返回提交历史
Modified
src/controllers/custom/ircDroppedController.ts
+19
-4
Modified
src/services/loginService.ts
+9
-8
XFEstudio/SpaceNinjaServer
chore: improve authentication and Dropped logic (#1296)
- Dropped is now also unset by getAccountForRequest - Improved how nonce is validated to avoid possible parser mismatch issues to smuggle a 0 - Updated ircDroppedController to perform only a single MongoDB operation Reviewed-on: https://onlyg.it/OpenWF/SpaceNinjaServer/pulls/1296
7f5592e0
代码差异
2 个文件
+28
-12
@@ -1,9 +1,24 @@
1
import { getAccountForRequest } from "@/src/services/loginService";
1
import { Account } from "@/src/models/loginModel";
2
2
import { RequestHandler } from "express";
3
3
4
4
export const ircDroppedController: RequestHandler = async (req, res) => {
5
const account = await getAccountForRequest(req);
6
account.Dropped = true;
7
await account.save();
5
if (!req.query.accountId) {
6
throw new Error("Request is missing accountId parameter");
7
}
8
const nonce: number = parseInt(req.query.nonce as string);
9
if (!nonce) {
10
throw new Error("Request is missing nonce parameter");
11
}
12
13
await Account.updateOne(
14
{
15
_id: req.query.accountId,
16
Nonce: nonce
17
},
18
{
19
Dropped: true
20
}
21
);
22
8
23
res.end();
9
24
};
@@ -69,26 +69,27 @@ export const getAccountForRequest = async (req: Request): Promise<TAccountDocume
69
69
if (!req.query.accountId) {
70
70
throw new Error("Request is missing accountId parameter");
71
71
}
72
if (!req.query.nonce || parseInt(req.query.nonce as string) === 0) {
72
const nonce: number = parseInt(req.query.nonce as string);
73
if (!nonce) {
73
74
throw new Error("Request is missing nonce parameter");
74
75
}
76
75
77
const account = await Account.findOne({
76
78
_id: req.query.accountId,
77
Nonce: req.query.nonce
79
Nonce: nonce
78
80
});
79
81
if (!account) {
80
82
throw new Error("Invalid accountId-nonce pair");
81
83
}
82
return account;
83
};
84
85
export const getAccountIdForRequest = async (req: Request): Promise<string> => {
86
const account = await getAccountForRequest(req);
87
84
if (account.Dropped && req.query.ct) {
88
85
account.Dropped = undefined;
89
86
await account.save();
90
87
}
91
return account._id.toString();
88
return account;
89
};
90
91
export const getAccountIdForRequest = async (req: Request): Promise<string> => {
92
return (await getAccountForRequest(req))._id.toString();
92
93
};
93
94
94
95
export const isAdministrator = (account: TAccountDocument): boolean => {