Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
lastName: args.input.lastName,
password: hashedPassword,
userGroup: JSON.stringify(
updateGroup({
user: true
})
)
});
try {
const token = ctx.utils.jwt.sign({
id: newUser.id
});
ctx.utils.headers.setTokenToResponse(ctx.res, token);
} catch (e) {
throw new AuthenticationError('Unable to sign token');
}
// Must attach user here as viewer because at this point forward.
// The user is logged in. This allows us to query private user details such as email
ctx.viewer = newUser;
return { ...newUser };
};
export async function getAuthUserFromReq(req: any, db: any, shouldFail = true) {
const { authorization } = req.headers
const noAuthorization = !authorization || authorization.indexOf('Bearer') === -1
if (noAuthorization && shouldFail) throw new AuthenticationError('You must supply a JWT for authorization!')
else if (noAuthorization) return null
// cache user via req object in case there are repeat calls to $getUser
if (req.user) return req.user
const token = authorization.replace('Bearer ', '')
const user = await getAuthUser(db.$connection, token)
req.user = user
return req.user
}
signIn: async (parent, { login, password }, { models, secret }) => {
const user = await models.User.findByLogin(login);
if (!user) {
throw new UserInputError("No users found with this login credentials.");
}
const isValid = await user.validatePassword(password);
if (!isValid) {
throw new AuthenticationError("Invalid password.");
}
// Expires in 30 min
return { token: createToken(user, secret, "1800000", models) };
},
) => resolver => async (root, args, ctx, info) => {
const user = await getUserFromContext(ctx);
if (!user) {
throw new AuthenticationError('Not authenticated!');
}
const isValid = await isValidUser(root, args, ctx, info);
if (!isValid) {
handleError(root, args, ctx, info, user);
}
return resolver(root, args, ctx, info);
};
export async function getAuthUser(connection: any, token: any) {
let userId
try {
userId = jwt.verify(token, getAppKey()).userId
} catch (err) {
throw new ForbiddenError('You are not authorized.')
}
const user = await connection('users').where('id', userId).first()
if (!user) throw new AuthenticationError('Encrypted user does not exist.')
return user
}
handleRequest(err: any, user: any) {
if (err || !user) {
throw err || new AuthenticationError('GqlAuthGuard');
}
return user;
}
}
field.resolve = async function(...args) {
const { user } = args[2];
if (!user) {
throw new AuthenticationError('Access denied.');
}
return resolve.apply(this, args);
};
});
return record.get('user')
})
if (
currentUser &&
(await bcrypt.compareSync(password, currentUser.password)) &&
!currentUser.disabled
) {
delete currentUser.password
return encode(currentUser)
} else if (currentUser &&
currentUser.disabled
) {
throw new AuthenticationError('Your account has been disabled.')
} else {
throw new AuthenticationError('Incorrect email address or password.')
}
},
changePassword: async (
RETURN user {.id, .email, .password}`,
{
userEmail: user.email
}
)
const [currentUser] = result.records.map(function (record) {
return record.get('user')
})
if (!(await bcrypt.compareSync(oldPassword, currentUser.password))) {
throw new AuthenticationError('Old password is not correct')
}
if (await bcrypt.compareSync(newPassword, currentUser.password)) {
throw new AuthenticationError(
'Old password and new password should be different'
)
} else {
const newHashedPassword = await bcrypt.hashSync(newPassword, 10)
session.run(
`MATCH (user:User {email: $userEmail})
SET user.password = $newHashedPassword
RETURN user
`,
{
userEmail: user.email,
newHashedPassword
}
)
session.close()