Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
.then((res) => {
// Check user exists
if (res.length === 0) {
throw new HTTPError(403, 'Invalid email address')
}
// Check valid password
return argon2.hash(event.body.password, salt)
.then((hashedPassword) => {
if (hashedPassword !== res[0].password) {
throw new HTTPError(403, 'Invalid password')
}
return
})
.then(() => controller.getPermissions(res[0].roles))
.then((permissions) => {
// Everything checks out, return JWT
return jwt.encode({
iss: pkg.name,
exp: Date.now() + process.env.AUTH_JWT_EXPIRES,
context: {
id: res[0]._id,
permissions
}
this.db.findOne({username: credentials.username}).exec((err, user) => {
if (err) {
return callback(null, err);
}
// Username not found.
if (user == null) {
return callback(null, user);
}
argon2
.verify(user.password, credentials.password)
.then(argon2Match => {
if (argon2Match) {
return callback(argon2Match, user.isAdmin);
}
callback(null, argon2Match, false);
})
.catch(error => callback(null, error));
});
}
export const verifyPassword = (storedHash, incomingPassword) => (
argon.verify(
// Always run password validation to impede side channel attacks
storedHash || dummyPassword,
incomingPassword,
)
);
});
/**
* Supported Argon2 variants.
* Argon2 currently has three modes:
* - d: Argon2d data-dependent.
* - i: Argon2i data-independent.
* - id: Argon2id a mix of the two.
* See https://crypto.stackexchange.com/a/49969
* @private
* @type {Object}
*/
const variants = Object.freeze({
i: argon2.argon2i,
d: argon2.argon2d,
id: argon2.argon2id
});
/**
* Supported Argon2 versions.
* @private
* @type {number[]}
*/
const versions = [
0x10, // 1.0 (16)
0x13 // 1.3 (19)
];
/**
* Computes the hash string of the given password in the PHC format using argon2
* package.
* @public
saltSize: 16
});
/**
* Supported Argon2 variants.
* Argon2 currently has three modes:
* - d: Argon2d data-dependent.
* - i: Argon2i data-independent.
* - id: Argon2id a mix of the two.
* See https://crypto.stackexchange.com/a/49969
* @private
* @type {Object}
*/
const variants = Object.freeze({
i: argon2.argon2i,
d: argon2.argon2d,
id: argon2.argon2id
});
/**
* Supported Argon2 versions.
* @private
* @type {number[]}
*/
const versions = [
0x10, // 1.0 (16)
0x13 // 1.3 (19)
];
/**
* Computes the hash string of the given password in the PHC format using argon2
* package.
// The minimum recommended size for the salt is 128 bits.
saltSize: 16
});
/**
* Supported Argon2 variants.
* Argon2 currently has three modes:
* - d: Argon2d data-dependent.
* - i: Argon2i data-independent.
* - id: Argon2id a mix of the two.
* See https://crypto.stackexchange.com/a/49969
* @private
* @type {Object}
*/
const variants = Object.freeze({
i: argon2.argon2i,
d: argon2.argon2d,
id: argon2.argon2id
});
/**
* Supported Argon2 versions.
* @private
* @type {number[]}
*/
const versions = [
0x10, // 1.0 (16)
0x13 // 1.3 (19)
];
/**
* Computes the hash string of the given password in the PHC format using argon2
test('edit resource', async t => {
let user = new User({
name: 'ademir',
password: await argon2.hash('123456', await argon2.generateSalt())
})
await user.save()
const {status} = await t.context.request.patch(`/users/${user.get('name')}`).send({
password: '654321'
})
t.is(status, 200)
user = await User.findById(user.get('_id'))
t.true(await argon2.verify(user.get('password'), '654321'))
})
test.before(async () => {
const user = new User({
name: 'ademir',
password: await argon2.hash('123456', await argon2.generateSalt())
})
await user.save()
})
async function createAdmin (username = 'remove-this-admin', email = 'admin@email.com') {
try {
let db = await MongoClient.connect(process.env.DB_URL)
let rand = uuidv4().split('-').join('')
let password = await argon2.hash(rand)
await db.collection('users').insertOne({ username, email, password, admin: true })
console.log(`
username: ${username}
password: ${rand}
Please sign in and create a new super user immediately. Delete this user when done.
`)
await db.close()
} catch (error) {
console.log(error)
process.exit(1)
}
}
register: async (_, { input }) => {
try {
await registerSchema.validate(input, { abortEarly: false });
} catch (err) {
return {
errors: formatYupError(err)
};
}
const { email, username, password } = input;
const hashedPassword = await argon.hash(password);
try {
await User.create({
email,
username,
password: hashedPassword
}).save();
} catch (err) {
console.log(err);
const { detail } = err;
if (detail.includes("already exists.")) {
if (detail.includes("email")) {
return {
errors: [
{
path: "email",