53 lines
2.2 KiB
TypeScript
53 lines
2.2 KiB
TypeScript
import { getGameDb } from '@/lib/db/client';
|
|
import { createSession, verifyPassword, DUMMY_HASH_FOR_UNKNOWN_USER } from '@/lib/auth';
|
|
|
|
// v0.71.0 — POST /api/login
|
|
// body { username: string, password: string } (both required non-empty; unknown fields 400).
|
|
// Success → 200 { sessionId, user: { username, admin } }; the session row lives 7 days and is
|
|
// sent back as X-Flight-Session on later requests. Failure → 401 { error }. An unknown
|
|
// username still runs one full scrypt against a fixed dummy digest so timing stays uniform.
|
|
|
|
export async function POST(req: Request) {
|
|
let body: unknown;
|
|
try {
|
|
const text = await req.text();
|
|
body = text ? JSON.parse(text) : undefined;
|
|
} catch {
|
|
return Response.json({ error: 'invalid JSON body' }, { status: 400 });
|
|
}
|
|
if (typeof body !== 'object' || body === null || Array.isArray(body)) {
|
|
return Response.json({ error: 'body must be a JSON object' }, { status: 400 });
|
|
}
|
|
const input = body as Record<string, unknown>;
|
|
for (const key of Object.keys(input)) {
|
|
if (key !== 'username' && key !== 'password') {
|
|
return Response.json({ error: `unknown field "${key}"` }, { status: 400 });
|
|
}
|
|
}
|
|
const username = input.username;
|
|
const password = input.password;
|
|
if (typeof username !== 'string' || username.length === 0) {
|
|
return Response.json({ error: 'username is required and must be a non-empty string' }, { status: 400 });
|
|
}
|
|
if (typeof password !== 'string' || password.length === 0) {
|
|
return Response.json({ error: 'password is required and must be a non-empty string' }, { status: 400 });
|
|
}
|
|
|
|
const inst = await getGameDb();
|
|
const res = inst.raw.exec('SELECT id, password_hash, admin FROM users WHERE username = ?', [username]);
|
|
const row = res[0]?.values?.[0];
|
|
if (!row) {
|
|
verifyPassword(password, DUMMY_HASH_FOR_UNKNOWN_USER); // uniform timing — result discarded
|
|
return Response.json({ error: 'invalid credentials' }, { status: 401 });
|
|
}
|
|
if (!verifyPassword(password, String(row[1]))) {
|
|
return Response.json({ error: 'invalid credentials' }, { status: 401 });
|
|
}
|
|
|
|
const sessionId = await createSession(inst, String(row[0]));
|
|
return Response.json({
|
|
sessionId,
|
|
user: { username, admin: Number(row[2]) === 1 },
|
|
});
|
|
}
|