-
Notifications
You must be signed in to change notification settings - Fork 100
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: add
hashPassword & verifyPassword server utils
* feat: support password * [autofix.ci] apply automated fixes * feat(playground): add login endpoint * chore: refactor * up * lint --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Sébastien Chopin <[email protected]>
- Loading branch information
3 people
authored
Sep 25, 2024
1 parent
7431e56
commit 0c4d050
Showing
14 changed files
with
709 additions
and
69 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,71 @@ | ||
| <script lang="ts" setup> | ||
| const isOpen = ref(false) | ||
| const { fetch } = useUserSession() | ||
| const toast = useToast() | ||
| async function login(event: SubmitEvent) { | ||
| const target = event.target as HTMLFormElement | ||
| await $fetch('/api/login', { | ||
| method: 'POST', | ||
| body: { | ||
| email: target.email.value, | ||
| password: target.password.value, | ||
| }, | ||
| }).then(() => { | ||
| fetch() | ||
| isOpen.value = false | ||
| toast.add({ | ||
| color: 'green', | ||
| title: 'User logged in successfully', | ||
| }) | ||
| }).catch((err) => { | ||
| console.log(err) | ||
| toast.add({ | ||
| color: 'red', | ||
| title: err.data?.message || err.message, | ||
| }) | ||
| }) | ||
| } | ||
| </script> | ||
|
|
||
| <template> | ||
| <UButton | ||
| size="xs" | ||
| color="gray" | ||
| @click="isOpen = true" | ||
| > | ||
| Login | ||
| </UButton> | ||
|
|
||
| <UDashboardModal | ||
| v-model="isOpen" | ||
| title="Login" | ||
| description="Enter your email and password" | ||
| > | ||
| <form @submit.prevent="login($event)"> | ||
| <UFormGroup label="Email"> | ||
| <UInput | ||
| name="email" | ||
| type="email" | ||
| /> | ||
| </UFormGroup> | ||
| <UFormGroup label="Password"> | ||
| <UInput | ||
| name="password" | ||
| type="password" | ||
| /> | ||
| </UFormGroup> | ||
| <UButton | ||
| type="submit" | ||
| color="black" | ||
| class="mt-2" | ||
| > | ||
| Login | ||
| </UButton> | ||
| </form> | ||
| </UDashboardModal> | ||
| </template> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,71 @@ | ||
| <script lang="ts" setup> | ||
| const isOpen = ref(false) | ||
| const { fetch } = useUserSession() | ||
| const toast = useToast() | ||
| async function register(event: SubmitEvent) { | ||
| const target = event.target as HTMLFormElement | ||
| await $fetch('/api/register', { | ||
| method: 'POST', | ||
| body: { | ||
| email: target.email.value, | ||
| password: target.password.value, | ||
| }, | ||
| }).then(() => { | ||
| fetch() | ||
| isOpen.value = false | ||
| toast.add({ | ||
| color: 'green', | ||
| title: 'User registered successfully', | ||
| }) | ||
| }).catch((err) => { | ||
| console.log(err) | ||
| toast.add({ | ||
| color: 'red', | ||
| title: err.data?.message || err.message, | ||
| }) | ||
| }) | ||
| } | ||
| </script> | ||
|
|
||
| <template> | ||
| <UButton | ||
| size="xs" | ||
| color="gray" | ||
| @click="isOpen = true" | ||
| > | ||
| Register | ||
| </UButton> | ||
|
|
||
| <UDashboardModal | ||
| v-model="isOpen" | ||
| title="Register" | ||
| description="Enter your email and password" | ||
| > | ||
| <form @submit.prevent="register($event)"> | ||
| <UFormGroup label="Email"> | ||
| <UInput | ||
| name="email" | ||
| type="email" | ||
| /> | ||
| </UFormGroup> | ||
| <UFormGroup label="Password"> | ||
| <UInput | ||
| name="password" | ||
| type="password" | ||
| /> | ||
| </UFormGroup> | ||
| <UButton | ||
| type="submit" | ||
| color="black" | ||
| class="mt-2" | ||
| > | ||
| Register | ||
| </UButton> | ||
| </form> | ||
| </UDashboardModal> | ||
| </template> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| export default eventHandler(async (event) => { | ||
| const { password } = await readBody(event) | ||
|
|
||
| if (password !== '123456') { | ||
| throw createError({ | ||
| statusCode: 401, | ||
| message: 'Wrong password', | ||
| }) | ||
| } | ||
| await setUserSession(event, { | ||
| user: { | ||
| password: 'admin', | ||
| }, | ||
| loggedInAt: Date.now(), | ||
| }) | ||
|
|
||
| return {} | ||
| }) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,18 +1,45 @@ | ||
| export default eventHandler(async (event) => { | ||
| const { password } = await readBody(event) | ||
| import { z } from 'zod' | ||
|
|
||
| if (password !== '123456') { | ||
| throw createError({ | ||
| statusCode: 401, | ||
| message: 'Wrong password', | ||
| }) | ||
| } | ||
| await setUserSession(event, { | ||
| user: { | ||
| password: 'admin', | ||
| }, | ||
| loggedInAt: Date.now(), | ||
| interface DBUser { | ||
| id: number | ||
| email: string | ||
| password: string | ||
| } | ||
|
|
||
| export default defineLazyEventHandler(async () => { | ||
| const db = useDatabase() | ||
|
|
||
| await db.sql`CREATE TABLE IF NOT EXISTS users ("id" INTEGER PRIMARY KEY AUTOINCREMENT, "email" TEXT UNIQUE NOT NULL, "password" TEXT NOT NULL)` | ||
|
|
||
| const invalidCredentialsError = createError({ | ||
| statusCode: 401, | ||
| // This message is intentionally vague to prevent user enumeration attacks. | ||
| message: 'Invalid credentials', | ||
| }) | ||
|
|
||
| return {} | ||
| return defineEventHandler(async (event) => { | ||
| const { email, password } = await readValidatedBody(event, z.object({ | ||
| email: z.string().email(), | ||
| password: z.string().min(8), | ||
| }).parse) | ||
|
|
||
| const user = await db.sql<{ rows: DBUser[] }>`SELECT * FROM users WHERE email = ${email}`.then(result => result.rows[0]) | ||
|
|
||
| if (!user) { | ||
| throw invalidCredentialsError | ||
| } | ||
|
|
||
| if (!(await verifyPassword(user.password, password))) { | ||
| throw invalidCredentialsError | ||
| } | ||
|
|
||
| await setUserSession(event, { | ||
| user: { | ||
| email, | ||
| }, | ||
| loggedInAt: Date.now(), | ||
| }) | ||
|
|
||
| return setResponseStatus(event, 201) | ||
| }) | ||
| }) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,29 @@ | ||
| import { z } from 'zod' | ||
|
|
||
| export default defineLazyEventHandler(async () => { | ||
| const db = useDatabase() | ||
|
|
||
| await db.sql`CREATE TABLE IF NOT EXISTS users ("id" INTEGER PRIMARY KEY AUTOINCREMENT, "email" TEXT UNIQUE NOT NULL, "password" TEXT NOT NULL)` | ||
|
|
||
| return defineEventHandler(async (event) => { | ||
| const { email, password } = await readValidatedBody(event, z.object({ | ||
| email: z.string().email(), | ||
| password: z.string().min(8), | ||
| }).parse) | ||
|
|
||
| const hashedPassword = await hashPassword(password) | ||
|
|
||
| await db.sql`INSERT INTO users(email, password) VALUES (${email}, ${hashedPassword})` | ||
|
|
||
| // In real applications, you should send a confirmation email to the user before logging them in. | ||
|
|
||
| await setUserSession(event, { | ||
| user: { | ||
| email, | ||
| }, | ||
| loggedInAt: Date.now(), | ||
| }) | ||
|
|
||
| return setResponseStatus(event, 201) | ||
| }) | ||
| }) |
Oops, something went wrong.