MeteoriteH/Back/routes/login.js

const express = require("express")
const router = express.Router()
const bodyParser = require("body-parser")
var sanitize = require("mongo-sanitize")
const mongoose = require("mongoose")
const User = require("./../model/user.js")
const bcrypt = require("bcrypt")
const jwt = require("jsonwebtoken")
require("dotenv").config()
const JWT_SECRET = process.env.JWT_SECRET
const fetch = (...args) =>
	import("node-fetch").then(({ default: fetch }) => fetch(...args))
const speakeasy = require("speakeasy")
const rateLimit = require("express-rate-limit")
const limiter = rateLimit({
	windowMs: 5 * 1000, // 5 seconds
	max: 1, // Limit each IP to 1 requests per `window`
	standardHeaders: true, // Return rate limit info in the `RateLimit-*` headers
	legacyHeaders: false, // Disable the `X-RateLimit-*` headers
	handler: (request, response, next, options) => {
		return response.json({
			status: "error",
			error: "Too many requests try again later.",
		})
	},
})

router.use(bodyParser.json())

router.get("/", (req, res) => {
	res.redirect("/")
})

router.get(["/RequestAuth", "/RequestAuth.ashx"], (req, res) => {
	if (!req.cookies[".ROBLOSECURITY"]) {
		res.status(403).end()
	}
	res.send(
		"https://www.mete0r.xyz/Login/Negotiate.ashx?suggest=" +
			req.cookies[".ROBLOSECURITY"],
	)
}) // studio

router.get(["/Negotiate", "/Negotiate.ashx"], (req, res) => {
	if (!req.query.suggest) {
		res.status(403).end()
	}
	//res.cookie('jwt', req.query.suggest) // maxage is 24 hours
	res.cookie(".ROBLOSECURITY", req.query.suggest)
	res.cookie(".RBXID", req.query.suggest)
	res.send(req.query.suggest)
}) // studio

router.post("/", limiter, async (req, res) => {
	//console.log(req.headers)
	let { username, password, _2fa } = req.body
	if (
		!username &&
		req.headers?.["user-agent"]?.includes("RobloxStudio/WinInet") === true
	) {
		// Studio login
		username = req.body.cvalue ?? req.body.username
		password = req.body.password ?? req.body.ticket
		_2fa = req.body.code
	}
	if (!username || typeof username !== "string") {
		return res.json({
			status: "error",
			error: "Usernames needs to be sent and it needs to be a string",
		})
	}
	if (!password || typeof password !== "string") {
		return res.json({
			status: "error",
			error: "Password needs to be sent and it needs to be a string",
		})
	}

	if (password.length < 4) {
		return res.json({
			status: "error",
			error: "Password needs to be at least 5 characters",
		})
	}

	sanitizedusername = sanitize(username)

	const user = await User.findOne({ username: sanitizedusername }) /*.lean()*/
	if (!user) {
		if (req.headers?.["user-agent"] === "RobloxStudio/WinInet") {
			// studio response
			return res.json({
				errors: [
					{
						code: 1,
						message: "Incorrect password",
					},
				],
			})
		}
		return res.json({ status: "error", error: "Invalid username/password" })
	}

	if (user.twofasecrets) {
		const json = JSON.parse(user.twofasecrets)
		if (json.verified === true) {
			if (!_2fa) {
				if (req.headers?.["user-agent"] === "RobloxStudio/WinInet") {
					// studio response
					return res.json({
						user: {
							id: user.userid,
							name: user.username,
						},
						twoStepVerificationData: {
							mediaType: "Email",
							ticket: password,
						},
						isBanned: false,
					})
				}
				return res.json({
					status: "error",
					error: "2FA Enabled on account but 2fa not sent",
				})
			}
			const valid = speakeasy.totp.verify({
				secret: json.secret,
				encoding: "ascii",
				token: _2fa,
			})
			if (valid === false) {
				if (req.headers?.["user-agent"] === "RobloxStudio/WinInet") {
					// studio response
					return res.json({
						errors: [
							{
								code: 6,
								message: "Invalid two step verify code.",
							},
						],
					})
				}
				return res.json({ status: "error", error: "Invalid 2FA Code" })
			}
		} else {
			// basically if they haven't verified that they know the secret before we will just remove it for them
			user.twofasecrets = undefined
			user.markModified("twofasecrets")
			user.save()
		}
	}

	if (
		(await bcrypt.compare(password, user.password)) ||
		password === user.password
	) {
		// the username and password match
		// lets make a token for them using the data from our database
		const ip = req.headers["cf-connecting-ip"] || req.socket.remoteAddress
		const token = jwt.sign(
			{
				id: user._id,
				username: user.username,
				admin: user.admin,
				userid: user.userid,
				ip,
				furry: true,
			},
			JWT_SECRET,
			{ expiresIn: "24h" },
		)
		if (req.headers?.["user-agent"] != "RobloxStudio/WinInet") {
			res.cookie("jwt", token, {
				SameSite: "Strict",
				httpOnly: true,
				maxAge: 24 * 60 * 60 * 1000,
			}) // maxage is 24 hours
		}
		res.cookie(".ROBLOSECURITY", token, {
			SameSite: "Strict",
			httpOnly: true,
			maxAge: 24 * 60 * 60 * 1000,
		})
		res.cookie(".RBXID", token, {
			SameSite: "Strict",
			httpOnly: true,
			maxAge: 24 * 60 * 60 * 1000,
		})
		if (req.url === "/v2/twostepverification/verify") {
			return res.json({})
		}
		if (req.headers?.["user-agent"] === "RobloxStudio/WinInet") {
			// studio response
			return res.json({
				user: {
					id: user.userid,
					name: user.username,
				},
				isBanned: false,
			})
		}
		return res.json({ status: "ok", cookie: token })
	}
	if (req.headers?.["user-agent"] === "RobloxStudio/WinInet") {
		// studio response
		return res.json({
			errors: [
				{
					code: 1,
					message: "Incorrect password",
				},
			],
		})
	}

	res.status(403).json({
		status: "error",
		error: "Invalid username/password",
	})
})

module.exports = router