Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
if (!user) {
return done(new UnauthorizedError('couldNotBeVerified'), null);
}
// dismiss password reset process
if (!isNullOrUndefined(user.resetPasswordToken)) {
user.resetPasswordToken = undefined;
user.resetPasswordExpires = undefined;
await user.save();
}
const isValid = await user.isValidPassword(password);
if (!isValid) {
return done(new UnauthorizedError('couldNotBeVerified'), null);
} else if (!user.isActive) {
return done(new UnauthorizedError('notActiveYet'), null);
} else {
return done(null, user);
}
} catch (err) {
done(new UnauthorizedError('unknown'), null);
}
});
try {
const user = await User.findOne({email: email});
if (!user) {
return done(new UnauthorizedError('couldNotBeVerified'), null);
}
// dismiss password reset process
if (!isNullOrUndefined(user.resetPasswordToken)) {
user.resetPasswordToken = undefined;
user.resetPasswordExpires = undefined;
await user.save();
}
const isValid = await user.isValidPassword(password);
if (!isValid) {
return done(new UnauthorizedError('couldNotBeVerified'), null);
} else if (!user.isActive) {
return done(new UnauthorizedError('notActiveYet'), null);
} else {
return done(null, user);
}
} catch (err) {
done(new UnauthorizedError('unknown'), null);
}
});
async wechatLogin(@BodyParam('code', {required: true}) code: string): Promise<{usertype: UserType, jwt: {token: string, expiresOn: number}}> {
try {
const res = await Axios.get(`https://api.weixin.qq.com/sns/jscode2session?appid=${wechatConfig.appid}&secret=${wechatConfig.appsecret}&js_code=${code}&grant_type=authorization_code`)
const openid = res.data.openid
const oldUser = await this.userService.userModel.findOne({openid: openid})
if (oldUser) {
return this.userService.signUser(oldUser)
} else {
const newUser = await this.userService.createNewCustomer(openid)
return this.userService.signUser(newUser)
}
} catch (e) {
console.log(e)
throw new UnauthorizedError()
}
}
const verify: VerifiedCallback = async (payload, done) => {
if (forbidMediaTokens && payload.isMediaToken) {
done(new UnauthorizedError(errorCodes.misc.mediaTokenInsufficient.code), false);
}
try {
if (await User.findById(payload._id)) {
done(null, {tokenPayload: payload});
} else {
done(null, false);
}
} catch (error) {
done(error);
}
};
if (!isNullOrUndefined(user.resetPasswordToken)) {
user.resetPasswordToken = undefined;
user.resetPasswordExpires = undefined;
await user.save();
}
const isValid = await user.isValidPassword(password);
if (!isValid) {
return done(new UnauthorizedError('couldNotBeVerified'), null);
} else if (!user.isActive) {
return done(new UnauthorizedError('notActiveYet'), null);
} else {
return done(null, user);
}
} catch (err) {
done(new UnauthorizedError('unknown'), null);
}
});
async put(
@CurrentUser({ required: true }) currentUser: User,
@Param("id") id: number,
@Body({ validate: true }) userData: UpdateUserBody) {
if (id != currentUser.id) {
throw new UnauthorizedError("Can not edit other users")
}
Object.assign(currentUser, userData)
return currentUser.save()
}
getPublicConfig(@Param('id') name: string) {
if (!isPublicConfig(name)) {
throw new UnauthorizedError();
}
return this.findConfig(name);
}
static checkAuthorization(action: Action, roles: string[]): Promise {
const jwtData = action.request.jwtData;
if (!jwtData) {
throw new UnauthorizedError();
}
const userId = jwtData.tokenPayload._id;
return User.findById(mongoose.Types.ObjectId(userId))
.then((user) => {
if (user && !roles.length) {
return true;
}
if (user && (roles.indexOf(user.role) !== -1)) {
return true;
}
return false;
});
}
async doAdminLogin(@BodyParam('username', {required: true}) username: string, @BodyParam('password', {required: true}) password: string): Promise<{usertype: UserType, jwt: {token: string, expiresOn: number}}> {
const u = await this.userService.userModel.findOne({username: username, password: md5(password), usertype: 1})
if (u) {
return this.userService.signUser(u)
} else {
throw new UnauthorizedError()
}
}