Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
if (!user._active) {
logger.info('user access denied: inactive', {
email,
headers: req.headers
})
throw new APIError('Account not active', httpStatus.UNAUTHORIZED)
}
if (!user.verified && env.NODE_ENV !== env.Environments.Test) { // Skip for tests since verifying requires opening an email
logger.info('user access denied: not verified', {
email,
headers: req.headers
})
throw new APIError('Access denied', httpStatus.PRECONDITION_FAILED)
}
const token = _generateToken(user)
res.json({
token
})
logger.info('user logged in', {
email,
headers: req.headers
})
}
.catch((err) => {
log.error({ err }, 'Failed to create session user');
notifications.notify('Failed to create "Try it now" session : ' + err.message,
notifications.SLACK_CHANNELS.CRITICAL_ERRORS);
if (err.message === sessionusers.ERROR_MESSAGES.CLASS_FULL) {
return res.status(httpstatus.PRECONDITION_FAILED).json({ error : err.message });
}
else {
return errors.unknownError(res, err);
}
});
}
debug("Response headers: " + JSON.stringify(res.headers));
switch ( res.statusCode ) {
case HTTPStatus.OK:
callback(null, body, res.headers);
break;
case HTTPStatus.UNAUTHORIZED:
callback(new UnauthorizedAccessError("Resource access denied"));
break;
case HTTPStatus.FORBIDDEN:
callback(new ForbiddenAccessError(body.message));
break;
case HTTPStatus.NOT_FOUND:
callback(new ResourceNotFoundError("Resource not found"));
break;
case HTTPStatus.PRECONDITION_FAILED:
callback(new PreconditionFailedError(body.message));
break;
default:
callback(new Error("Expected status code " + HTTPStatus.OK + " and received " + res.statusCode));
}
});
}
}
user.verified = true
user.password = password
await user.save()
return res.sendStatus(httpStatus.OK)
} catch (error) {
logger.warn('invalid JWT was used for account verification', {
token,
headers: req.headers
})
if (error.name === 'TokenExpiredError') {
return res.sendStatus(httpStatus.PRECONDITION_FAILED)
}
return next(new APIError(error, httpStatus.BAD_REQUEST, false))
}
}