			if (amount) r += '/' + amount;
-			console.log('AM', amount);
 			throw redirect(307, r);
 		}