From 545c5a016eba8128d4ade02aa506b8821a00a38c Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Tue, 8 Nov 2022 02:22:18 -0800 Subject: fix 2fa --- src/lib/invoice.js | 5 ++--- src/routes/(app)/+layout.svelte | 2 +- src/routes/(app)/[username]/+page.svelte | 15 +++++++-------- src/routes/(app)/[username]/request/+page.server.js | 1 - src/routes/(app)/[username]/settings/+page.server.js | 11 ----------- src/routes/(app)/[username]/settings/+page.svelte | 11 ++++------- src/routes/(app)/[username]/settings/_pos.svelte | 13 ++----------- src/routes/(app)/[username]/settings/_security.svelte | 17 +++++++++++------ src/routes/(app)/invoice/[id]/+page.svelte | 2 +- src/routes/(app)/otpsecret/+server.js | 8 ++++++++ src/routes/(app)/send/[...text]/+page.server.js | 1 - 11 files changed, 36 insertions(+), 50 deletions(-) create mode 100644 src/routes/(app)/otpsecret/+server.js (limited to 'src') diff --git a/src/lib/invoice.js b/src/lib/invoice.js index e280a1a1..4da3c9b4 100644 --- a/src/lib/invoice.js +++ b/src/lib/invoice.js @@ -5,12 +5,11 @@ export default async ({ cookies, request }) => { let form = await request.formData(); let rates = await get('/rates'); - let amount = - parseInt(form.get('amount')); + let amount = parseInt(form.get('amount')); let requester = form.get('requester'); let invoice = { - amount, + amount, tip: parseInt(form.get('tip')), network: 'lightning', prompt: form.get('prompt') === 'true', diff --git a/src/routes/(app)/+layout.svelte b/src/routes/(app)/+layout.svelte index 67caf131..3d03e199 100644 --- a/src/routes/(app)/+layout.svelte +++ b/src/routes/(app)/+layout.svelte @@ -46,7 +46,7 @@ let checkSocket = () => { counter++; lost = Date.now() - $last > 15000; - if (lost) connect(token); + if (lost) connect(token); if (counter > 5) { send('heartbeat'); counter = 0; diff --git a/src/routes/(app)/[username]/+page.svelte b/src/routes/(app)/[username]/+page.svelte index 04b28b01..960cf897 100644 --- a/src/routes/(app)/[username]/+page.svelte +++ b/src/routes/(app)/[username]/+page.svelte @@ -52,16 +52,15 @@ - {#if user} - - - - {/if} + {#if user} + + + + {/if} {/if} -
diff --git a/src/routes/(app)/[username]/request/+page.server.js b/src/routes/(app)/[username]/request/+page.server.js index 18d3bbab..f32c118c 100644 --- a/src/routes/(app)/[username]/request/+page.server.js +++ b/src/routes/(app)/[username]/request/+page.server.js @@ -2,7 +2,6 @@ import { redirect } from '@sveltejs/kit'; import { auth, post } from '$lib/utils'; export let load = ({ locals }) => { - console.log("HERE", locals.user) if (!locals.user) throw redirect(307, '/login'); }; diff --git a/src/routes/(app)/[username]/settings/+page.server.js b/src/routes/(app)/[username]/settings/+page.server.js index 713841c2..482b70b1 100644 --- a/src/routes/(app)/[username]/settings/+page.server.js +++ b/src/routes/(app)/[username]/settings/+page.server.js @@ -1,16 +1,5 @@ import { invalid } from '@sveltejs/kit'; import { auth, get, post } from '$lib/utils'; -import Qr from 'qrcode-base64'; - -export async function load({ locals: { user } }) { - return { - otpQr: Qr.drawImg( - `otpauth://totp/coinos:${user.username}?secret=${user.otpsecret}&period=30&digits=6&algorithm=SHA1&issuer=coinos`, - { size: 600 } - ) - }; -} - export const actions = { default: async ({ cookies, locals, request }) => { let form = Object.fromEntries(await request.formData()); diff --git a/src/routes/(app)/[username]/settings/+page.svelte b/src/routes/(app)/[username]/settings/+page.svelte index f4660fab..250087c1 100644 --- a/src/routes/(app)/[username]/settings/+page.svelte +++ b/src/routes/(app)/[username]/settings/+page.svelte @@ -15,11 +15,11 @@ export let data; export let form; - let { user, rates, token } = data; + let { user, token } = data; $: update(data); - let update = () => ({ user, rates, token } = data); + let update = () => ({ user, token } = data); - $: form && ({ user } = form); + $: form?.user && ({ user } = form); $: if (form?.message?.startsWith('Pin')) { failure('Wrong pin, try again'); @@ -39,7 +39,6 @@ let loading, submit; let save = async (msg) => { loading = true; - if (typeof msg !== 'string') msg = 'Settings saved'; try { if ($avatarUpload) { @@ -49,8 +48,6 @@ if ($bannerUpload) { await upload($bannerUpload.file, $bannerUpload.type, $bannerUpload.progress, token); } - - success(msg); } catch (e) { console.log(e); failure('Something went wrong'); @@ -85,7 +82,7 @@ {/each}
- +
@@ -16,12 +16,3 @@ {/each}
- - diff --git a/src/routes/(app)/[username]/settings/_security.svelte b/src/routes/(app)/[username]/settings/_security.svelte index 98b9b503..4bdb00d4 100644 --- a/src/routes/(app)/[username]/settings/_security.svelte +++ b/src/routes/(app)/[username]/settings/_security.svelte @@ -5,9 +5,10 @@ import { Pincode, PincodeInput } from 'svelte-pincode'; import { post, success, failure } from '$lib/utils'; import { pin as current } from '$lib/store'; + import { invalidate } from '$app/navigation'; + import { page } from '$app/stores'; export let user, submit; - let settingPin, setting2fa, disabling2fa; let token = ''; @@ -23,6 +24,12 @@ $: pin = pinCode.join(''); + let otp; + $: pinChange($current); + let pinChange = async (pin) => { + otp = await post('/otpsecret', { pin }); + }; + let locked; $: verifyCode.join('').length > 5 && checkPin(); let checkPin = async () => { @@ -108,8 +115,6 @@ failure('Failed to disable 2FA, try again'); } }; - - $: otpUri = `otpauth://totp/coinos:${user.username}?secret=${user.otpsecret}&period=30&digits=6&algorithm=SHA1&issuer=coinos`;
@@ -172,13 +177,13 @@ {$t('user.settings.twofaDescription')}

{#if setting2fa} - - + +
{$t('user.settings.accountId')}
- {user.otpsecret} + {otp.secret}
diff --git a/src/routes/(app)/invoice/[id]/+page.svelte b/src/routes/(app)/invoice/[id]/+page.svelte index 6c86efde..f8ae91f1 100644 --- a/src/routes/(app)/invoice/[id]/+page.svelte +++ b/src/routes/(app)/invoice/[id]/+page.svelte @@ -73,7 +73,7 @@
-
{username}
+
{username}
diff --git a/src/routes/(app)/otpsecret/+server.js b/src/routes/(app)/otpsecret/+server.js new file mode 100644 index 00000000..8dec7778 --- /dev/null +++ b/src/routes/(app)/otpsecret/+server.js @@ -0,0 +1,8 @@ +import { auth, post } from '$lib/utils'; +import Qr from 'qrcode-base64'; + +export async function POST({ cookies, locals, request }) { + let { secret } = await post('/otpsecret', await request.json(), auth(cookies)); + let uri = `otpauth://totp/coinos:${locals.user.username}?secret=${secret}&period=30&digits=6&algorithm=SHA1&issuer=coinos`; + return new Response(JSON.stringify({ secret, uri, qr: Qr.drawImg(uri, { size: 600 }) })); +} diff --git a/src/routes/(app)/send/[...text]/+page.server.js b/src/routes/(app)/send/[...text]/+page.server.js index 5e274c67..77eea61f 100644 --- a/src/routes/(app)/send/[...text]/+page.server.js +++ b/src/routes/(app)/send/[...text]/+page.server.js @@ -46,7 +46,6 @@ let parse = async (t, r) => { } catch (e) { let r = `/send/bitcoin/${t}`; if (amount) r += '/' + amount; - console.log('AM', amount); throw redirect(307, r); } -- cgit v1.2.3