author | Michael Krelin <hacker@klever.net> | 2013-11-25 18:57:57 (UTC) |
---|---|---|
committer | Michael Krelin <hacker@klever.net> | 2013-11-25 18:57:57 (UTC) |
commit | 706ed5b980c48ad807923d36741f19b21f2911a6 (patch) (unidiff) | |
tree | f749d44a744190eb626251dda7ee7e3d3d74ef40 | |
parent | 2c9aa9d30d3b833954b4fa584293e6e5a817f102 (diff) | |
download | clipperz-706ed5b980c48ad807923d36741f19b21f2911a6.zip clipperz-706ed5b980c48ad807923d36741f19b21f2911a6.tar.gz clipperz-706ed5b980c48ad807923d36741f19b21f2911a6.tar.bz2 |
typo fix
-rw-r--r-- | backend/node/src/clipperz.js | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/backend/node/src/clipperz.js b/backend/node/src/clipperz.js index 6bf56bb..c6d776a 100644 --- a/backend/node/src/clipperz.js +++ b/backend/node/src/clipperz.js | |||
@@ -64,193 +64,193 @@ var CLIPPERZ = module.exports = function(CONFIG) { | |||
64 | LOGGER.trace('SQL: rollback'); | 64 | LOGGER.trace('SQL: rollback'); |
65 | if(this.over) return cb(new Error('game over')); | 65 | if(this.over) return cb(new Error('game over')); |
66 | return (this.over=true),C.query('ROLLBACK',function(e){D();cb&&cb(e)}); | 66 | return (this.over=true),C.query('ROLLBACK',function(e){D();cb&&cb(e)}); |
67 | }, | 67 | }, |
68 | end: function(e,cb) { | 68 | end: function(e,cb) { |
69 | if(e) return LOGGER.trace(e,"rolling back transaction due to an error"),this.rollback(cb); | 69 | if(e) return LOGGER.trace(e,"rolling back transaction due to an error"),this.rollback(cb); |
70 | this.commit(cb); | 70 | this.commit(cb); |
71 | } | 71 | } |
72 | }); | 72 | }); |
73 | }); | 73 | }); |
74 | }); | 74 | }); |
75 | } | 75 | } |
76 | }; | 76 | }; |
77 | 77 | ||
78 | 78 | ||
79 | return { | 79 | return { |
80 | 80 | ||
81 | json: function clipperz_json(req,res,cb) { | 81 | json: function clipperz_json(req,res,cb) { |
82 | var method = req.body.method, pp = JSON.parse(req.body.parameters).parameters; | 82 | var method = req.body.method, pp = JSON.parse(req.body.parameters).parameters; |
83 | var message = pp.message; | 83 | var message = pp.message; |
84 | var ppp = pp.parameters; | 84 | var ppp = pp.parameters; |
85 | res.res = function(o) { return res.json({result:o}) }; | 85 | res.res = function(o) { return res.json({result:o}) }; |
86 | LOGGER.trace({method:method,parameters:pp},"JSON request"); | 86 | LOGGER.trace({method:method,parameters:pp},"JSON request"); |
87 | 87 | ||
88 | switch(method) { | 88 | switch(method) { |
89 | case 'registration': | 89 | case 'registration': |
90 | switch(message) { | 90 | switch(message) { |
91 | case 'completeRegistration': return PG.Q( | 91 | case 'completeRegistration': return PG.Q( |
92 | "INSERT INTO clipperz.theuser" | 92 | "INSERT INTO clipperz.theuser" |
93 | +" (u_name, u_srp_s,u_srp_v, u_authversion,u_header,u_statistics,u_version,u_lock)" | 93 | +" (u_name, u_srp_s,u_srp_v, u_authversion,u_header,u_statistics,u_version,u_lock)" |
94 | +" VALUES ($1, $2,$3, $4,$5,$6,$7,$8)", | 94 | +" VALUES ($1, $2,$3, $4,$5,$6,$7,$8)", |
95 | [pp.credentials.C, pp.credentials.s, pp.credentials.v, | 95 | [pp.credentials.C, pp.credentials.s, pp.credentials.v, |
96 | pp.credentials.version,pp.user.header, pp.user.statistics, | 96 | pp.credentials.version,pp.user.header, pp.user.statistics, |
97 | pp.user.version, pp.user.lock], function(e,r) { | 97 | pp.user.version, pp.user.lock], function(e,r) { |
98 | if(e) return cb(e); | 98 | if(e) return cb(e); |
99 | res.res({lock:pp.user.lock,result:'done'}); | 99 | res.res({lock:pp.user.lock,result:'done'}); |
100 | }); | 100 | }); |
101 | } | 101 | } |
102 | break; | 102 | break; |
103 | 103 | ||
104 | case 'handshake': | 104 | case 'handshake': |
105 | switch(message) { | 105 | switch(message) { |
106 | case 'connect': return ASYNC.auto({ | 106 | case 'connect': return ASYNC.auto({ |
107 | u: function(cb) { PG.Q( | 107 | u: function(cb) { PG.Q( |
108 | "SELECT u_id, u_srp_s, u_srp_v FROM clipperz.theuser WHERE u_name=$1", | 108 | "SELECT u_id, u_srp_s, u_srp_v FROM clipperz.theuser WHERE u_name=$1", |
109 | [ppp.C], function(e,r) { | 109 | [ppp.C], function(e,r) { |
110 | if(e) return cb(e); | 110 | if(e) return cb(e); |
111 | if(!r.rowCount) return cb(null,{u_id:null,u_srp_s:n123,u_srp_v:n123}); | 111 | if(!r.rowCount) return cb(null,{u_id:null,u_srp_s:n123,u_srp_v:n123}); |
112 | cb(null,r.rows[0]); | 112 | cb(null,r.rows[0]); |
113 | }) }, | 113 | }) }, |
114 | otp: ['u',function(cb,r) { | 114 | otp: ['u',function(cb,r) { |
115 | if(!req.session.otp) return cb(); | 115 | if(!req.session.otp) return cb(); |
116 | if(req.session.u!=r.u.u_id) return cb(new Error('user/OTP mismatch')); | 116 | if(req.session.u!=r.u.u_id) return cb(new Error('user/OTP mismatch')); |
117 | PG.Q( | 117 | PG.Q( |
118 | "UPDATE clipperz.theotp AS otp" | 118 | "UPDATE clipperz.theotp AS otp" |
119 | +" SET" | 119 | +" SET" |
120 | +" otps_id=CASE WHEN s.otps_code='REQUESTED' THEN (" | 120 | +" otps_id=CASE WHEN s.otps_code='REQUESTED' THEN (" |
121 | +" SELECT ss.otps_id FROM clipperz.otpstatus AS ss WHERE ss.otps_code='USED'" | 121 | +" SELECT ss.otps_id FROM clipperz.otpstatus AS ss WHERE ss.otps_code='USED'" |
122 | +" ) ELSE otp.otps_id END," | 122 | +" ) ELSE otp.otps_id END," |
123 | +" otp_utime=current_timestamp" | 123 | +" otp_utime=current_timestamp" |
124 | +" FROM clipperz.otpstatus AS s, clipperz.theotp AS o" | 124 | +" FROM clipperz.otpstatus AS s, clipperz.theotp AS o" |
125 | +" WHERE" | 125 | +" WHERE" |
126 | +" o.otp_id=otp.otp_id AND otp.otps_id=s.otps_id" | 126 | +" o.otp_id=otp.otp_id AND otp.otps_id=s.otps_id" |
127 | +" AND otp.otp_id=$1 AND otp.u_id=$2" | 127 | +" AND otp.otp_id=$1 AND otp.u_id=$2" |
128 | +" RETURNING o.otps_id!=otp.otps_id AS yes, o.otp_ref", | 128 | +" RETURNING o.otps_id!=otp.otps_id AS yes, o.otp_ref", |
129 | [ req.session.otp, req.session.u ], | 129 | [ req.session.otp, req.session.u ], |
130 | function(e,r) { | 130 | function(e,r) { |
131 | if(e) return cb(e); | 131 | if(e) return cb(e); |
132 | if(!r.rowCount) return cb(new Error('no OTP found')); | 132 | if(!r.rowCount) return cb(new Error('no OTP found')); |
133 | r=r.rows[0]; | 133 | r=r.rows[0]; |
134 | if(!r.yes) return cb(new Error('OTP is in a sorry state')); | 134 | if(!r.yes) return cb(new Error('OTP is in a sorry state')); |
135 | cb(null,{ref:r.otp_ref}); | 135 | cb(null,{ref:r.otp_ref}); |
136 | }); | 136 | }); |
137 | }] | 137 | }] |
138 | },function(e,r) { | 138 | },function(e,r) { |
139 | if(e) return cb(e); | 139 | if(e) return cb(e); |
140 | req.session.C = ppp.C; req.session.A = ppp.A; | 140 | req.session.C = ppp.C; req.session.A = ppp.A; |
141 | req.session.s = r.u.u_srp_s; req.session.v = r.u.u_srp_v; | 141 | req.session.s = r.u.u_srp_s; req.session.v = r.u.u_srp_v; |
142 | req.session.u = r.u.u_id; | 142 | req.session.u = r.u.u_id; |
143 | req.session.b = clipperz_random(); | 143 | req.session.b = clipperz_random(); |
144 | req.session.B = BIGNUM(req.session.v,16).add(srp_g.powm(BIGNUM(req.session.b,16),srp_n)).toString(16); | 144 | req.session.B = BIGNUM(req.session.v,16).add(srp_g.powm(BIGNUM(req.session.b,16),srp_n)).toString(16); |
145 | var rv = {s:req.session.s,B:req.session.B} | 145 | var rv = {s:req.session.s,B:req.session.B} |
146 | if(r.otp && r.otp.otp_ref) rv.oneTimePassword=r.otp.otp_ref; | 146 | if(r.otp && r.otp.otp_ref) rv.oneTimePassword=r.otp.otp_ref; |
147 | res.res(rv); | 147 | res.res(rv); |
148 | }); | 148 | }); |
149 | 149 | ||
150 | case 'credentialCheck': | 150 | case 'credentialCheck': |
151 | var u = clipperz_hash(BIGNUM(req.session.B,16).toString(10)); | 151 | var u = clipperz_hash(BIGNUM(req.session.B,16).toString(10)); |
152 | var A = BIGNUM(req.session.A,16); | 152 | var A = BIGNUM(req.session.A,16); |
153 | var S = A.mul(BIGNUM(req.session.v,16).powm(BIGNUM(u,16),srp_n)).powm( | 153 | var S = A.mul(BIGNUM(req.session.v,16).powm(BIGNUM(u,16),srp_n)).powm( |
154 | BIGNUM(req.session.b,16), srp_n); | 154 | BIGNUM(req.session.b,16), srp_n); |
155 | var K = clipperz_hash(S.toString(10)); | 155 | var K = clipperz_hash(S.toString(10)); |
156 | var M1 = clipperz_hash(A.toString(10)+BIGNUM(req.session.B,16).toString(10)+K.toString(16)); | 156 | var M1 = clipperz_hash(A.toString(10)+BIGNUM(req.session.B,16).toString(10)+K.toString(16)); |
157 | if(M1!=ppp.M1) return res.res({error:'?'}); | 157 | if(M1!=ppp.M1) return res.res({error:'?'}); |
158 | req.session.K = K; | 158 | req.session.K = K; |
159 | var M2 = clipperz_hash(A.toString(10)+M1+K.toString(16)); | 159 | var M2 = clipperz_hash(A.toString(10)+M1+K.toString(16)); |
160 | return res.res({M2:M2,connectionId:'',loginInfo:{latest:{},current:{}},offlineCopyNeededd:false,lock:'----'}); | 160 | return res.res({M2:M2,connectionId:'',loginInfo:{latest:{},current:{}},offlineCopyNeeded:false,lock:'----'}); |
161 | 161 | ||
162 | case 'oneTimePassword': return PG.Q( | 162 | case 'oneTimePassword': return PG.Q( |
163 | "UPDATE clipperz.theotp AS otp" | 163 | "UPDATE clipperz.theotp AS otp" |
164 | +" SET" | 164 | +" SET" |
165 | +" otps_id = CASE WHEN s.otps_code!='ACTIVE' THEN s.otps_id ELSE (" | 165 | +" otps_id = CASE WHEN s.otps_code!='ACTIVE' THEN s.otps_id ELSE (" |
166 | +" SELECT ss.otps_id FROM clipperz.otpstatus AS ss WHERE ss.otps_code=CASE" | 166 | +" SELECT ss.otps_id FROM clipperz.otpstatus AS ss WHERE ss.otps_code=CASE" |
167 | +" WHEN otp.otp_key_checksum=$2 THEN 'REQUESTED'" | 167 | +" WHEN otp.otp_key_checksum=$2 THEN 'REQUESTED'" |
168 | +" ELSE 'DISABLED' END" | 168 | +" ELSE 'DISABLED' END" |
169 | +" ) END," | 169 | +" ) END," |
170 | +" otp_data = CASE WHEN s.otps_code='ACTIVE' THEN '' ELSE otp.otp_data END," | 170 | +" otp_data = CASE WHEN s.otps_code='ACTIVE' THEN '' ELSE otp.otp_data END," |
171 | +" otp_utime = current_timestamp," | 171 | +" otp_utime = current_timestamp," |
172 | +" otp_rtime = CASE WHEN otp.otp_key_checksum=$2 THEN current_timestamp ELSE otp.otp_rtime END" | 172 | +" otp_rtime = CASE WHEN otp.otp_key_checksum=$2 THEN current_timestamp ELSE otp.otp_rtime END" |
173 | +" FROM clipperz.otpstatus AS s, clipperz.theotp AS o" | 173 | +" FROM clipperz.otpstatus AS s, clipperz.theotp AS o" |
174 | +" WHERE" | 174 | +" WHERE" |
175 | +" o.otp_id=otp.otp_id AND otp.otps_id=s.otps_id AND otp.otp_key=$1" | 175 | +" o.otp_id=otp.otp_id AND otp.otps_id=s.otps_id AND otp.otp_key=$1" |
176 | +" RETURNING otp.u_id, s.otps_code, otp.otp_id, otp.otp_key_checksum, o.otp_data, otp.otp_version", | 176 | +" RETURNING otp.u_id, s.otps_code, otp.otp_id, otp.otp_key_checksum, o.otp_data, otp.otp_version", |
177 | [ ppp.oneTimePasswordKey, ppp.oneTimePasswordKeyChecksum ], | 177 | [ ppp.oneTimePasswordKey, ppp.oneTimePasswordKeyChecksum ], |
178 | function(e,r) { | 178 | function(e,r) { |
179 | if(e) return cb(e); | 179 | if(e) return cb(e); |
180 | if(!r.rowCount) return cb(new Error('OTP not found')); | 180 | if(!r.rowCount) return cb(new Error('OTP not found')); |
181 | r=r.rows[0]; | 181 | r=r.rows[0]; |
182 | if(r.otp_key_checksum!=ppp.oneTimePasswordKeyChecksum) | 182 | if(r.otp_key_checksum!=ppp.oneTimePasswordKeyChecksum) |
183 | return cb(new Error('OTP was disabled because of checksum mismatch')); | 183 | return cb(new Error('OTP was disabled because of checksum mismatch')); |
184 | if(r.otps_code!='ACTIVE') | 184 | if(r.otps_code!='ACTIVE') |
185 | return cb(new Error("OTP wasn't active, sorry")); | 185 | return cb(new Error("OTP wasn't active, sorry")); |
186 | req.session.u=r.u_id; req.session.otp=r.otp_id; | 186 | req.session.u=r.u_id; req.session.otp=r.otp_id; |
187 | res.res({data:r.otp_data,version:r.otp_version}); | 187 | res.res({data:r.otp_data,version:r.otp_version}); |
188 | }); | 188 | }); |
189 | } | 189 | } |
190 | break; | 190 | break; |
191 | 191 | ||
192 | case 'message': | 192 | case 'message': |
193 | if(!req.session.K) return res.res({result:'EXCEPTION',message:"effectively, we're missing a aconnection"}); | 193 | if(!req.session.K) return res.res({result:'EXCEPTION',message:"effectively, we're missing a aconnection"}); |
194 | if(req.session.K!=pp.srpSharedSecret) return res.res({error:'Wrong shared secret!'}); | 194 | if(req.session.K!=pp.srpSharedSecret) return res.res({error:'Wrong shared secret!'}); |
195 | switch(message) { | 195 | switch(message) { |
196 | case 'getUserDetails': return ASYNC.parallel({ | 196 | case 'getUserDetails': return ASYNC.parallel({ |
197 | u: function(cb) { | 197 | u: function(cb) { |
198 | PG.Q("SELECT u_header,u_statistics,u_version FROM clipperz.theuser WHERE u_id=$1", | 198 | PG.Q("SELECT u_header,u_statistics,u_version FROM clipperz.theuser WHERE u_id=$1", |
199 | [req.session.u],function(e,r) { | 199 | [req.session.u],function(e,r) { |
200 | if(e) return cb(e); | 200 | if(e) return cb(e); |
201 | if(!r.rowCount) return cb(new Error("user's gone AWOL")); | 201 | if(!r.rowCount) return cb(new Error("user's gone AWOL")); |
202 | cb(null,r.rows[0]); | 202 | cb(null,r.rows[0]); |
203 | }); | 203 | }); |
204 | }, | 204 | }, |
205 | stats: function(cb) { | 205 | stats: function(cb) { |
206 | PG.Q("SELECT r_ref,r_mtime FROM clipperz.therecord WHERE u_id=$1", | 206 | PG.Q("SELECT r_ref,r_mtime FROM clipperz.therecord WHERE u_id=$1", |
207 | [req.session.u],function(e,r) { | 207 | [req.session.u],function(e,r) { |
208 | if(e) return cb(e); | 208 | if(e) return cb(e); |
209 | cb(null,r.rows.reduce(function(p,r){p[r.r_ref]={updateDate:r.r_mtime};return p},{})); | 209 | cb(null,r.rows.reduce(function(p,r){p[r.r_ref]={updateDate:r.r_mtime};return p},{})); |
210 | }); | 210 | }); |
211 | } | 211 | } |
212 | },function(e,r) { | 212 | },function(e,r) { |
213 | if(e) return cb(e); | 213 | if(e) return cb(e); |
214 | res.res({header:JSON.stringify(r.u.u_header),statistics:r.u.u_statistics,version:r.u.u_version,recordsStats:r.stats}); | 214 | res.res({header:JSON.stringify(r.u.u_header),statistics:r.u.u_statistics,version:r.u.u_version,recordsStats:r.stats}); |
215 | }); | 215 | }); |
216 | 216 | ||
217 | case 'saveChanges': return PG.T(function(e,T) { | 217 | case 'saveChanges': return PG.T(function(e,T) { |
218 | if(e) return cb(e); | 218 | if(e) return cb(e); |
219 | ASYNC.auto({ | 219 | ASYNC.auto({ |
220 | user: function(cb) { | 220 | user: function(cb) { |
221 | T.Q( | 221 | T.Q( |
222 | "UPDATE clipperz.theuser" | 222 | "UPDATE clipperz.theuser" |
223 | +" SET u_header=$1, u_statistics=$2, u_version=$3, u_lock=COALESCE($4,u_lock)" | 223 | +" SET u_header=$1, u_statistics=$2, u_version=$3, u_lock=COALESCE($4,u_lock)" |
224 | +" WHERE u_id=$5" | 224 | +" WHERE u_id=$5" |
225 | +" RETURNING u_lock",[ppp.user.header,ppp.user.statistics,ppp.user.version,ppp.user.lock||null,req.session.u], | 225 | +" RETURNING u_lock",[ppp.user.header,ppp.user.statistics,ppp.user.version,ppp.user.lock||null,req.session.u], |
226 | function(e,r) { | 226 | function(e,r) { |
227 | if(e) return cb(e); | 227 | if(e) return cb(e); |
228 | if(!r.rowCount) return cb(new Error("user's gone AWOL")); | 228 | if(!r.rowCount) return cb(new Error("user's gone AWOL")); |
229 | cb(null,r.rows[0]); | 229 | cb(null,r.rows[0]); |
230 | }); | 230 | }); |
231 | }, | 231 | }, |
232 | updaterecords: function(cb) { | 232 | updaterecords: function(cb) { |
233 | if(!(ppp.records && ppp.records.updated && ppp.records.updated.length)) return cb(); | 233 | if(!(ppp.records && ppp.records.updated && ppp.records.updated.length)) return cb(); |
234 | ASYNC.each(ppp.records.updated,function(r,cb) { | 234 | ASYNC.each(ppp.records.updated,function(r,cb) { |
235 | ASYNC.auto({ | 235 | ASYNC.auto({ |
236 | updater: function(cb) { | 236 | updater: function(cb) { |
237 | T.Q( | 237 | T.Q( |
238 | "UPDATE clipperz.therecord" | 238 | "UPDATE clipperz.therecord" |
239 | +" SET r_data=$2, r_version=$3, r_mtime=current_timestamp" | 239 | +" SET r_data=$2, r_version=$3, r_mtime=current_timestamp" |
240 | +" WHERE r_ref=$1 AND u_id=$4 RETURNING r_id", | 240 | +" WHERE r_ref=$1 AND u_id=$4 RETURNING r_id", |
241 | [r.record.reference,r.record.data,r.record.version,req.session.u], function(e,r) { | 241 | [r.record.reference,r.record.data,r.record.version,req.session.u], function(e,r) { |
242 | if(e) return cb(e); | 242 | if(e) return cb(e); |
243 | return cb(null,r.rows.length?r.rows[0]:null); | 243 | return cb(null,r.rows.length?r.rows[0]:null); |
244 | }); | 244 | }); |
245 | }, | 245 | }, |
246 | insertr: ['updater',function(cb,rr) { | 246 | insertr: ['updater',function(cb,rr) { |
247 | if(rr.updater) return cb(); | 247 | if(rr.updater) return cb(); |
248 | T.Q( | 248 | T.Q( |
249 | "INSERT INTO clipperz.therecord" | 249 | "INSERT INTO clipperz.therecord" |
250 | +" (u_id,r_ref,r_data,r_version)" | 250 | +" (u_id,r_ref,r_data,r_version)" |
251 | +" VALUES ($1,$2,$3,$4) RETURNING r_id",[req.session.u,r.record.reference,r.record.data,r.record.version], | 251 | +" VALUES ($1,$2,$3,$4) RETURNING r_id",[req.session.u,r.record.reference,r.record.data,r.record.version], |
252 | function(e,r) { | 252 | function(e,r) { |
253 | if(e) return cb(e); | 253 | if(e) return cb(e); |
254 | return cb(null,r.rows[0]); | 254 | return cb(null,r.rows[0]); |
255 | }); | 255 | }); |
256 | }], | 256 | }], |