README.md

@@ -10,9 +10,8 @@ My own homepage, bocken.org (new.bocken.org for now), built with svelte-kit.
 - [] logout without /logout page
 - [] no DB request for every Layout change if session already got the username once
 - [] preferences page
-- [x] change password
+- [] change password
 - [] fail2ban integration
-- [ ] dark mode 
 
 ### Rezepte
 - [] nutrition facts
@@ -49,6 +48,3 @@ My own homepage, bocken.org (new.bocken.org for now), built with svelte-kit.
 - [] setup dendrite
 - [] OAuth? -> Everything OAuth or OpenID?
 - [] Serve some web-frontend -> Just element?
-
-### Gitea
-- [ ] consistent theming

src/lib/components/UserHeader.svelte

@@ -130,7 +130,7 @@ h2{
 	<div id=options class="speech top" hidden>
 			<h2>{username}</h2>
 			<ul>
-				<li><a href="/settings" >Einstellungen</a></li>
+				<!--<li><a href="/settings">Einstellungen</a></li>-->
 				<li><a href="/logout" >Log Out</a></li>
 			</ul>
 		</div>

src/routes/(main)/register/+page.svelte

@@ -3,7 +3,7 @@ import "$lib/css/form.css"
 </script>
 
 <form action="?/register" method=POST>
-	<h1>Registrieren</h1>
+	<h1>Regrieren</h1>
 	<label>
 		Username
 		<input type="text" name="username" required>

src/routes/(main)/settings/+page.server.ts

@@ -10,26 +10,36 @@ export const load: PageServerLoad = async ({ locals }) => {
 
 export const actions: Actions = {
 	change_password: async (event) => {
-    console.log("Changin password")
+		const data = await event.fetch.request.formData()
+
+	},
+	login: async (event) => {
 		const data = await event.request.formData()
- 		const res = await event.fetch('/api/user/change_pw',
+ 		const res = await event.fetch('/api/user/login',
 	    		{method: 'POST',
 			body: JSON.stringify({
 				username: data.get('username'),
-				new_password: data.get('new_password'),
+				password: data.get('password'),
-				new_password_rep: data.get('new_password_rep'),
-				old_password: data.get('old_password'),
-			}),
-      headers: {
-        credentials: 'include',
-      }
 			})
+			}
+			)
+	    	const jwt = await res.json()
 		if(res.ok){
-      console.log("OK response")
+		event.cookies.set("UserSession", jwt, {
+			path: "/",
+			httpOnly: true,
+			sameSite: "strict",
+			secure: process.env.NODE_ENV === "production",
+			maxAge: 60 * 60 * 24 * 7, // 1 week
+		})
+
+		throw redirect(303, "/")
 		}
 		else{
-      const item = await res.json()
+			throw error(401, jwt.message)
-      throw error(401, item.message) 
-    }
 		}
+	},
+	logout: async () => {
+		throw redirect(303, "/logout")
+	},
 }

src/routes/(main)/settings/+page.svelte

@@ -1,56 +1,33 @@
 <script>
-  import {enhance} from '$app/forms';
 	export let data
-  let password;
 	const admin = data.user?.access.includes('admin') ?? false
-  import "$lib/css/form.css"
 </script>
 <style>
-input:invalid + div{
-  display: none;
-}
-input:valid + div{
-  position: absolute;
-  color: green;
-  bottom: 0.25rem;
-  right: -0.25rem;
-  font-size: 1.5rem;
-  width: 1em;
-  height: 1em;
-}
 form label,
 form label input
 {
-  position: relative;
 	display: block;
 }
-input.hide{
-  display:none;
-}
 </style>
 <section>
 	<h2>Change Profile pictures</h2>
 </section>
 
 <section>
-  <form action="?/change_password" method=POST use:enhance>
+	<h2>Change password</h2>
-	<h2>Passwort ändern</h2>
+	<form>
-    <input type="text" bind:value={data.user.username} class=hide name="username" required> 
 		<label>
 		Altes Passwort:
-			<input type="password" name="old_password" required>
+			<input type="password" >
 		</label>
 		<label>
 		Neues Passwort:
-			<input type="password" name="new_password" required bind:value={password} minlength=10>
+			<input type="password" >
-      <div>✔️</div>
 		</label>
 		<label>
 		Neues Passwort wiederholen:
-			<input type="password" name="new_password_rep" required pattern={password}>
+			<input type="password" >
-      <div>✔️</div>
 		</label>
-    <button type="submit">Ändern</button>
 	</form>
 </section>
 

src/routes/api/user/change_pw/+server.ts

@@ -1,8 +1,6 @@
 import type { RequestHandler } from '@sveltejs/kit';
 import { error } from '@sveltejs/kit';
-import { verify }  from 'argon2';
+import { hash }  from 'argon2';
-import { hashPassword } from '$lib/js/hashPassword'
-import {randomBytes} from 'crypto'
 
 import { PEPPER } from '$env/static/private';
 
@@ -12,25 +10,31 @@ import { dbConnect, dbDisconnect } from '../../../../utils/db';
 // header: use for bearer token for now
 // recipe json in body
 export const POST: RequestHandler = async ({request}) => {
-	const {username, old_password, new_password, new_password_rep} = await request.json()
+	const {username, old_password, new_password} = await request.json()
-  if(new_password != new_password_rep){
-    throw error(400, 'new passwords do not match!')
-  }
 	await dbConnect();
-	const user = await User.findOne({username: username});
+	const salt = await User.findOne({username: username}, 'salt');
-  console.log("Found user:", user)
+	const pass_hash =  await hashPassword(old_password + PEPPER, salt)
-  const isMatch = await verify(user.pass_hash, old_password + PEPPER, {salt: user.salt})
+	try{
-  console.log("isMatch:", isMatch)
+		await User.updateOne({
-  if(isMatch){
+				username: username,
-		const salt = randomBytes(32).toString('hex'); // Generate a random salt
+				pass_hash: pass_hash,
-    const pass_hash = await hashPassword(new_password + PEPPER, salt)
+		})
-    await User.findOneAndUpdate({username: username}, {pass_hash: pass_hash, salt: salt})
+	}catch(e){
-    await dbDisconnect()
-	  return new Response(JSON.stringify({message: "Password updated successfully"}),
-                        {status: 200})
-  }
-  else{
 		await dbDisconnect();
-    throw error(401, "Wrong old password")
+		throw error(400, e);
+	}
+	await dbDisconnect();
+	return new Response(JSON.stringify({message: "User added successfully"}),
+			    	{status: 200}
+		);
 	}
 };
+
+async function hashPassword(password, salt) {
+  try {
+    const hashedPassword = await hash(password, salt); // Hash the password with the salt and pepper
+    return hashedPassword;
+  } catch (error) {
+    console.error('Error hashing password:', error);
+  }
+}