ban and auth db connection

Author: Swaggeroo

middleware/auth.js

@@ -1,6 +1,8 @@
 const jwt = require('jsonwebtoken');
 const fs = require("fs");
 const authDebug = require('debug')('app:auth');
+//Services
+const dbAdapter = require('../services/dbAdapter');
 
 module.exports = async function (req, res, next) {
     const token = req.header('x-auth-token');
@@ -17,24 +19,23 @@ module.exports = async function (req, res, next) {
             authDebug("400 - Token expired");
             return res.status(400).send('Token expired.');
         }
+        req.user.sub = 1;
+        let user = await dbAdapter.getUserById(req.user.sub);
 
+        if(user.banned) {
+            authDebug("403 - User banned");
+            return res.status(403).send('User banned.');
+        }
 
-        //TODO get User
-
-        //if(user.banned){
-        //    authDebug("403 - User banned");
-        //    return res.status(403).send('User banned.');
-        //}
-
-        //if (user.lastSecurityUpdate && req.user.iat*1000 < new Date(user.lastSecurityUpdate.valueOf())-5000) {
-        //    authDebug("400 - Token expired");
-        //    return res.status(400).send('Token expired.');
-        //}
+        if (user.last_security_change && req.user.iat*1000 < new Date(user.last_security_change.valueOf())-5000) {
+            authDebug("400 - Token expired");
+            return res.status(400).send('Token expired.');
+        }
 
-        //if(user.otp_enabled && user.otp_verified && !req.user.otp && !(req.originalUrl === "/api/otp/verify")){
-        //    authDebug("403 - OTP required");
-        //    return res.status(403).send('OTP required.');
-        //}
+        if(user.totp_secret !== undefined && user.totp_confirmed && !req.user.otp && !(req.originalUrl === "/api/otp/verify")){
+            authDebug("403 - OTP required");
+            return res.status(403).send('OTP required.');
+        }
 
         next();
     } catch (ex) {

routes/ban.js

@@ -2,6 +2,8 @@ const express = require('express');
 const router = express.Router();
 const debugRoute = require('debug')('app:route');
 const _ = require('lodash');
+//Services
+const dbAdapter = require('../services/dbAdapter');
 //Middleware
 const auth = require('../middleware/auth');
 const admin = require('../middleware/admin');
@@ -13,16 +15,16 @@ router.post('/:id', [auth,admin], async (req, res) => {
         return res.status(400).send("You can't ban yourself");
     }
 
-    //TODO GET USER
-    let user = {};
+    let user = await dbAdapter.getUserById(req.params.id);
+
     if (!user) {
         debugRoute("POST /api/ban - 404 - User not found");
         return res.status(404).send('User not found.');
     }
 
     user.banned = true;
 
-    //TODO push to database
+    await dbAdapter.updateUser(user);
 
     debugRoute("POST /api/ban - 200 - User banned");