Merge pull request #29 from ln-markets/add-password

Author: kibotrel

apps/api/package.json

@@ -26,6 +26,7 @@
     "cuid": "^2.1.8",
     "dotenv": "^10.0.0",
     "express": "^4.17.1",
+    "express-session": "^1.17.2",
     "express-winston": "^4.2.0",
     "helmet": "^4.6.0",
     "ln-service": "^52.14.2",

apps/api/src/express.js

@@ -24,6 +24,7 @@ module.exports = () => {
   app.use(bodyParser.json({ extended: false }))
   app.use(bodyParser.text())
   app.use(bodyParser.urlencoded({ extended: false }))
+  app.use(require('@/middleware/session.js'))
   app.get('/status', (req, res) => {
     res.status(200).end()
   })

apps/api/src/helpers/errors.js

@@ -0,0 +1,15 @@
+module.exports = class HttpError extends Error {
+  constructor(status, code, message, details) {
+    if (!status) throw new Error('An HTTP Error need a status')
+    if (!code) throw new Error('An HTTP Error need a code')
+
+    super(code)
+
+    this.name = 'HttpError'
+    this.status = status
+
+    if (code) this.code = code
+    if (message) this.message = message
+    if (details) this.details = details
+  }
+}

apps/api/src/middleware/auth.js

@@ -0,0 +1,12 @@
+const HttpError = require('@/helpers/errors.js')
+
+module.exports = (req, res, next) => {
+  if (!req.session || !req.session.auth) {
+    throw new HttpError(
+      401,
+      'unauthorized',
+      'You do not have permission to reach this ressource.'
+    )
+  }
+  next()
+}

apps/api/src/middleware/cors.js

@@ -1,6 +1,8 @@
 const cors = require('cors')
 
 module.exports = cors({
+  credentials: true,
+  exposedHeaders: ['Set-Cookie', 'Cookie'],
   origin: (origin, callback) => {
     if (
       !origin ||

apps/api/src/middleware/errors.js

@@ -1,3 +1,5 @@
+const HttpError = require('@/helpers/errors.js')
+
 const handleLNMarketsRestError = (error) => {
   const { message, statusCode, code } = error
 
@@ -21,15 +23,28 @@ const internalError = (opt = {}) => {
     statusCode,
     json: {
       code: 'internalError',
-      message: 'Internal error',
+      message: 'Internal error.',
+    },
+  }
+}
+
+const parseHttpError = ({ status, code, message }) => {
+  return {
+    statusCode: status,
+    json: {
+      code,
+      message: message || code,
     },
   }
 }
 
 module.exports = (error, req, res, next) => {
   let response
+
   if (error.name === 'LNMarketsRestError') {
     response = handleLNMarketsRestError(error)
+  } else if (error instanceof HttpError) {
+    response = parseHttpError(error)
   } else {
     response = internalError()
   }

apps/api/src/middleware/session.js

@@ -0,0 +1,23 @@
+const dotenv = require('dotenv')
+dotenv.config()
+
+const def = {
+  userSecret: 'Default user secret change me',
+}
+
+const session = require('express-session')
+
+module.exports = session({
+  secret: process.env.SESSION_USER_SECRET || def.userSecret,
+  resave: false,
+  saveUninitialized: true,
+  name: process.env.SESSION_USER_COOKIE_NAME || 'session',
+  cookie: {
+    httpOnly: true,
+    maxAge:
+      parseInt(process.env.SESSION_USER_COOKIE_MAXAGE) ||
+      1000 * 60 * 60 * 24 * 30,
+    path: '/',
+    sameSite: process.env.SESSION_COOKIE_SAMESITE || true,
+  },
+})

apps/api/src/routes/index.js

@@ -1,9 +1,11 @@
 const express = require('express')
-const router = express.Router()
+const isAuth = require('@/middleware/auth.js')
 
-router.get('/auth', require('./auth/get.js'))
-router.get('/futures', require('./futures/get.js'))
+const router = express.Router()
 
+router.get('/auth', [isAuth], require('./auth/get.js'))
+router.get('/futures', [isAuth], require('./futures/get.js'))
+router.post('/login', require('./login/post.js'))
 router.use('/user', require('./user/index.js'))
 
 module.exports = router

apps/api/src/routes/login/post.js

@@ -0,0 +1,15 @@
+const HttpError = require('@/helpers/errors.js')
+
+module.exports = (req, res, next) => {
+  try {
+    if (req.body.password === process.env.APP_PASSWORD) {
+      req.session.auth = true
+    } else {
+      throw new HttpError(400, 'wrongPassword', 'Given password is incorrect.')
+    }
+
+    res.end()
+  } catch (error) {
+    next(error)
+  }
+}

apps/api/src/routes/user/deposit/post.js

@@ -1,6 +1,8 @@
 const LNMarketsAPI = require('@/classes/lnmarkets-api.js')
 const LND = require('@/classes/lnd.js')
 
+const HttpError = require('@/helpers/errors.js')
+
 module.exports = async (req, res, next) => {
   try {
     const { amount } = req.body
@@ -13,7 +15,11 @@ module.exports = async (req, res, next) => {
     const { tokens } = await LND.decodePaymentRequest({ request })
 
     if (amount !== tokens) {
-      throw new Error('WrongAmountInvoice')
+      throw new HttpError(
+        400,
+        'WrongAmountInvoice',
+        'Amount request does not match with tokens in payment request.'
+      )
     }
 
     const { secret, paths } = await LND.pay({ request })