From 46e33eb5ba63276836322b11abfbff6432c98ff6 Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Fri, 6 Jan 2023 12:23:40 -0800 Subject: re-encrypt entropy on password change --- .../[username]/settings/[...tab]/+page.svelte | 92 ++++++++++++---------- .../[username]/settings/[...tab]/_account.svelte | 85 ++------------------ .../(app)/[username]/settings/[...tab]/_pos.svelte | 9 ++- .../[username]/settings/[...tab]/_security.svelte | 29 ++++++- src/routes/(app)/otpsecret/+server.js | 4 +- 5 files changed, 91 insertions(+), 128 deletions(-) (limited to 'src/routes') diff --git a/src/routes/(app)/[username]/settings/[...tab]/+page.svelte b/src/routes/(app)/[username]/settings/[...tab]/+page.svelte index b02ddca4..b2602625 100644 --- a/src/routes/(app)/[username]/settings/[...tab]/+page.svelte +++ b/src/routes/(app)/[username]/settings/[...tab]/+page.svelte @@ -6,10 +6,10 @@ import { Icon, Spinner, Pin } from '$comp'; import { t } from '$lib/translations'; import { failure, post, success } from '$lib/utils'; - import { avatarUpload, bannerUpload, pin } from '$lib/store'; + import { avatarUpload, bannerUpload, password, pin } from '$lib/store'; import { upload } from '$lib/upload'; import { page } from '$app/stores'; - import { sign, send } from '$lib/nostr'; + import { sign, send, reEncryptEntropy } from '$lib/nostr'; import { invalidateAll } from '$app/navigation'; import Account from './_account.svelte'; @@ -50,50 +50,62 @@ let loading; async function handleSubmit() { - loading = true; - let data = new FormData(formElement); - try { - if ($avatarUpload) { - await upload($avatarUpload.file, $avatarUpload.type, $avatarUpload.progress, token); + loading = true; + let data = new FormData(formElement); + + if (data.get('password')) { + console.log('reencrypting', user.cipher); + data.set('cipher', await reEncryptEntropy(user, data.get('password'))); + console.log(data.get('cipher')); + } + + try { + if ($avatarUpload) { + await upload($avatarUpload.file, $avatarUpload.type, $avatarUpload.progress, token); + } + + if ($bannerUpload) { + await upload($bannerUpload.file, $bannerUpload.type, $bannerUpload.progress, token); + } + } catch (e) { + console.log(e); + failure('Something went wrong'); } - if ($bannerUpload) { - await upload($bannerUpload.file, $bannerUpload.type, $bannerUpload.progress, token); + let event = { + pubkey: user.pubkey, + created_at: Math.floor(Date.now() / 1000), + kind: 0, + content: JSON.stringify({ + name: user.username, + about: user.address, + picture: `${PUBLIC_COINOS_URL}/public/${user.username}-profile.webp` + }), + tags: [] + }; + + await sign({ event, user }); + await send(event); + + const response = await fetch(formElement.action, { + method: 'POST', + body: data + }); + + const result = deserialize(await response.text()); + + if (result.type === 'success') { + await invalidateAll(); + if (data.get('password')) $password = data.get('password'); } + + applyAction(result); + loading = false; } catch (e) { console.log(e); - failure('Something went wrong'); - } - - let event = { - pubkey: user.pubkey, - created_at: Math.floor(Date.now() / 1000), - kind: 0, - content: JSON.stringify({ - name: user.username, - about: user.address, - picture: `${PUBLIC_COINOS_URL}/public/${user.username}-profile.webp` - }), - tags: [] - }; - - await sign({ event, user }); - await send(event); - - const response = await fetch(formElement.action, { - method: 'POST', - body: data - }); - - const result = deserialize(await response.text()); - - if (result.type === 'success') { - await invalidateAll(); + failure('Problem submitting form'); } - - applyAction(result); - loading = false; } let loaded; @@ -117,7 +129,7 @@ {$t('user.settings.header')} -
+
{#each tabs as { name, key }} -
+ + + +
@@ -105,27 +70,6 @@ />
- - - - - - - - - - - - - - - - - - - - -
{$t('user.settings.profileImage')} @@ -192,7 +136,6 @@
{$t('user.settings.bannerImage')}
- {#if banner} {/if} -
{/if}
- - diff --git a/src/routes/(app)/[username]/settings/[...tab]/_pos.svelte b/src/routes/(app)/[username]/settings/[...tab]/_pos.svelte index b4aa3181..bade7a99 100644 --- a/src/routes/(app)/[username]/settings/[...tab]/_pos.svelte +++ b/src/routes/(app)/[username]/settings/[...tab]/_pos.svelte @@ -1,13 +1,18 @@ +
+ + +
+
+ + + +
+ + {#if revealPassword} + + {:else} + + {/if} + +
+
{verifying ? $t('user.settings.verifyPIN') : $t('user.settings.securityPIN')} diff --git a/src/routes/(app)/otpsecret/+server.js b/src/routes/(app)/otpsecret/+server.js index f998fb17..31dbcec1 100644 --- a/src/routes/(app)/otpsecret/+server.js +++ b/src/routes/(app)/otpsecret/+server.js @@ -4,12 +4,12 @@ import { error } from '@sveltejs/kit'; export async function POST({ cookies, request }) { try { - let body = await request.json(); + let body = await request.json(); let { username, secret } = await post('/otpsecret', body, auth(cookies)); let uri = `otpauth://totp/coinos:${username}?secret=${secret}&period=30&digits=6&algorithm=SHA1&issuer=coinos`; return new Response(JSON.stringify({ secret, uri, qr: Qr.drawImg(uri, { size: 600 }) })); } catch (e) { - console.log(e) + console.log(e); throw new error(500, 'Problem saving secret'); } } -- cgit v1.2.3