| import express from 'express'; |
| import bcrypt from 'bcryptjs'; |
| import { db } from './db'; |
|
|
| export const authRouter = express.Router(); |
|
|
| authRouter.post('/login', (req, res) => { |
| const { username, password } = req.body; |
| if (!username || !password) { |
| return res.render('message', { title: 'Error', message: 'Please provide both username and password.', backUrl: '/login' }); |
| } |
|
|
| const user = db.prepare('SELECT * FROM users WHERE user_name = ?').get(username) as any; |
| if (!user || !bcrypt.compareSync(password, user.user_password)) { |
| return res.render('message', { title: 'Login Failed', message: 'Invalid username or password.', backUrl: '/login' }); |
| } |
|
|
| const group = db.prepare('SELECT * FROM usergroups WHERE group_id = ?').get(user.user_group) as any; |
|
|
| (req.session as any).user = { |
| id: user.user_id, |
| name: user.user_name, |
| email: user.user_email, |
| groupId: user.user_group, |
| isAdmin: group ? Boolean(group.has_admin_access) : false |
| }; |
|
|
| res.redirect('/'); |
| }); |
|
|
| authRouter.post('/register', (req, res) => { |
| const { username, email, password, password_again } = req.body; |
| if (!username || !email || !password) { |
| return res.render('message', { title: 'Error', message: 'Please fill in all required fields.', backUrl: '/register' }); |
| } |
| if (password !== password_again) { |
| return res.render('message', { title: 'Error', message: 'Passwords do not match.', backUrl: '/register' }); |
| } |
|
|
| const existing = db.prepare('SELECT user_id FROM users WHERE user_name = ?').get(username); |
| if (existing) { |
| return res.render('message', { title: 'Error', message: 'Username is already taken.', backUrl: '/register' }); |
| } |
|
|
| const hash = bcrypt.hashSync(password, 10); |
| const result = db.prepare('INSERT INTO users (user_group, user_name, user_password, user_email) VALUES (?, ?, ?, ?)').run(2, username, hash, email); |
|
|
| (req.session as any).user = { |
| id: Number(result.lastInsertRowid), |
| name: username, |
| email: email, |
| groupId: 2, |
| isAdmin: false |
| }; |
|
|
| res.redirect('/'); |
| }); |
|
|
| authRouter.get('/logout', (req, res) => { |
| req.session.destroy(() => { |
| res.redirect('/'); |
| }); |
| }); |
|
|
