129 lines
2.9 KiB
TypeScript
129 lines
2.9 KiB
TypeScript
import { Context } from 'elysia'
|
|
import {
|
|
getClientIp,
|
|
getDatabaseConnection,
|
|
jsonResponse,
|
|
verifyTurstileOrVerifyCode
|
|
} from '../../../lib/util'
|
|
import { resetCodes, users } from '../../../lib/tables'
|
|
import { and, desc, eq, sql } from 'drizzle-orm'
|
|
import bcrypt from 'bcryptjs'
|
|
|
|
type Body = {
|
|
token: string | null
|
|
verifyCode: string | null
|
|
code: string
|
|
password: string
|
|
}
|
|
|
|
export async function handler (context: Context) {
|
|
const dbInfo0 = getDatabaseConnection(0)
|
|
|
|
if (!dbInfo0)
|
|
return jsonResponse(
|
|
{ success: false, message: 'Failed to connect to database' },
|
|
500
|
|
)
|
|
const { connection: connection0, db: db0 } = dbInfo0
|
|
|
|
const body = context.body as Body
|
|
if (!body.token || !body.code || !body.password) {
|
|
connection0.end()
|
|
return jsonResponse(
|
|
{
|
|
success: false,
|
|
message: 'Token, code and password must be in POST data'
|
|
},
|
|
400
|
|
)
|
|
}
|
|
if (body.code.length != 64) {
|
|
connection0.end()
|
|
return jsonResponse(
|
|
{
|
|
success: false,
|
|
message: 'Invalid verify code (codes can only be used once)'
|
|
},
|
|
400
|
|
)
|
|
}
|
|
const ip = getClientIp(context)
|
|
if (!ip) {
|
|
connection0.end()
|
|
return jsonResponse(
|
|
{
|
|
success: false,
|
|
message: 'Failed to get required info'
|
|
},
|
|
400
|
|
)
|
|
}
|
|
|
|
if (!(await verifyTurstileOrVerifyCode(body.token, body.verifyCode, ip, db0)))
|
|
return jsonResponse(
|
|
{
|
|
success: false,
|
|
message:
|
|
body.token != null
|
|
? 'Invalid captcha token'
|
|
: 'Invalid verify code (codes can only be used once)'
|
|
},
|
|
400
|
|
)
|
|
|
|
const time = Math.floor(Date.now() / 1000)
|
|
const codeExists = await db0
|
|
.select({ id: resetCodes.id, userId: resetCodes.userId })
|
|
.from(resetCodes)
|
|
.where(
|
|
and(
|
|
eq(resetCodes.ip, ip),
|
|
eq(resetCodes.usedTimestamp, 0),
|
|
eq(resetCodes.code, body.code),
|
|
sql`${resetCodes.timestamp} >= UNIX_TIMESTAMP() - 600`,
|
|
eq(resetCodes.type, 0)
|
|
)
|
|
)
|
|
.orderBy(desc(resetCodes.id))
|
|
.limit(1)
|
|
.execute()
|
|
if (codeExists[0]) {
|
|
await db0
|
|
.update(resetCodes)
|
|
.set({ usedTimestamp: time })
|
|
.where(
|
|
and(
|
|
eq(resetCodes.id, codeExists[0].id),
|
|
eq(resetCodes.ip, ip),
|
|
eq(resetCodes.usedTimestamp, 0),
|
|
eq(resetCodes.code, body.code),
|
|
eq(resetCodes.type, 0)
|
|
)
|
|
)
|
|
.execute()
|
|
const hashedPassword = await bcrypt.hash(body.password, 10)
|
|
await db0
|
|
.update(users)
|
|
.set({ password: hashedPassword })
|
|
.where(eq(users.id, codeExists[0].userId))
|
|
.execute()
|
|
connection0.end()
|
|
return jsonResponse(
|
|
{
|
|
success: true,
|
|
message: null
|
|
},
|
|
200
|
|
)
|
|
} else {
|
|
connection0.end()
|
|
return jsonResponse(
|
|
{
|
|
success: false,
|
|
message: 'Invalid reset code (codes can only be used once)'
|
|
},
|
|
400
|
|
)
|
|
}
|
|
}
|