48 lines
1.5 KiB
TypeScript
48 lines
1.5 KiB
TypeScript
import { readBody, setCookie, setResponseStatus } from "h3"
|
|
import argon2 from "argon2"
|
|
import { User } from "../../models/user"
|
|
import { REFRESH_COOKIE } from "../../utils/auth"
|
|
import { getAuthValidationMessage } from "../../utils/auth-validation"
|
|
|
|
export default defineEventHandler(async (event) => {
|
|
const body = await readBody(event)
|
|
const validationMessage = getAuthValidationMessage(body, [
|
|
{ name: "email", email: true },
|
|
{ name: "password", minimumLength: 8 },
|
|
])
|
|
if (validationMessage) {
|
|
setResponseStatus(event, 400)
|
|
return { message: validationMessage }
|
|
}
|
|
|
|
const user = await User.findOne({ email: body.email.toLowerCase() }).select(
|
|
"+refreshToken +passwordHash",
|
|
)
|
|
let passwordMatches = false
|
|
if (user) {
|
|
try {
|
|
// Bun.password's default output is PHC Argon2id and argon2 verifies
|
|
// its encoded algorithm and parameters directly.
|
|
passwordMatches = await argon2.verify(user.passwordHash, body.password)
|
|
} catch {
|
|
// Malformed or unsupported stored hashes must not reveal account state.
|
|
}
|
|
}
|
|
|
|
if (!user || !passwordMatches) {
|
|
setResponseStatus(event, 400)
|
|
return { message: "The email or password is wrong" }
|
|
}
|
|
|
|
setCookie(event, REFRESH_COOKIE, user.refreshToken, {
|
|
path: "/",
|
|
httpOnly: true,
|
|
sameSite: "lax",
|
|
secure: !import.meta.dev,
|
|
...(body.remember ? { maxAge: 60 * 60 * 24 * 30 } : {}),
|
|
})
|
|
setResponseStatus(event, 200)
|
|
// The long-lived refresh token is deliberately omitted from the JSON body.
|
|
return {}
|
|
})
|