more auth stuff

api/src/api.ts

@@ -108,7 +108,7 @@ export default function createApi(log: Log, pg: Pg, discogs) {
     app.use(bodyParser())
 
     app.keys = [SECRET];
-    app.use(session({ sameSite: 'None' }, app));
+    app.use(session(app));
 
     const { authRouter, passport } = routerAuth(log, pg);
     app.use(passport.initialize());
@@ -119,11 +119,7 @@ export default function createApi(log: Log, pg: Pg, discogs) {
         ctx.status = 200;
     });
 
-    async function requireAuth(ctx, next) {
-        await next();
-    }
-
-    router.get('/bundles', requireAuth, async (ctx, next) => {
+    router.get('/bundles', async (ctx, next) => {
         const bundles = await getBundles();
         ctx.response.body = bundles;
     })

api/src/routers/router.auth.ts

@@ -17,9 +17,10 @@ export default function authRouter(log, pg: Pg) {
         { usernameField: 'email' },
         function localStrategy(email, password, done) {
             pg.userFindEmail(email)
-                .then(user => {
+                .then(async user => {
                     if (!user) return done(null, false);
-                    if (!verifyPassword(user, password)) return done(null, false);
+                    const passwordMatch = await verifyPassword(user, password);
+                    if (!passwordMatch) return done(null, false);
                     return done(null, user);
                 })
                 .catch(e => done(e, null));
@@ -37,23 +38,39 @@ export default function authRouter(log, pg: Pg) {
 
     authRouter.post('/login', async (ctx, next) => {
         await passport.authenticate('local', (err, user, info, status) => {
-            if (user) {
-                ctx.login(user);
-                ctx.status = 200;
-                ctx.body = { status: 'success' };
-            } else {
-                ctx.status = 400;
-                ctx.body = { status: 'error' };
-            }
+            ctx.assert(user, 401, { error: 'incorrect login' });
+
+            ctx.login(user);
+            ctx.status = 200;
+            ctx.body = {
+                email: user.email,
+                discogs: user.discogs,
+            };
         })(ctx, next);
     });
 
+    authRouter.get('/login', async (ctx, next) => {
+        ctx.assert(ctx.isAuthenticated(), 401, { error: 'log in required' });
+
+        const user = ctx.state.user;
+        ctx.status = 200;
+        ctx.body = {
+            email: user.email,
+            discogs: user.discogs,
+        };
+    });
+
     authRouter.post('/register', async (ctx, next) => {
         const { discogs, email, password } = ctx.request.body;
         // fetch discogs data if they have it
         const params = { discogs, email, password, data: {} };
         const user = await pg.userCreate(params)
-        ctx.response.body = user;
+        ctx.login(user);
+        ctx.status = 200;
+        ctx.body = {
+            email: user.email,
+            discogs: user.discogs,
+        };
     });
 
     return { authRouter, passport };