yoanm / alfred-personal-assistant

server/privacy.js

var express = require('express');

var extend  = require('extend');

var request = require('request');


// ------------------------------------------

//  CONSTRUCTOR

// ------------------------------------------


var init = function(){

  info('Starting PrivacyManager ...');

  salt();

  

  return PrivacyManager;

}


// ------------------------------------------

//  USERS

// ------------------------------------------


var findByUsername = function (username, fn) {

  setTimeout(function(){ // slow bruteforce

    

    var user = Config.auth['local-users'][username]

The variable Config seems to be never declared. If this is a global, consider adding a /** global: Config */ comment.

    if (user){ return fn(null, user); }

    return fn(null, null);

    

  }, 1000);

}


// ------------------------------------------

//  PASSPORT

// ------------------------------------------


var passport = require('passport');


passport.serializeUser  (function(user, done) { /*info('serializeUser',   user);*/ done(null, user); });

passport.deserializeUser(function(obj, done)  { /*info('deserializeUser', obj);*/  done(null, obj);  });


// ------------------------------------------

//  LOCAL STRATEGY

// ------------------------------------------


var setLocalStrategy = function(passport, router){

  router.get('/login', function(req, res, next) {

The parameter next is not used and could be removed.

    res.render('portal/login.ejs', { 'redirect' : req.query.redirect });

  });

  

  router.post('/login', 

    passport.authenticate('local', { failureRedirect: '/login', failureFlash: false }), function(req, res) { 

      if (req.body.redirect){

        res.redirect(req.body.redirect);

      } else {

        res.redirect('/');

      } 

    }

  );

  

  var LocalStrategy = require('passport-local').Strategy;

  passport.use(new LocalStrategy(local));

}


var local = function(username, password, done) {

  process.nextTick(function () {

    findByUsername(username, function(err, user) {

      

      if (err) { return done(err); }

      if (!user) { return done(null, false, { message: 'Unknown user ' + username }); }

      

      var passHash = hash(password);

      if (user.password != passHash) { 

        info('Invalid password');

        return done(null, false, { message: 'Invalid password' }); 

      }

      

      return done(null, user);

    });

  });

}


// ------------------------------------------

//  ROUTER

// ------------------------------------------


var Router = express.Router();

Router.use(passport.initialize());

Router.use(passport.session());


Router.get('/logout', function(req, res){

  req.logout();

  res.redirect('/');

});


// Set local strategy

setLocalStrategy(passport, Router);


// Set google strategy

// setGoogleStrategy(passport, Router);


// Security

Router.all('*', function(req, res, next) {

  

  // Security Hole: ByPass for client

  if ( req.path.startsWith('/sarah') 

    || req.path.startsWith('/askme')

    || req.path.startsWith('/standby')){

    return next();

  }

  

  // Set user authentication 

  if (Config.auth && Config.auth['local-users']){

The variable Config seems to be never declared. If this is a global, consider adding a /** global: Config */ comment.

  if (!req.isAuthenticated()){ 

    

    var redirectURL = encodeURIComponent(req.url);

    return res.redirect('/login?redirect='+redirectURL); }  

  } else { req.user = { displayName : '' }}

  

  next();

There is no return statement in this branch, but you do return something in other branches. Did you maybe miss it? If you do not want to return anything, consider adding return undefined; explicitly.

});


Router.get('/profile', function(req, res){

  res.render('portal/profile.ejs', { "user" : req.user });

});


Router.post('/profile', function(req, res){

  

  var username    = req.body.username;

The assignment to variable username seems to be never used. Consider removing it.

  var password    = req.body.password;

  var newPassword = req.body.newpassword;

  var displayName = req.body.displayname;

  

  // Retrieve user

  var user = Config.auth['local-users'][req.user.login];

The variable Config seems to be never declared. If this is a global, consider adding a /** global: Config */ comment.

  

  // Check Old password

  var oldHash = hash(password);

  if (user.password !== oldHash){

    res.redirect('/');

    return;

  }

  

  // Update new password

  var newHash = hash(newPassword);

  user.password = newHash;

  user.displayName = displayName;

  SARAH.ConfigManager.save();

The variable SARAH seems to be never declared. If this is a global, consider adding a /** global: SARAH */ comment.

  

  res.redirect('/');

});


Router.get('/profile/delete', function(req, res){

The parameter res is not used and could be removed.

  delete Config.auth['local-users'][req.query.id]

The variable Config seems to be never declared. If this is a global, consider adding a /** global: Config */ comment.

  SARAH.ConfigManager.save();

The variable SARAH seems to be never declared. If this is a global, consider adding a /** global: SARAH */ comment.

});


Router.all('/profile/create', function(req, res){

  var msg = undefined;

The assignment of undefined is not necessary as msg is implicitly marked as undefined by the declaration.

  var op  = req.body.op;

  

  if (op){

    if (req.body.login && req.body.password && req.body.displayname){

      Config.auth['local-users'][req.body.login] = {

The variable Config seems to be never declared. If this is a global, consider adding a /** global: Config */ comment.

        login       : req.body.login,

        password    : hash(req.body.password),

        displayName : req.body.displayname,

      }

      SARAH.ConfigManager.save();

The variable SARAH seems to be never declared. If this is a global, consider adding a /** global: SARAH */ comment.

    } else { msg = i18n('portal.error.missing'); }

  }

  

  res.render('portal/modal-profile.ejs', { 'message': msg, 'op': op });

});


// ------------------------------------------

//  CRYPTO

// ------------------------------------------


var bcrypt = require('bcryptjs');


var ITERATION = 10000;

var hash   = function(password){

  var salt = Config.auth['local-salt'];

The variable Config seems to be never declared. If this is a global, consider adding a /** global: Config */ comment.

  //    salt = new Buffer(salt, 'hex');

  //var key  = Crypto.pbkdf2Sync(password, salt, ITERATION, 64);

  //var hash = 'pbkdf2$' + ITERATION + '$' + key.toString('hex') + '$' + salt.toString('hex');

  var hash = bcrypt.hashSync(password, salt);

  return hash;

}


var salt = function(){

  if (Config.auth['local-salt'] != false) return;

Curly braces around statements make for more readable code and help prevent bugs when you add further statements.

The variable Config seems to be never declared. If this is a global, consider adding a /** global: Config */ comment.

  

  // var salt = ('salt' + (Math.random()*10000)).replace('.','0');

  var salt = bcrypt.genSaltSync(10);

  var sarahId = 'uid-' + (new Date()).getTime();

  registerSARAH(sarahId);

  

  Config.auth['local-uid']  = sarahId

  Config.auth['local-salt'] = salt

  Config.auth['local-users']          = Config.auth['local-users']          || {};

  Config.auth['local-users']['admin'] = Config.auth['local-users']['admin'] || {};

  

  var admin = Config.auth['local-users']['admin'];

  admin.login       = 'admin';

  admin.password    = hash('password');

  admin.displayName = 'Admin';

  SARAH.ConfigManager.save();

The variable SARAH seems to be never declared. If this is a global, consider adding a /** global: SARAH */ comment.

}


var AMZID = '5eVBwYTHp21nzkXrcCC6e4UM93Pr2QMX5cLeD50S';

var registerSARAH = function(id){

 var url = 'http://tracker.sarah.encausse.net';

  request({ 

    'uri' : url+'?trackerId='+id, 

    'json' : true, 

    'headers': {'x-api-key': AMZID } 

  },

  function (err, response, json){

The parameter json is not used and could be removed.

    if (err || response.statusCode != 200) { 

There is no return statement if err || response.statusCode != 200 is false. Are you sure this is correct? If so, consider adding return; explicitly.

      return warn("Can't register SARAH into the Cloud", err, response);   

    }

  });

}



// ------------------------------------------

//  PUBLIC

// ------------------------------------------


var PrivacyManager = {

  'init' : init,

  'Router' : Router

}


// Exports Manager

exports.init = PrivacyManager.init;