From 717fd3fe382100a4e398d192b7103cc008a3aa71 Mon Sep 17 00:00:00 2001
From: Timur Kazantaev <timurkazantaev@gmail.com>
Date: Thu, 7 Mar 2019 19:46:37 +0300
Subject: [PATCH] Auth fix (#54)

* Authorization added

* added secret to password, md5 hashing, removed promise from verifyToken, deleted links when not authorized

* added dbinsert script

* turned verifyToken to middleware, added description for dbinsert, added hidden csrf field in auth form

* added middlewares, user model and controller

* JSDoc fix

* wrong password processing fix

* added comments to dbinsert script, moved salt and passHash to singe db doc

* Moved salt to .env, upgradedscript for generating password was, fixed comments and JSDoc

* Deleted using salt (now user is only one), changed verifying password to bcrypt.compare, added httpyOnly property to jwt cookie

* Added verifyToken middleware to aliases route, added check for user existance on POST/auth

* Added message "password not set" to client
---
 src/routes/aliases.js           | 3 ++-
 src/routes/auth.js              | 8 ++++++++
 src/routes/middlewares/token.js | 2 +-
 3 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/src/routes/aliases.js b/src/routes/aliases.js
index 76b99af..d504216 100644
--- a/src/routes/aliases.js
+++ b/src/routes/aliases.js
@@ -3,13 +3,14 @@ const router = express.Router();
 const Aliases = require('../controllers/aliases');
 const Pages = require('../controllers/pages');
 const Alias = require('../models/alias');
+const verifyToken = require('./middlewares/token');
 
 /**
  * GET /*
  *
  * Return document with given alias
  */
-router.get('*', async (req, res) => {
+router.get('*', verifyToken, async (req, res) => {
   try {
     const alias = await Aliases.get(req.originalUrl.slice(1)); // Cuts first '/' character
 
diff --git a/src/routes/auth.js b/src/routes/auth.js
index 5ba1b0a..795cc8c 100644
--- a/src/routes/auth.js
+++ b/src/routes/auth.js
@@ -28,6 +28,14 @@ router.get('/auth', csrfProtection, function (req, res) {
 router.post('/auth', parseForm, csrfProtection, async (req, res) => {
   let userDoc = await Users.get();
 
+  if (!userDoc) {
+    res.render('auth', {
+      title: 'Login page',
+      header: 'Password not set',
+      csrfToken: req.csrfToken()
+    });
+  }
+
   const passHash = userDoc.passHash;
 
   bcrypt.compare(req.body.password, passHash, async (err, result) => {
diff --git a/src/routes/middlewares/token.js b/src/routes/middlewares/token.js
index 851b763..220a972 100644
--- a/src/routes/middlewares/token.js
+++ b/src/routes/middlewares/token.js
@@ -15,7 +15,7 @@ module.exports = async function verifyToken(req, res, next) {
 
   if (!userDoc) {
     res.locals.isAuthorized = false;
-    next()
+    next();
   }
 
   jwt.verify(token, userDoc.passHash + config.secret, (err, decodedToken) => {