1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
|
const express = require("express");
const mysql = require("mysql");
const bodyParser = require("body-parser");
const https = require("https");
const config = require("./config.json");
const api = express();
const checkCaptcha = (req, res, next) => {
const token = String(req.get("X-CAPTCHA-TOKEN"));
if (!token.match(/^[a-zA-Z0-9-_]{8,}$/)) {
res.status(403).json({
status: "error",
error: "no token sent"
});
console.info("a request with an empty token was received");
return;
}
https.get(`https://www.google.com/recaptcha/api/siteverify?secret=${config.recaptcha.secret}&response=${token}`, (re) => {
re.setEncoding("utf8");
re.on("data", response => {
const data = JSON.parse(response);
if (!data.success) {
console.error(`recaptcha returned an error: ${JSON.stringify(data)}`);
res.status(403).json({
status: "error",
error: "captcha validation failed"
});
console.info("a request failed to validate");
return;
}
next(); // challenge passed, so process the request
});
}).on("error", error => {
console.error(error);
res.status(403).json({
status: "error",
error: "recaptcha couldn't be reached"
});
console.warn("reCaptcha couldn't be reached");
return;
})
};
api.use(checkCaptcha);
api.use(bodyParser.json());
api.post("/api/account", (req, res) => {
if (!req.body || !Reflect.has(req.body, "username") ||
!Reflect.has(req.body, "password") || !Reflect.has(req.body, "email") ||
!req.body.username.match(/^[a-zA-Z0-9]{4,23}$/) ||
!req.body.password.match(/^[a-zA-Z0-9]{4,23}$/) ||
!req.body.email.match(/^|(?:[a-zA-Z0-9.$&+=_~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*)$/) ||
req.body.email.length >= 40)
{
res.status(400).json({
status: "error",
error: "malformed request"
});
console.info("a malformed request was received");
return;
}
const account = {
username: req.body.username,
password: req.body.password,
email: req.body.email || "a@a.com"
};
const db = mysql.createConnection({
host : config.sql.host,
user : config.sql.user,
password : config.sql.password,
database : config.sql.database
});
db.connect(err => {
if (err) {
res.status(500).json({
status: "error",
error: "couldn't reach the database"
});
console.warn("a connection with the database couldn't be established");
return;
}
db.query({sql: `INSERT INTO ${config.sql.table} (USERNAME, PASSWORD, EMAIL, GENDER) VALUES ("${account.username}", "${account.password}", "${account.email}", "N")`}, (err, rows, fields) => {
if (err) {
if (err.code == "ER_DUP_ENTRY") {
res.status(409).json({
status: "error",
error: "already exists"
});
console.info("a request to create an already-existent account was received");
} else {
res.status(500).json({
status: "error",
error: "couldn't add the user"
});
console.error("an unexpected sql error occured", err);
}
} else {
res.status(201).json({
status: "success"
});
console.info(`an account was created: ${account.username}`);
}
db.end();
});
});
});
api.use((req, res, next) => {
res.status(404).json({
status: "error",
error: "unknown endpoint"
});
console.info("a request for an unknown endpoint was received");
});
api.set("trust proxy", "loopback"); // only allow localhost to communicate with the API
api.listen(config.port, () => console.info(`Listening on port ${config.port}`));
|
