prehistoric-systems/omnivore
1
0
Fork 0
mirror of https://github.com/omnivore-app/omnivore.git synced 2026-03-11 08:54:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

verify captcha in email-login and forgot-password api

Browse source
This commit is contained in:
Hongbo Wu 2024-04-08 12:27:29 +08:00
parent 7ed885bdab
commit ec309f5b0d
1 changed files with 26 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
packages/api/src/routers/auth/auth_router.ts
View file

@ -416,6 +416,7 @@ export function authRouter() {
interface LoginRequest {
email: string
password: string
recaptchaToken?: string
}
function isValidLoginRequest(obj: any): obj is LoginRequest {
return (
@ -430,7 +431,19 @@ export function authRouter() {
`${env.client.url}/auth/email-login?errorCodes=${LoginErrorCode.InvalidCredentials}`
)
}
const { email, password } = req.body
const { email, password, recaptchaToken } = req.body
if (process.env.RECAPTCHA_CHALLENGE_SECRET_KEY) {
const verified =
recaptchaToken && (await verifyChallengeRecaptcha(recaptchaToken))
if (!verified) {
logger.info('recaptcha failed', { recaptchaToken, verified })
return res.redirect(
`${env.client.url}/auth/email-login?errorCodes=UNKNOWN`
)
}
}
try {
const user = await userRepository.findByEmail(email.trim())
if (!user || user.status === StatusType.Deleted) {
@ -514,7 +527,7 @@ export function authRouter() {
const verified =
recaptchaToken && (await verifyChallengeRecaptcha(recaptchaToken))
if (!verified) {
logger.info('recaptcha failed', recaptchaToken, verified)
logger.info('recaptcha failed', { recaptchaToken, verified })
return res.redirect(
`${env.client.url}/auth/email-signup?errorCodes=UNKNOWN`
)
@ -642,6 +655,17 @@ export function authRouter() {
)
}
const captchaToken = req.body.recaptchaToken as string
if (process.env.RECAPTCHA_CHALLENGE_SECRET_KEY) {
const verified = await verifyChallengeRecaptcha(captchaToken)
if (!verified) {
logger.info('recaptcha failed', { captchaToken, verified })
return res.redirect(
`${env.client.url}/auth/forgot-password?errorCodes=UNKNOWN`
)
}
}
try {
const user = await userRepository.findByEmail(email)
if (!user || user.status === StatusType.Deleted) {