node-programmeren4-studentenhuis-master/controllers/authentication.controller.js
/**
     * Log a user in by validating the email and password in the request.
     * Email is supposed to be more unique than a username, so we use that for identification.
     * When the email/password combination is valid a token is returned to the client. 
     * The token provides access to the protected endpoints in subsequent requests, as long 
     * as it is valid and not expired.
     * 
     * Security issue: the password is probably typed-in by the client and sent as 
     * plain text. Anyone listening on the network could read the password. The 
     * connection should therefore be secured and encrypted. Another option is to
     * encrypt the password on the client side and send it encrypted.
     * 
     * @param {*} req The incoming request, should contain valid JWT token in headers.
     * @param {*} res The token, additional user information, and status 200 when valid.
     * @param {*} next ApiError when token is invalid.
     */
Log a user in by validating the email and password in the request.
Email is supposed to be more unique than a username, so we use that for identification.
When the email/password combination is valid a token is returned to the client.
The token provides access to the protected endpoints in subsequent requests, as long
as it is valid and not expired.

Security issue: the password is probably typed-in by the client and sent as
plain text. Anyone listening on the network could read the password. The
connection should therefore be secured and encrypted. Another option is to
encrypt the password on the client side and send it encrypted.

@param {*} req The incoming request, should contain valid JWT token in headers.
@param {*} res The token, additional user information, and status 200 when valid.
@param {*} next ApiError when token is invalid.
Log a user in by validating the email and password in the request . Email is supposed to be more unique than a username so we use that for identification . When the email / password combination is valid a token is returned to the client . The token provides access to the protected endpoints in subsequent requests as long as it is valid and not expired . Security issue : the password is probably typed - in by the client and sent as plain text . Anyone listening on the network could read the password . The connection should therefore be secured and encrypted . Another option is to encrypt the password on the client side and send it encrypted . @param { * } req The incoming request should contain valid JWT token in headers . @param { * } res The token additional user information and status 200 when valid . @param { * } next ApiError when token is invalid .
login(req, res, next) {
        try {
            assert(typeof (req.body.email) === 'string', 'email must be a string.')
            assert(typeof (req.body.password) === 'string', 'password must be a string.')
        } catch (ex) {
            const error = new ApiError(ex.toString(), 422)
            next(error)
            return
        }
        pool.getConnection((err, connection) => {
            if(err) {
                logger.error('Error getting connection from pool: ' + err.toString())
                const error = new ApiError(err, 500)
                next(error);
                return
            }
            connection.query('SELECT `ID`, `Voornaam`, `Achternaam`, `Email`, `Password` FROM `user` WHERE `Email` = ?', [req.body.email], (err, rows, fields) => {
                connection.release()
                if (err) {
                    const error = new ApiError(err, 500)
                    next(error);
                } else {
                    if (rows && rows.length === 1 && rows[0].Email !== undefined) {
                        bcrypt.compare(req.body.password, rows[0].Password, (err, success) => {
                            if (success) {
                                logger.info('passwords DID match, sending valid token')
                                const payload = {
                                    user: rows[0].Email,
                                    id: rows[0].ID
                                }
                                const userinfo = {
                                    token: auth.encodeToken(payload),
                                    username: rows[0].Voornaam + ' ' + rows[0].Achternaam,
                                    email: rows[0].Email,
                                }
                                res.status(200).json(userinfo).end()
                            } else {
                                next(new ApiError('Password did not match.', 401))
                            }
                        })
                    } else {
                        next(new ApiError('Email does not exist.', 401))
                    }
                }
            })
        })
    }
login ( req , res , next ) { try { assert ( typeof ( req . body . email ) === 'string' , 'email must be a string.' ) assert ( typeof ( req . body . password ) === 'string' , 'password must be a string.' ) } catch ( ex ) { const error = new ApiError ( ex . toString ( ) , 422 ) next ( error ) return } pool . getConnection ( ( err , connection ) => { if ( err ) { logger . error ( 'Error getting connection from pool: ' + err . toString ( ) ) const error = new ApiError ( err , 500 ) next ( error ) ; return } connection . query ( 'SELECT `ID`, `Voornaam`, `Achternaam`, `Email`, `Password` FROM `user` WHERE `Email` = ?' , [ req . body . email ] , ( err , rows , fields ) => { connection . release ( ) if ( err ) { const error = new ApiError ( err , 500 ) next ( error ) ; } else { if ( rows && rows . length === 1 && rows [ 0 ] . Email !== undefined ) { bcrypt . compare ( req . body . password , rows [ 0 ] . Password , ( err , success ) => { if ( success ) { logger . info ( 'passwords DID match, sending valid token' ) const payload = { user : rows [ 0 ] . Email , id : rows [ 0 ] . ID } const userinfo = { token : auth . encodeToken ( payload ) , username : rows [ 0 ] . Voornaam + ' ' + rows [ 0 ] . Achternaam , email : rows [ 0 ] . Email , } res . status ( 200 ) . json ( userinfo ) . end ( ) } else { next ( new ApiError ( 'Password did not match.' , 401 ) ) } } ) } else { next ( new ApiError ( 'Email does not exist.' , 401 ) ) } } } ) } ) }
Log a user in by validating the email and password in the request.
Log a user in by validating the email and password in the request .
// Verify that we receive the expected input // Login kan alleen als het emailadres bestaat // Was er een resultaat? Zo ja, check het password. // logger.info('Result from database: ') // logger.info(rows) // logger.info('password = ' + rows[0].Password) // Create an object containing the data we want in the payload. // Userinfo returned to the caller.