IPost/routes/user_auth.js

import {SHA256} from "../extra_modules/SHA.js";
import * as signature from "cookie-signature";
import getIP from "../extra_modules/getip.js";
import {readFileSync} from "fs"

const cookiesecret = readFileSync("cookiesecret.txt").toString();

export const setup = function (router, con, server) {
    const config = server.config
    const DID_I_FINALLY_ADD_HTTPS = server.DID_I_FINALLY_ADD_HTTPS
    const increaseAPICall = server.increaseAPICall
    const HASHES_DB = config.cookies.server_hashes;
    const HASHES_COOKIE = config.cookies.client_hashes;
    const HASHES_DIFF = HASHES_DB - HASHES_COOKIE;

    router.post("/register",  function (req, res) {
        for (let i = 0; i < 10; i++) { //don't want people spam registering
            if (!increaseAPICall(req, res))
                return;
        }
        res.status(200);
        if ((typeof req.body.user) !== "string") {
            res.status(416);
            res.json({ "error": "incorrect username" });
            return;
        }
        if ((typeof req.body.pass) !== "string") {
            res.status(417);
            res.json({ "error": "incorrect password" });
            return;
        }
        let username = req.body.user.toString();
        username = username.replace(/\s/gi, "");
        let password = req.body.pass.toString();
        if (!username) {
            res.status(410);
            res.redirect("/register?success=false&reason=username");
            return;
        }
        if (username === "") {
            res.status(411);
            res.redirect("/register?success=false&reason=username");
            return;
        }
        if (password.length < 10) {
            res.status(412);
            res.send("password is too short");
            return;
        }
        if (username.length > 25) {
            res.status(413);
            res.send("username is too long");
            return;
        }
        if (username.search("@") !== -1) {
            res.status(414);
            res.send("username can't contain @-characters");
            return;
        }
        if (!password) {
            res.status(415);
            res.redirect("/register?success=false&reason=password");
            return;
        }
        let userexistssql = `SELECT User_Name from ipost.users where User_Name = ?`;
        con.query(userexistssql, [encodeURIComponent(username)], function (_error, result) {
            if (result && result[0] && result[0].User_Name) {
                res.status(418);
                res.redirect("/register?success=false&reason=already_exists");
                return;
            }
            let less_hashed_pw = SHA256(password, username, HASHES_DIFF);
            let hashed_pw = SHA256(less_hashed_pw, username, HASHES_COOKIE);
            let ip = getIP(req);
            let setTo = `${username} ${SHA256(password, username, HASHES_COOKIE)}`
            let cookiesigned = signature.sign(setTo, cookiesecret + ip);
            ip = SHA256(ip, setTo, HASHES_DB);
            const default_settings = {};
            let values = [encodeURIComponent(username), hashed_pw, Date.now(), ip, ip, JSON.stringify(default_settings)];
            let sql = `INSERT INTO ipost.users (User_Name, User_PW, User_CreationStamp, User_CreationIP, User_LastIP, User_Settings) VALUES (?, ?, ?, ?, ?, ?);`;
            con.query(sql, values, function (err) {
                if (err)
                    throw err;
                res.cookie('AUTH_COOKIE', cookiesigned, { maxAge: Math.pow(10, 10), httpOnly: true, secure: DID_I_FINALLY_ADD_HTTPS });
                if(req.body.r !== undefined) {
                    res.redirect(decodeURIComponent(req.body.r))
                } else {
                    res.redirect("/user");
                }
            });
        });
    });
    router.post("/login",  function (req, res) {
        if (!increaseAPICall(req, res))
            return;
        if ((typeof req.body.user) !== "string") {
            res.status(416);
            res.json({ "error": "incorrect username" });
            return;
        }
        if ((typeof req.body.pass) !== "string") {
            res.status(417);
            res.json({ "error": "incorrect password" });
            return;
        }
        if (!req.body.user) {
            res.status(410);
            res.send("no username given");
            return;
        }
        if (!req.body.pass) {
            res.status(411);
            res.send("no password given");
            return;
        }
        let username = req.body.user.toString();
        username = username.replace(" ", "");
        let password = req.body.pass.toString();
        if (!username) {
            res.status(412);
            res.send("no username given");
            return;
        }
        if (username.length > 25) {
            res.status(413);
            res.send("username is too long");
            return;
        }
        if (password.length < 10) {
            res.status(414);
            res.send("password is too short");
            return;
        }
        if (!password) {
            res.status(415);
            res.send("no password given");
            return;
        }

        const no_ip_lock = username.endsWith("@unsafe")
        username = username.replace("@unsafe","")

        let less_hashed_pw = SHA256(password, username, HASHES_DIFF);
        let hashed_pw = SHA256(less_hashed_pw, username, HASHES_COOKIE);
        let userexistssql = `SELECT * from ipost.users where User_Name = ? and User_PW = ?;`;
        con.query(userexistssql, [encodeURIComponent(username), hashed_pw], function (_error, result) {
            if (result && result[0]) {
                let ip = getIP(req);
                let setTo = `${username} ${SHA256(password, username, HASHES_COOKIE)}`
                let cookiesigned = signature.sign(setTo, cookiesecret + (!no_ip_lock ? ip : ""));
                res.cookie('AUTH_COOKIE', cookiesigned, { maxAge: Math.pow(10, 10), httpOnly: true, secure: DID_I_FINALLY_ADD_HTTPS });
                ip = SHA256(ip, setTo, HASHES_DB);
                if (result[0].User_LastIP !== ip) {
                    let sql = `update ipost.users set User_LastIP = ? where User_Name = ?;`;
                    con.query(sql, [ip, encodeURIComponent(username)], function (error) {
                        if (error)
                            throw error;
                    });
                }
                if(req.body.r !== undefined) {
                    res.redirect(decodeURIComponent(req.body.r))
                } else {
                    res.redirect("/user");
                }
            }
            else {
                console.log(5,"login failed, username: ", username);
                res.redirect("/login?success=false?reason=noUser");
            }
        });
    });
}