Yavook.de/node-fftcg
Archived
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

db: input validation and error messages

Browse source
This commit is contained in:
Jörn-Michael Miehe 2019-05-08 21:35:11 +02:00
parent 4b6b5f339f
commit eee3ed96ac
1 changed files with 81 additions and 56 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

61
backend/db.coffee
View file

@ -7,6 +7,14 @@ sqlite3 = (require 'sqlite3').verbose()
# bruteforce countermeasure
saltRounds = 13
messages =
empty: 'Empty user name or password'
hash: 'Failed to process your data, try again later'
exists: 'User name is already taken'
noexists: 'Wrong user name or password'
password: 'Wrong user name or password'
db: 'Failed to access the database, try again later'
class FFTCGDB
constructor: (filename, truncate) ->
@filename = filename
@ -56,24 +64,33 @@ class FFTCGDB
@db.close (err) ->
if err
logger.error "FAIL '#{err.message}'"
reject 'db'
reject null
else
logger.warn "OK close '#{@filename}'"
resolve 'ok'
resolve null
validate: (login, password) ->
defined = (value) -> value? and value isnt ''
new Promise (resolve, reject) =>
if (defined login) and (defined password)
# both are defined
resolve null
else
# no user name or password given
logger.info "validate: FAIL empty '#{login}' or password"
reject null
register: (login, password) ->
new Promise (resolve, reject) =>
# validate user input
if login == '' or password == ''
# no user name or password given
logger.info "reg: FAIL empty '#{login}' or password"
reject 'invalid'
@validate login, password
.then =>
# hash password
bcrypt.hash password, saltRounds, (err, hash) =>
if err
logger.warn "reg: FAIL hash for '#{login}'"
reject 'hash'
reject messages.hash
else
# try creating row in users table
@ -82,7 +99,7 @@ class FFTCGDB
stmt.finalize()
if err
logger.warn "reg: FAIL db '#{err.code}' for '#{login}'"
reject 'existence' # user already exists
reject messages.exists # user already exists
else
logger.info "reg: OK '#{login}'"
@ -91,27 +108,33 @@ class FFTCGDB
user: @lastID
login: login
.catch ->
reject messages.empty
login: (login, password) ->
new Promise (resolve, reject) =>
# validate user input
@validate login, password
.then =>
# get users table row
stmt = @db.prepare 'SELECT user, login, pwdhash FROM users WHERE login = ?'
stmt.get [login], (err, row) =>
stmt.finalize()
if err
logger.warn "login: FAIL db '#{err.code}' for '#{login}'"
reject 'db'
reject messages.db
else if not row
# hash the password for timing attack reasons
bcrypt.hash password, saltRounds, (err, hash) ->
logger.debug "login: FAIL nonexistent '#{login}'"
reject 'existence' # user doesnt exist
reject messages.noexists # user doesnt exist
else
bcrypt.compare password, row.pwdhash, (err, res) ->
if err
logger.warn "login: FAIL hash for '#{login}'"
reject 'hash'
reject messages.hash
if res == true
logger.debug "login: OK '#{row.login}'"
@ -122,8 +145,10 @@ class FFTCGDB
else
logger.debug "login: FAIL password for '#{login}'"
# login failed
reject 'login'
reject messages.password # login failed
.catch ->
reject messages.empty
addDeck: (user, deckCards) ->
new Promise (resolve, reject) =>
@ -133,7 +158,7 @@ class FFTCGDB
stmt.finalize()
if err
logger.warn "addDeck: FAIL db '#{err.code}' for '#{user}'"
reject 'db'
reject messages.db
else
logger.debug "addDeck: OK '#{@lastID}'"
@ -146,7 +171,7 @@ class FFTCGDB
stmt.finalize()
if err
logger.warn "modDeck: FAIL db '#{err.code}' for '#{deckID}'"
reject 'db'
reject messages.db
else
logger.debug "modDeck: OK '#{deckID}'"
resolve deckID
@ -158,7 +183,7 @@ class FFTCGDB
stmt.finalize()
if err
logger.warn "getDeck: FAIL db '#{err.code}' for '#{deckID}'"
reject 'db'
reject messages.db
else
logger.debug "getDeck: OK '#{deckID}'"
resolve (id: row.deck, content: JSON.parse row.json for row, i in rows)
@ -170,7 +195,7 @@ class FFTCGDB
stmt.finalize()
if err
logger.warn "delDeck: FAIL db '#{err.code}' for '#{deckID}'"
reject 'db'
reject messages.db
else
logger.debug "delDeck: OK '#{deckID}'"
resolve deckID