10689875771

Committed 03 Sep 2024 08:08PM UTC coverage: 82.684% (+0.01%) from 82.671%

Build # 10689875771

Build Type

Pull #396

github

Committed by

web-flow

Commit Message

Merge 3a508c0f1 into e7cfda55c

Pull Request Pull Request #396: Refactored Code in src/controllers/authentication.js, reducing Cognitive Complexity -2

Run Details

9963 of 13470 branches covered (73.96%)

Branch coverage included in aggregate %.

22 of 24 new or added lines in 1 file covered. (91.67%)

1 existing line in 1 file now uncovered.

22326 of 25581 relevant lines covered (87.28%)

1632.86 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

79.23

/src/controllers/authentication.js

'use strict';

const winston = require('winston');
const passport = require('passport');
const nconf = require('nconf');
const validator = require('validator');
const _ = require('lodash');
const util = require('util');

const db = require('../database');
const meta = require('../meta');
const analytics = require('../analytics');
const user = require('../user');
const plugins = require('../plugins');
const utils = require('../utils');
const slugify = require('../slugify');
const helpers = require('./helpers');
const privileges = require('../privileges');
const sockets = require('../socket.io');

const authenticationController = module.exports;

async function registerAndLoginUser(req, res, userData) {
        if (!userData.hasOwnProperty('email')) {
                userData.updateEmail = true;
        }

        const data = await user.interstitials.get(req, userData);

        // If interstitials are found, save registration attempt into session and abort
        const deferRegistration = data.interstitials.length;
        if (deferRegistration) {
                userData.register = true;
                req.session.registration = userData;

                if (req.body.noscript === 'true') {
                        res.redirect(`${nconf.get('relative_path')}/register/complete`);
                        return;
                }
                res.json({ next: `${nconf.get('relative_path')}/register/complete` });
                return;
        }

        const queue = await user.shouldQueueUser(req.ip);
        const result = await plugins.hooks.fire('filter:register.shouldQueue', { req: req, res: res, userData: userData, queue: queue });
        if (result.queue) {
                return await addToApprovalQueue(req, userData);
        }

        const uid = await user.create(userData);
        if (res.locals.processLogin) {
                await authenticationController.doLogin(req, uid);
        }

        // Distinguish registrations through invites from direct ones
        if (userData.token) {
                // Token has to be verified at this point
                await Promise.all([
                        user.confirmIfInviteEmailIsUsed(userData.token, userData.email, uid),
                        user.joinGroupsFromInvitation(uid, userData.token),
                ]);
        }
        await user.deleteInvitationKey(userData.email, userData.token);
        const next = req.session.returnTo || `${nconf.get('relative_path')}/`;
        const complete = await plugins.hooks.fire('filter:register.complete', { uid: uid, next: next });
        req.session.returnTo = complete.next;
        return complete;
}

authenticationController.register = async function (req, res) {
        const registrationType = meta.config.registrationType || 'normal';

        if (registrationType === 'disabled') {
                return res.sendStatus(403);
        }

        const userData = req.body;
        try {
                if (userData.token || registrationType === 'invite-only' || registrationType === 'admin-invite-only') {
                        await user.verifyInvitation(userData);
                }

                if (
                        !userData.username ||
                        userData.username.length < meta.config.minimumUsernameLength ||
                        slugify(userData.username).length < meta.config.minimumUsernameLength
                ) {
                        throw new Error('[[error:username-too-short]]');
                }

                if (userData.username.length > meta.config.maximumUsernameLength) {
                        throw new Error('[[error:username-too-long]]');
                }

                if (userData.password !== userData['password-confirm']) {
                        throw new Error('[[user:change-password-error-match]]');
                }

                if (userData.password.length > 512) {
                        throw new Error('[[error:password-too-long]]');
                }

                user.isPasswordValid(userData.password);

                await plugins.hooks.fire('filter:password.check', { password: userData.password, uid: 0, userData: userData });

                res.locals.processLogin = true; // set it to false in plugin if you wish to just register only
                await plugins.hooks.fire('filter:register.check', { req: req, res: res, userData: userData });

                const data = await registerAndLoginUser(req, res, userData);
                if (data) {
                        if (data.uid && req.body.userLang) {
                                await user.setSetting(data.uid, 'userLang', req.body.userLang);
                        }
                        res.json(data);
                }
        } catch (err) {
                helpers.noScriptErrors(req, res, err.message, 400);
        }
};

async function addToApprovalQueue(req, userData) {
        userData.ip = req.ip;
        await user.addToApprovalQueue(userData);
        let message = '[[register:registration-added-to-queue]]';
        if (meta.config.showAverageApprovalTime) {
                const average_time = await db.getObjectField('registration:queue:approval:times', 'average');
                if (average_time > 0) {
                        message += ` [[register:registration-queue-average-time, ${Math.floor(average_time / 60)}, ${Math.floor(average_time % 60)}]]`;
                }
        }
        if (meta.config.autoApproveTime > 0) {
                message += ` [[register:registration-queue-auto-approve-time, ${meta.config.autoApproveTime}]]`;
        }
        return { message: message };
}

authenticationController.registerComplete = async function (req, res) {
        try {
                // For the interstitials that respond, execute the callback with the form body
                const data = await user.interstitials.get(req, req.session.registration);
                const callbacks = data.interstitials.reduce((memo, cur) => {
                        if (cur.hasOwnProperty('callback') && typeof cur.callback === 'function') {
                                req.body.files = req.files;
                                if (
                                        (cur.callback.constructor && cur.callback.constructor.name === 'AsyncFunction') ||
                                        cur.callback.length === 2 // non-async function w/o callback
                                ) {
                                        memo.push(cur.callback);
                                } else {
                                        memo.push(util.promisify(cur.callback));
                                }
                        }

                        return memo;
                }, []);

                const done = function (data) {
                        delete req.session.registration;
                        const relative_path = nconf.get('relative_path');
                        if (data && data.message) {
                                return res.redirect(`${relative_path}/?register=${encodeURIComponent(data.message)}`);
                        }

                        if (req.session.returnTo) {
                                res.redirect(relative_path + req.session.returnTo.replace(new RegExp(`^${relative_path}`), ''));
                        } else {
                                res.redirect(`${relative_path}/`);
                        }
                };

                const results = await Promise.allSettled(callbacks.map(async (cb) => {
                        await cb(req.session.registration, req.body);
                }));
                const errors = results.map(result => result.status === 'rejected' && result.reason && result.reason.message).filter(Boolean);
                if (errors.length) {
                        req.flash('errors', errors);
                        return req.session.save(() => {
                                res.redirect(`${nconf.get('relative_path')}/register/complete`);
                        });
                }

                if (req.session.registration.register === true) {
                        res.locals.processLogin = true;
                        req.body.noscript = 'true'; // trigger full page load on error

                        const data = await registerAndLoginUser(req, res, req.session.registration);
                        if (!data) {
                                return winston.warn('[register] Interstitial callbacks processed with no errors, but one or more interstitials remain. This is likely an issue with one of the interstitials not properly handling a null case or invalid value.');
                        }
                        done(data);
                } else {
                        // Update user hash, clear registration data in session
                        const payload = req.session.registration;
                        const { uid } = payload;
                        delete payload.uid;
                        delete payload.returnTo;

                        Object.keys(payload).forEach((prop) => {
                                if (typeof payload[prop] === 'boolean') {
                                        payload[prop] = payload[prop] ? 1 : 0;
                                }
                        });

                        await user.setUserFields(uid, payload);
                        done();
                }
        } catch (err) {
                delete req.session.registration;
                res.redirect(`${nconf.get('relative_path')}/?register=${encodeURIComponent(err.message)}`);
        }
};

authenticationController.registerAbort = async (req, res) => {
        if (req.uid && req.session.registration) {
                // Email is the only cancelable interstitial
                delete req.session.registration.updateEmail;

                const { interstitials } = await user.interstitials.get(req, req.session.registration);
                if (!interstitials.length) {
                        delete req.session.registration;
                        return res.redirect(nconf.get('relative_path') + (req.session.returnTo || '/'));
                }
        }

        // End the session and redirect to home
        req.session.destroy(() => {
                res.clearCookie(nconf.get('sessionKey'), meta.configs.cookie.get());
                res.redirect(`${nconf.get('relative_path')}/`);
        });
};

authenticationController.login = async (req, res, next) => {
        let { strategy } = await plugins.hooks.fire('filter:login.override', { req, strategy: 'local' });
        if (!passport._strategy(strategy)) {
                winston.error(`[auth/override] Requested login strategy "${strategy}" not found, reverting back to local login strategy.`);
                strategy = 'local';
        }

        if (plugins.hooks.hasListeners('action:auth.overrideLogin')) {
                return continueLogin(strategy, req, res, next);
        }

        const loginWith = meta.config.allowLoginWith || 'username-email';
        req.body.username = String(req.body.username).trim();
        const errorHandler = res.locals.noScriptErrors || helpers.noScriptErrors;
        try {
                await plugins.hooks.fire('filter:login.check', { req: req, res: res, userData: req.body });
        } catch (err) {
                return errorHandler(req, res, err.message, 403);
        }
        try {
                const isEmailLogin = loginWith.includes('email') && req.body.username && utils.isEmailValid(req.body.username);
                const isUsernameLogin = loginWith.includes('username') && !validator.isEmail(req.body.username);
                if (isEmailLogin) {
                        const username = await user.getUsernameByEmail(req.body.username);
                        if (username !== '[[global:guest]]') {
                                req.body.username = username;
                        }
                }
                if (isEmailLogin || isUsernameLogin) {
                        continueLogin(strategy, req, res, next);
                } else {
                        errorHandler(req, res, `[[error:wrong-login-type-${loginWith}]]`, 400);
                }
        } catch (err) {
                return errorHandler(req, res, err.message, 500);
        }
};

function continueLogin(strategy, req, res, next) {
        passport.authenticate(strategy, async (err, userData, info) => {
                if (err) {
                        plugins.hooks.fire('action:login.continue', { req, strategy, userData, error: err });
                        return helpers.noScriptErrors(req, res, err.data || err.message, 403);
                }

                if (!userData) {
                        return handleNoUserData(info, strategy, req, res);
                }

                setSessionCookie(req);

                plugins.hooks.fire('action:login.continue', { req, strategy, userData, error: null });

                if (!(userData.passwordExpiry && userData.passwordExpiry < Date.now())) {
                        await handleLogin(userData, req, res);
                }
        })(req, res, next);
}

function handleNoUserData(info, strategy, req, res) {
        if (typeof info === 'object') {
                info = '[[error:invalid-username-or-password]]';
        }

        plugins.hooks.fire('action:login.continue', { req, strategy, userData: null, error: new Error(info) });
        return helpers.noScriptErrors(req, res, info, 403);
}

function setSessionCookie(req) {
        if (req.body.remember === 'on') {
                const duration = meta.getSessionTTLSeconds() * 1000;
                req.session.cookie.maxAge = duration;
                req.session.cookie.expires = new Date(Date.now() + duration);
        } else {
                const duration = meta.config.sessionDuration * 1000;
                req.session.cookie.maxAge = duration || false;
                req.session.cookie.expires = duration ? new Date(Date.now() + duration) : false;
        }
}

function getRedirectDestination(req) {
        let destination;
        if (req.session.returnTo) {
                destination = req.session.returnTo.startsWith('http') ?
                        req.session.returnTo :
                        nconf.get('relative_path') + req.session.returnTo;
                delete req.session.returnTo;
        } else {
                destination = `${nconf.get('relative_path')}/`;
        }
        return destination;
}

async function handleLogin(userData, req, res) {
        delete req.query.lang;
        await authenticationController.doLogin(req, userData.uid);
        const destination = getRedirectDestination(req);
        (res.locals.redirectAfterLogin || redirectAfterLogin)(req, res, destination);
}

function redirectAfterLogin(req, res, destination) {
        if (req.body.noscript === 'true') {
                res.redirect(`${destination}?loggedin`);
        } else {
                res.status(200).send({
                        next: destination,
                });
        }
}

authenticationController.doLogin = async function (req, uid) {
        if (!uid) {
                return;
        }
        const loginAsync = util.promisify(req.login).bind(req);
        await loginAsync({ uid: uid }, { keepSessionInfo: req.res.locals.reroll !== false });
        await authenticationController.onSuccessfulLogin(req, uid);
};

authenticationController.onSuccessfulLogin = async function (req, uid, trackSession = true) {
        /*
         * Older code required that this method be called from within the SSO plugin.
         * That behaviour is no longer required, onSuccessfulLogin is now automatically
         * called in NodeBB core. However, if already called, return prematurely
         */
        if (req.loggedIn && !req.session.forceLogin) {
                return true;
        }

        try {
                const uuid = utils.generateUUID();

                req.uid = uid;
                req.loggedIn = true;
                await meta.blacklist.test(req.ip);
                await user.logIP(uid, req.ip);
                await user.bans.unbanIfExpired([uid]);
                await user.reset.cleanByUid(uid);

                req.session.meta = {};

                delete req.session.forceLogin;
                // Associate IP used during login with user account
                req.session.meta.ip = req.ip;

                // Associate metadata retrieved via user-agent
                req.session.meta = _.extend(req.session.meta, {
                        uuid: uuid,
                        datetime: Date.now(),
                        platform: req.useragent.platform,
                        browser: req.useragent.browser,
                        version: req.useragent.version,
                });
                await Promise.all([
                        new Promise((resolve) => {
                                req.session.save(resolve);
                        }),
                        trackSession ? user.auth.addSession(uid, req.sessionID) : undefined,
                        user.updateLastOnlineTime(uid),
                        user.onUserOnline(uid, Date.now()),
                        analytics.increment('logins'),
                        db.incrObjectFieldBy('global', 'loginCount', 1),
                ]);

                // Force session check for all connected socket.io clients with the same session id
                sockets.in(`sess_${req.sessionID}`).emit('checkSession', uid);

                plugins.hooks.fire('action:user.loggedIn', { uid: uid, req: req });
        } catch (err) {
                req.session.destroy();
                throw err;
        }
};

const destroyAsync = util.promisify((req, callback) => req.session.destroy(callback));
const logoutAsync = util.promisify((req, callback) => req.logout(callback));

authenticationController.localLogin = async function (req, username, password, next) {
        if (!username) {
                return next(new Error('[[error:invalid-username]]'));
        }

        if (!password || !utils.isPasswordValid(password)) {
                return next(new Error('[[error:invalid-password]]'));
        }

        if (password.length > 512) {
                return next(new Error('[[error:password-too-long]]'));
        }

        const userslug = slugify(username);
        const uid = await user.getUidByUserslug(userslug);
        try {
                const [userData, isAdminOrGlobalMod, canLoginIfBanned] = await Promise.all([
                        user.getUserFields(uid, ['uid', 'passwordExpiry']),
                        user.isAdminOrGlobalMod(uid),
                        user.bans.canLoginIfBanned(uid),
                ]);

                userData.isAdminOrGlobalMod = isAdminOrGlobalMod;

                if (!canLoginIfBanned) {
                        return next(await getBanError(uid));
                }

                // Doing this after the ban check, because user's privileges might change after a ban expires
                const hasLoginPrivilege = await privileges.global.can('local:login', uid);
                if (parseInt(uid, 10) && !hasLoginPrivilege) {
                        return next(new Error('[[error:local-login-disabled]]'));
                }

                try {
                        const passwordMatch = await user.isPasswordCorrect(uid, password, req.ip);
                        if (!passwordMatch) {
                                return next(new Error('[[error:invalid-login-credentials]]'));
                        }
                } catch (e) {
                        if (req.loggedIn) {
                                await logoutAsync(req);
                                await destroyAsync(req);
                        }
                        throw e;
                }

                next(null, userData, '[[success:authentication-successful]]');
        } catch (err) {
                next(err);
        }
};

authenticationController.logout = async function (req, res, next) {
        if (!req.loggedIn || !req.sessionID) {
                res.clearCookie(nconf.get('sessionKey'), meta.configs.cookie.get());
                return res.status(200).send('not-logged-in');
        }
        const { uid } = req;
        const { sessionID } = req;

        try {
                await user.auth.revokeSession(sessionID, uid);
                await logoutAsync(req);
                await destroyAsync(req);
                res.clearCookie(nconf.get('sessionKey'), meta.configs.cookie.get());

                await user.setUserField(uid, 'lastonline', Date.now() - (meta.config.onlineCutoff * 60000));
                await db.sortedSetAdd('users:online', Date.now() - (meta.config.onlineCutoff * 60000), uid);
                await plugins.hooks.fire('static:user.loggedOut', { req: req, res: res, uid: uid, sessionID: sessionID });

                // Force session check for all connected socket.io clients with the same session id
                sockets.in(`sess_${sessionID}`).emit('checkSession', 0);
                const payload = {
                        next: `${nconf.get('relative_path')}/`,
                };
                plugins.hooks.fire('filter:user.logout', payload);

                if (req.body.noscript === 'true') {
                        return res.redirect(payload.next);
                }
                res.status(200).send(payload);
        } catch (err) {
                next(err);
        }
};

async function getBanError(uid) {
        try {
                const banInfo = await user.getLatestBanInfo(uid);

                if (!banInfo.reason) {
                        banInfo.reason = '[[user:info.banned-no-reason]]';
                }
                const err = new Error(banInfo.reason);
                err.data = banInfo;
                return err;
        } catch (err) {
                if (err.message === 'no-ban-info') {
                        return new Error('[[error:user-banned]]');
                }
                throw err;
        }
}

require('../promisify')(authenticationController, ['register', 'registerComplete', 'registerAbort', 'login', 'localLogin', 'logout']);

1	'use strict';
2
3	const winston = require('winston');	1✔
4	const passport = require('passport');	1✔
5	const nconf = require('nconf');	1✔
6	const validator = require('validator');	1✔
7	const _ = require('lodash');	1✔
8	const util = require('util');	1✔
9
10	const db = require('../database');	1✔
11	const meta = require('../meta');	1✔
12	const analytics = require('../analytics');	1✔
13	const user = require('../user');	1✔
14	const plugins = require('../plugins');	1✔
15	const utils = require('../utils');	1✔
16	const slugify = require('../slugify');	1✔
17	const helpers = require('./helpers');	1✔
18	const privileges = require('../privileges');	1✔
19	const sockets = require('../socket.io');	1✔
20
21	const authenticationController = module.exports;	1✔
22
23	async function registerAndLoginUser(req, res, userData) {
24	if (!userData.hasOwnProperty('email')) {	19✔
25	userData.updateEmail = true;	5✔
26	}
27
28	const data = await user.interstitials.get(req, userData);	19✔
29
30	// If interstitials are found, save registration attempt into session and abort
31	const deferRegistration = data.interstitials.length;	19✔
32	if (deferRegistration) {	19✔
33	userData.register = true;	6✔
34	req.session.registration = userData;	6✔
35
36	if (req.body.noscript === 'true') {	6!
37	res.redirect(`${nconf.get('relative_path')}/register/complete`);	×
38	return;	×
39	}
40	res.json({ next: `${nconf.get('relative_path')}/register/complete` });	6✔
41	return;	6✔
42	}
43
44	const queue = await user.shouldQueueUser(req.ip);	13✔
45	const result = await plugins.hooks.fire('filter:register.shouldQueue', { req: req, res: res, userData: userData, queue: queue });	13✔
46	if (result.queue) {	13✔
47	return await addToApprovalQueue(req, userData);	6✔
48	}
49
50	const uid = await user.create(userData);	7✔
51	if (res.locals.processLogin) {	7!
52	await authenticationController.doLogin(req, uid);	7✔
53	}
54
55	// Distinguish registrations through invites from direct ones
56	if (userData.token) {	7✔
57	// Token has to be verified at this point
58	await Promise.all([	1✔
59	user.confirmIfInviteEmailIsUsed(userData.token, userData.email, uid),
60	user.joinGroupsFromInvitation(uid, userData.token),
61	]);
62	}
63	await user.deleteInvitationKey(userData.email, userData.token);	7✔
64	const next = req.session.returnTo \|\| `${nconf.get('relative_path')}/`;	7✔
65	const complete = await plugins.hooks.fire('filter:register.complete', { uid: uid, next: next });	7✔
66	req.session.returnTo = complete.next;	7✔
67	return complete;	7✔
68	}
69
70	authenticationController.register = async function (req, res) {	1✔
71	const registrationType = meta.config.registrationType \|\| 'normal';	25!
72
73	if (registrationType === 'disabled') {	25✔
74	return res.sendStatus(403);	1✔
75	}
76
77	const userData = req.body;	24✔
78	try {	24✔
79	if (userData.token \|\| registrationType === 'invite-only' \|\| registrationType === 'admin-invite-only') {	24✔
80	await user.verifyInvitation(userData);	2✔
81	}
82
83	if (	23✔
84	!userData.username \|\|	65✔
85	userData.username.length < meta.config.minimumUsernameLength \|\|
86	slugify(userData.username).length < meta.config.minimumUsernameLength
87	) {
88	throw new Error('[[error:username-too-short]]');	6✔
89	}
90
91	if (userData.username.length > meta.config.maximumUsernameLength) {	17✔
92	throw new Error('[[error:username-too-long]]');	1✔
93	}
94
95	if (userData.password !== userData['password-confirm']) {	16!
96	throw new Error('[[user:change-password-error-match]]');	×
97	}
98
99	if (userData.password.length > 512) {	16!
100	throw new Error('[[error:password-too-long]]');	×
101	}
102
103	user.isPasswordValid(userData.password);	16✔
104
105	await plugins.hooks.fire('filter:password.check', { password: userData.password, uid: 0, userData: userData });	16✔
106
107	res.locals.processLogin = true; // set it to false in plugin if you wish to just register only	16✔
108	await plugins.hooks.fire('filter:register.check', { req: req, res: res, userData: userData });	16✔
109
110	const data = await registerAndLoginUser(req, res, userData);	16✔
111	if (data) {	14✔
112	if (data.uid && req.body.userLang) {	8✔
113	await user.setSetting(data.uid, 'userLang', req.body.userLang);	1✔
114	}
115	res.json(data);	8✔
116	}
117	} catch (err) {
118	helpers.noScriptErrors(req, res, err.message, 400);	10✔
119	}
120	};
121
122	async function addToApprovalQueue(req, userData) {
123	userData.ip = req.ip;	6✔
124	await user.addToApprovalQueue(userData);	6✔
125	let message = '[[register:registration-added-to-queue]]';	4✔
126	if (meta.config.showAverageApprovalTime) {	4!
127	const average_time = await db.getObjectField('registration:queue:approval:times', 'average');	4✔
128	if (average_time > 0) {	4!
129	message += ` [[register:registration-queue-average-time, ${Math.floor(average_time / 60)}, ${Math.floor(average_time % 60)}]]`;	×
130	}
131	}
132	if (meta.config.autoApproveTime > 0) {	4!
133	message += ` [[register:registration-queue-auto-approve-time, ${meta.config.autoApproveTime}]]`;	×
134	}
135	return { message: message };	4✔
136	}
137
138	authenticationController.registerComplete = async function (req, res) {	1✔
139	try {	4✔
140	// For the interstitials that respond, execute the callback with the form body
141	const data = await user.interstitials.get(req, req.session.registration);	4✔
142	const callbacks = data.interstitials.reduce((memo, cur) => {	4✔
143	if (cur.hasOwnProperty('callback') && typeof cur.callback === 'function') {	8!
144	req.body.files = req.files;	8✔
145	if (	8✔
146	(cur.callback.constructor && cur.callback.constructor.name === 'AsyncFunction') \|\|	20✔
147	cur.callback.length === 2 // non-async function w/o callback
148	) {
149	memo.push(cur.callback);	4✔
150	} else {
151	memo.push(util.promisify(cur.callback));	4✔
152	}
153	}
154
155	return memo;	8✔
156	}, []);
157
158	const done = function (data) {	4✔
159	delete req.session.registration;	3✔
160	const relative_path = nconf.get('relative_path');	3✔
161	if (data && data.message) {	3!
162	return res.redirect(`${relative_path}/?register=${encodeURIComponent(data.message)}`);	×
163	}
164
165	if (req.session.returnTo) {	3!
166	res.redirect(relative_path + req.session.returnTo.replace(new RegExp(`^${relative_path}`), ''));	3✔
167	} else {
168	res.redirect(`${relative_path}/`);	×
169	}
170	};
171
172	const results = await Promise.allSettled(callbacks.map(async (cb) => {	4✔
173	await cb(req.session.registration, req.body);	8✔
174	}));
175	const errors = results.map(result => result.status === 'rejected' && result.reason && result.reason.message).filter(Boolean);	8✔
176	if (errors.length) {	4✔
177	req.flash('errors', errors);	1✔
178	return req.session.save(() => {	1✔
179	res.redirect(`${nconf.get('relative_path')}/register/complete`);	1✔
180	});
181	}
182
183	if (req.session.registration.register === true) {	3!
184	res.locals.processLogin = true;	3✔
185	req.body.noscript = 'true'; // trigger full page load on error	3✔
186
187	const data = await registerAndLoginUser(req, res, req.session.registration);	3✔
188	if (!data) {	3!
189	return winston.warn('[register] Interstitial callbacks processed with no errors, but one or more interstitials remain. This is likely an issue with one of the interstitials not properly handling a null case or invalid value.');	×
190	}
191	done(data);	3✔
192	} else {
193	// Update user hash, clear registration data in session
194	const payload = req.session.registration;	×
195	const { uid } = payload;	×
196	delete payload.uid;	×
197	delete payload.returnTo;	×
198
199	Object.keys(payload).forEach((prop) => {	×
200	if (typeof payload[prop] === 'boolean') {	×
201	payload[prop] = payload[prop] ? 1 : 0;	×
202	}
203	});
204
205	await user.setUserFields(uid, payload);	×
206	done();	×
207	}
208	} catch (err) {
209	delete req.session.registration;	×
210	res.redirect(`${nconf.get('relative_path')}/?register=${encodeURIComponent(err.message)}`);	×
211	}
212	};
213
214	authenticationController.registerAbort = async (req, res) => {	1✔
215	if (req.uid && req.session.registration) {	6✔
216	// Email is the only cancelable interstitial
217	delete req.session.registration.updateEmail;	5✔
218
219	const { interstitials } = await user.interstitials.get(req, req.session.registration);	5✔
220	if (!interstitials.length) {	5✔
221	delete req.session.registration;	4✔
222	return res.redirect(nconf.get('relative_path') + (req.session.returnTo \|\| '/'));	4!
223	}
224	}
225
226	// End the session and redirect to home
227	req.session.destroy(() => {	2✔
228	res.clearCookie(nconf.get('sessionKey'), meta.configs.cookie.get());	2✔
229	res.redirect(`${nconf.get('relative_path')}/`);	2✔
230	});
231	};
232
233	authenticationController.login = async (req, res, next) => {	1✔
234	let { strategy } = await plugins.hooks.fire('filter:login.override', { req, strategy: 'local' });	84✔
235	if (!passport._strategy(strategy)) {	84!
236	winston.error(`[auth/override] Requested login strategy "${strategy}" not found, reverting back to local login strategy.`);	×
237	strategy = 'local';	×
238	}
239
240	if (plugins.hooks.hasListeners('action:auth.overrideLogin')) {	84!
241	return continueLogin(strategy, req, res, next);	×
242	}
243
244	const loginWith = meta.config.allowLoginWith \|\| 'username-email';	84✔
245	req.body.username = String(req.body.username).trim();	84✔
246	const errorHandler = res.locals.noScriptErrors \|\| helpers.noScriptErrors;	84✔
247	try {	84✔
248	await plugins.hooks.fire('filter:login.check', { req: req, res: res, userData: req.body });	84✔
249	} catch (err) {
250	return errorHandler(req, res, err.message, 403);	×
251	}
252	try {	84✔
253	const isEmailLogin = loginWith.includes('email') && req.body.username && utils.isEmailValid(req.body.username);	84✔
254	const isUsernameLogin = loginWith.includes('username') && !validator.isEmail(req.body.username);	84✔
255	if (isEmailLogin) {	84✔
256	const username = await user.getUsernameByEmail(req.body.username);	3✔
257	if (username !== '[[global:guest]]') {	3✔
258	req.body.username = username;	2✔
259	}
260	}
261	if (isEmailLogin \|\| isUsernameLogin) {	84✔
262	continueLogin(strategy, req, res, next);	83✔
263	} else {
264	errorHandler(req, res, `[[error:wrong-login-type-${loginWith}]]`, 400);	1✔
265	}
266	} catch (err) {
267	return errorHandler(req, res, err.message, 500);	×
268	}
269	};
270
271	function continueLogin(strategy, req, res, next) {
272	passport.authenticate(strategy, async (err, userData, info) => {	83✔
273	if (err) {	83✔
274	plugins.hooks.fire('action:login.continue', { req, strategy, userData, error: err });	12✔
275	return helpers.noScriptErrors(req, res, err.data \|\| err.message, 403);	12✔
276	}
277
278	if (!userData) {	71✔
279	return handleNoUserData(info, strategy, req, res);	3✔
280	}
281
282	setSessionCookie(req);	68✔
283
284	plugins.hooks.fire('action:login.continue', { req, strategy, userData, error: null });	68✔
285
286	if (!(userData.passwordExpiry && userData.passwordExpiry < Date.now())) {	68!
287	await handleLogin(userData, req, res);	68✔
288	}
289	})(req, res, next);
290	}
291
292	function handleNoUserData(info, strategy, req, res) {
293	if (typeof info === 'object') {	3!
294	info = '[[error:invalid-username-or-password]]';	3✔
295	}
296
297	plugins.hooks.fire('action:login.continue', { req, strategy, userData: null, error: new Error(info) });	3✔
298	return helpers.noScriptErrors(req, res, info, 403);	3✔
299	}
300
301	function setSessionCookie(req) {
302	if (req.body.remember === 'on') {	68✔
303	const duration = meta.getSessionTTLSeconds() * 1000;	3✔
304	req.session.cookie.maxAge = duration;	3✔
305	req.session.cookie.expires = new Date(Date.now() + duration);	3✔
306	} else {
307	const duration = meta.config.sessionDuration * 1000;	65✔
308	req.session.cookie.maxAge = duration \|\| false;	65✔
309	req.session.cookie.expires = duration ? new Date(Date.now() + duration) : false;	65✔
310	}
311	}
312
313	function getRedirectDestination(req) {
314	let destination;
315	if (req.session.returnTo) {	68!
NEW 316	destination = req.session.returnTo.startsWith('http') ?	×
317	req.session.returnTo :
318	nconf.get('relative_path') + req.session.returnTo;
NEW 319	delete req.session.returnTo;	×
320	} else {
321	destination = `${nconf.get('relative_path')}/`;	68✔
322	}
323	return destination;	68✔
324	}
325
326	async function handleLogin(userData, req, res) {
327	delete req.query.lang;	68✔
328	await authenticationController.doLogin(req, userData.uid);	68✔
329	const destination = getRedirectDestination(req);	68✔
330	(res.locals.redirectAfterLogin \|\| redirectAfterLogin)(req, res, destination);	68✔
331	}
332
333	function redirectAfterLogin(req, res, destination) {
334	if (req.body.noscript === 'true') {	67!
335	res.redirect(`${destination}?loggedin`);	×
336	} else {
337	res.status(200).send({	67✔
338	next: destination,
339	});
340	}
341	}
342
343	authenticationController.doLogin = async function (req, uid) {	1✔
344	if (!uid) {	75!
345	return;	×
346	}
347	const loginAsync = util.promisify(req.login).bind(req);	75✔
348	await loginAsync({ uid: uid }, { keepSessionInfo: req.res.locals.reroll !== false });	75✔
349	await authenticationController.onSuccessfulLogin(req, uid);	75✔
350	};
351
352	authenticationController.onSuccessfulLogin = async function (req, uid, trackSession = true) {	1✔
353	/*
354	* Older code required that this method be called from within the SSO plugin.
355	* That behaviour is no longer required, onSuccessfulLogin is now automatically
356	* called in NodeBB core. However, if already called, return prematurely
357	*/
358	if (req.loggedIn && !req.session.forceLogin) {	77✔
359	return true;	1✔
360	}
361
362	try {	76✔
363	const uuid = utils.generateUUID();	76✔
364
365	req.uid = uid;	76✔
366	req.loggedIn = true;	76✔
367	await meta.blacklist.test(req.ip);	76✔
368	await user.logIP(uid, req.ip);	76✔
369	await user.bans.unbanIfExpired([uid]);	76✔
370	await user.reset.cleanByUid(uid);	76✔
371
372	req.session.meta = {};	76✔
373
374	delete req.session.forceLogin;	76✔
375	// Associate IP used during login with user account
376	req.session.meta.ip = req.ip;	76✔
377
378	// Associate metadata retrieved via user-agent
379	req.session.meta = _.extend(req.session.meta, {	76✔
380	uuid: uuid,
381	datetime: Date.now(),
382	platform: req.useragent.platform,
383	browser: req.useragent.browser,
384	version: req.useragent.version,
385	});
386	await Promise.all([	76✔
387	new Promise((resolve) => {
388	req.session.save(resolve);	76✔
389	}),
390	trackSession ? user.auth.addSession(uid, req.sessionID) : undefined,	76✔
391	user.updateLastOnlineTime(uid),
392	user.onUserOnline(uid, Date.now()),
393	analytics.increment('logins'),
394	db.incrObjectFieldBy('global', 'loginCount', 1),
395	]);
396
397	// Force session check for all connected socket.io clients with the same session id
398	sockets.in(`sess_${req.sessionID}`).emit('checkSession', uid);	76✔
399
400	plugins.hooks.fire('action:user.loggedIn', { uid: uid, req: req });	76✔
401	} catch (err) {
402	req.session.destroy();	×
403	throw err;	×
404	}
405	};
406
407	const destroyAsync = util.promisify((req, callback) => req.session.destroy(callback));	1✔
408	const logoutAsync = util.promisify((req, callback) => req.logout(callback));	1✔
409
410	authenticationController.localLogin = async function (req, username, password, next) {	1✔
411	if (!username) {	80!
412	return next(new Error('[[error:invalid-username]]'));	×
413	}
414
415	if (!password \|\| !utils.isPasswordValid(password)) {	80!
416	return next(new Error('[[error:invalid-password]]'));	×
417	}
418
419	if (password.length > 512) {	80✔
420	return next(new Error('[[error:password-too-long]]'));	1✔
421	}
422
423	const userslug = slugify(username);	79✔
424	const uid = await user.getUidByUserslug(userslug);	79✔
425	try {	79✔
426	const [userData, isAdminOrGlobalMod, canLoginIfBanned] = await Promise.all([	79✔
427	user.getUserFields(uid, ['uid', 'passwordExpiry']),
428	user.isAdminOrGlobalMod(uid),
429	user.bans.canLoginIfBanned(uid),
430	]);
431
432	userData.isAdminOrGlobalMod = isAdminOrGlobalMod;	79✔
433
434	if (!canLoginIfBanned) {	79✔
435	return next(await getBanError(uid));	2✔
436	}
437
438	// Doing this after the ban check, because user's privileges might change after a ban expires
439	const hasLoginPrivilege = await privileges.global.can('local:login', uid);	77✔
440	if (parseInt(uid, 10) && !hasLoginPrivilege) {	77✔
441	return next(new Error('[[error:local-login-disabled]]'));	1✔
442	}
443
444	try {	76✔
445	const passwordMatch = await user.isPasswordCorrect(uid, password, req.ip);	76✔
446	if (!passwordMatch) {	74✔
447	return next(new Error('[[error:invalid-login-credentials]]'));	6✔
448	}
449	} catch (e) {
450	if (req.loggedIn) {	2!
451	await logoutAsync(req);	×
452	await destroyAsync(req);	×
453	}
454	throw e;	2✔
455	}
456
457	next(null, userData, '[[success:authentication-successful]]');	68✔
458	} catch (err) {
459	next(err);	2✔
460	}
461	};
462
463	authenticationController.logout = async function (req, res, next) {	1✔
464	if (!req.loggedIn \|\| !req.sessionID) {	3!
465	res.clearCookie(nconf.get('sessionKey'), meta.configs.cookie.get());	3✔
466	return res.status(200).send('not-logged-in');	3✔
467	}
468	const { uid } = req;	×
469	const { sessionID } = req;	×
470
471	try {	×
472	await user.auth.revokeSession(sessionID, uid);	×
473	await logoutAsync(req);	×
474	await destroyAsync(req);	×
475	res.clearCookie(nconf.get('sessionKey'), meta.configs.cookie.get());	×
476
477	await user.setUserField(uid, 'lastonline', Date.now() - (meta.config.onlineCutoff * 60000));	×
478	await db.sortedSetAdd('users:online', Date.now() - (meta.config.onlineCutoff * 60000), uid);	×
479	await plugins.hooks.fire('static:user.loggedOut', { req: req, res: res, uid: uid, sessionID: sessionID });	×
480
481	// Force session check for all connected socket.io clients with the same session id
482	sockets.in(`sess_${sessionID}`).emit('checkSession', 0);	×
483	const payload = {	×
484	next: `${nconf.get('relative_path')}/`,
485	};
486	plugins.hooks.fire('filter:user.logout', payload);	×
487
488	if (req.body.noscript === 'true') {	×
489	return res.redirect(payload.next);	×
490	}
491	res.status(200).send(payload);	×
492	} catch (err) {
493	next(err);	×
494	}
495	};
496
497	async function getBanError(uid) {
498	try {	2✔
499	const banInfo = await user.getLatestBanInfo(uid);	2✔
500
501	if (!banInfo.reason) {	2✔
502	banInfo.reason = '[[user:info.banned-no-reason]]';	1✔
503	}
504	const err = new Error(banInfo.reason);	2✔
505	err.data = banInfo;	2✔
506	return err;	2✔
507	} catch (err) {
508	if (err.message === 'no-ban-info') {	×
509	return new Error('[[error:user-banned]]');	×
510	}
511	throw err;	×
512	}
513	}
514
515	require('../promisify')(authenticationController, ['register', 'registerComplete', 'registerAbort', 'login', 'localLogin', 'logout']);	1✔

CMU-313 / NodeBB / 10689875771

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous