user.js

var crypto = require('crypto')
  , Blockr = require('./helpers/blockr-api')
  , mysql = require('./config.js')
  , s = require('speakeasy');

function createUserString() {
    var bytes = crypto.randomBytes(16).toString('hex');
    return bytes.slice(0, 7) +
        "-" + bytes.slice(8, 16) +
        "-" + bytes.slice(17, 24) +
        "-" + bytes.slice(25, 32);
}

function db_error(message) {
    if (message === void 0) { message = "There was a database error! Please contact an administrator immediately"}
    return {
        "error": {"type": "DB_ERROR", "message":message}
    };
}


var User = (function() {
    function User(req) {
        this.req = req;

        // If email was submitted as the identifier then load identifier from db
        req.body.identifier
    }
    User.prototype.read_user_settings = function(identifier, callback) {
        var mysqlString = "";

        if (identifier && typeof identifier === "string" && identifier.includes("@")){
            mysqlString = 'SELECT setting, value, shared_key, identifier FROM user_settings INNER JOIN users ON users.email = user_settings.email WHERE users.email = ?';
        } else {
            mysqlString = 'SELECT setting, value, shared_key FROM user_settings INNER JOIN users ON users.identifier = user_settings.identifier WHERE users.identifier = ?';
        }

        mysql.query(mysqlString, [identifier], function(err, rows) {
            if(err) {
                console.log(err);
                callback(err);
            }
            var settings = {};
            if(rows.length > 0) {
                for(var row in rows) {
                    if(rows.hasOwnProperty(row)) {
                        settings[rows[row]['setting']] = rows[row]['value'];
                    }
                }
            }
            callback(false, settings)
        });
    };
    User.prototype.getIdentifierFromEmail = function(emailAddress, callback){
        mysql.query('SELECT * FROM users WHERE email = ?', emailAddress, function(err, rows) {
            if(err) {
                console.log(err);
                callback(err);
            }

            if(rows.length > 0) {
                // false (noError), false (notUnique)
                callback(false, rows[0].identifier);
            } else {
                // false (noError), true (unique)
                callback(true, "No Identifier Matches Email");
            }
        });
    };
    User.prototype.getIdentifier = function(identifier, callback){
        if (identifier && typeof identifier == "string" && identifier.includes("@")){
            this.getIdentifierFromEmail(identifier, function(err, identifier){
                if (err){
                    console.log(identifier);
                    return;
                }
                callback(identifier);
            })
        } else {
            callback(identifier);
        }
    };
    User.prototype.checkUniqueEmail = function(emailAddress, callback){
        mysql.query('SELECT * FROM users WHERE email = ?', emailAddress, function(err, rows) {
            if(err) {
                console.log(err);
                callback(err);
            }
            var settings = {};
            if(rows.length > 0) {
                // false (noError), false (notUnique)
                callback(false, false);
            } else {
                // false (noError), true (unique)
                callback(false, true);
            }
        });
    };
    User.prototype.create = function(callback) {
        var createAndFinish = function(req){
            var identifier = createUserString();
            var data = {};
            var wallet = {
                identifier: identifier,
                shared_key: crypto.randomBytes(48).toString('hex'),
                wallet_data: "",
                created_at: Math.floor(new Date() / 1000),
                last_update: Math.floor(new Date() / 1000),
                created_ip_address: req.ip,
                last_ip_address: req.ip,
                email: ('email' in req.body) ? req.body.email : null
            };
            mysql.query('INSERT INTO users SET ?', wallet, function(err, rows) {
                if(err) {
                    console.log(err);
                    callback(db_error());
                }
                data.identifier = identifier;
                data.shared_key = wallet.shared_key;
                data.error = false;
                callback(data);
            });
        }

        if (this.req && this.req.body && this.req.body.email){
            var request = this.req;
            this.checkUniqueEmail(this.req.body.email, function(err, unique){
                if (err){
                    callback({error: true, errorText: err });
                    return;
                }

                if (unique){
                    createAndFinish(request);
                } else {
                    callback({error: true, errorText: "Please provide a unique email"});
                }
            })
        } else {
            createAndFinish(this.req);
        }
            
    };
    User.prototype.genAuthKey = function(identifier, expires, callback) {
        var data = {
            identifier: identifier,
            expires: expires,
            user_agent: this.req.headers['user-agent'],
            auth_key: crypto.randomBytes(64).toString('hex')
        };
        mysql.query('INSERT INTO user_authkeys SET ?', data, function(err, rows) {
            if(err){
                callback(db_error());
            }
            callback(false, data.auth_key);
        });
    };
    User.prototype.tryGauth = function(identifier, token, is_trusted, callback) {
        var _this = this;
        this.read_user_settings(identifier,
            function(err, settings) {
                if(err){
                    console.log(err);
                    callback(db_error());
                }

                if('gauth_enabled' in settings && (settings['gauth_enabled'] == 'true')) {
                    var expected_key = s.totp({key: settings['gauth_secret'], encoding: 'base32'});

                    if(expected_key === token) {
                        // 1 week if trusted, 2 hours if not
                        var expiration_time = (is_trusted == "true")
                            ? Math.floor(new Date() / 1000) + (60 * 60 * 24 * 7)
                            : Math.floor(new Date() / 1000) + (60 * 60 * 2);
                            _this.genAuthKey(identifier, expiration_time, function(err, auth_key) {
                            if(err) {
                                callback(err);
                            }
                            callback({error: false, data: {auth_key: auth_key, expires: expiration_time}});
                        });
                    } else {
                        callback({error: {type: "WRONG_TOKEN", message: "The token you provided is wrong. " +
                        "You may need to try again in about 10 seconds because " +
                        "these tokens are time based"}});
                    }
                } else {
                    callback({error: {type: "NO_GAUTH", message: "Google Authenticator was not found for this identifier"}});
                }
            }
        );
    };
    User.prototype.setGauth = function(identifier, token, secret, shared_key, callback) {
        var _this = this;
        mysql.query('SELECT * FROM users WHERE identifier = ?', [identifier], function(err, rows) {
            if(rows.length > 0) {
                var row = rows[0];
                if(row.shared_key === shared_key) {
                    var expected_key = s.totp({key: secret, encoding: 'base32'});
                    if(token === expected_key) {
                        var q1 = "INSERT INTO user_settings (`identifier`, `setting`, `value`) VALUES (?, 'gauth_enabled', 'true') ON DUPLICATE KEY UPDATE `value` = 'true'; ";
                        var q2 = "INSERT INTO user_settings (`identifier`, `setting`, `value`) VALUES (?, 'gauth_secret', ?) ON DUPLICATE KEY UPDATE `value` = VALUES(`value`);";
                        var combined = mysql.format(q1 + q2, [
                            identifier,
                            identifier,
                            secret
                        ]);

                        //console.log(combined);
                        mysql.query(combined, function(err, rows) {
                            if(err) {
                                console.log(err);
                                callback(db_error())
                            }
                            var expires = Math.floor(new Date() / 1000) + (60 * 60 * 24 * 7);
                            _this.genAuthKey(identifier, expires, function(err, auth_key) {
                                if(err) {
                                    console.log(err);
                                    callback(db_error())
                                }
                                callback({error: false, data: {message: "successfully set token", auth_key: auth_key, expires: expires}});
                            });
                        });
                    } else {
                        callback({
                            error: {
                                type: "WRONG_TOKEN",
                                message: "The token you provided is wrong. " +
                                "You may need to try again in about 10 seconds because " +
                                "these tokens are time based"
                            }
                        });
                    }
                }
            }
        });
    };

    User.prototype.check2FA = function (res, identifier, callback, fail_callback) {
        var req = this.req;

        this.read_user_settings(identifier, function(err, settings) {
            if(err) {
                res.json(db_error());
            }
            if (settings && ('gauth_enabled' in settings) && settings.gauth_enabled === 'true') {
                //console.log(req.cookies);
                if('auth_key' in req.cookies) {
                    //console.log('in cookies');
                    mysql.query('SELECT * FROM user_authkeys WHERE identifier=? AND auth_key=?', [identifier, req.cookies.auth_key], function(err, rows) {
                        if(rows.length > 0) {
                            var row = rows[0];
                            if(parseInt(row.expires) < Math.floor(new Date() / 1000)) {
                                // 2FA enabled, but their authkey recently expired
                                if (fail_callback === void 0) {
                                    res.json(
                                        {
                                            error: {
                                                type: "AUTH_KEY_EXPIRED",
                                                message: "Your 2FA authentication token has expired. You'll need to login again using your 2FA Authenticator such as Google Authenticator."
                                            }
                                        }
                                    );
                                }else{
                                    fail_callback();
                                }

                            } else {
                                // 2FA enabled, and they're authorized
                                callback();
                            }
                        } else {
                            //console.log('not in db');
                            // 2FA enabled, there's a cookie, but it's not in our DB
                            if (fail_callback === void 0) {
                                res.json({error: {type: "2FA_ENABLED", message: "2FA is enabled for this account, but you're not authenticated."}});
                            } else {
                                fail_callback();
                            }
                        }

                    });
                } else {
                    // 2FA enabled, but no cookie
                    if (fail_callback === void 0) {
                        res.json({error: {type: "2FA_ENABLED", message: "2FA is enabled for this account, but you're not authenticated."}});
                    } else {
                        fail_callback();
                    }

                }
            } else {
                // if they don't have 2FA enabled, we run the callback normally
                callback();
            }
        });
    };

    User.prototype.updateEmail = function(identifier, shared_key, email, callback) {
        mysql.query('SELECT * FROM users WHERE identifier = ?', [identifier], function(err, rows) {
            if(err) {
                callback(db_error());
            }
            if (rows.length > 0) {
                var row = rows[0];
                if (row.shared_key === shared_key) {
                    this.checkUniqueEmail(email, function(err, unique){
                        if (unique){
                            mysql.query('UPDATE users SET email = ? WHERE identifier = ?', [email, identifier], function(err, rows) {
                                if(err) {
                                    callback(db_error());
                                } else {
                                    callback({error: false})
                                }
                            });
                        } else {
                            callback({error: {
                                "type": "EMAIL_NOT_UNIQUE",
                                "message": "Unable to update email, please provide an email address that is not already in use."
                            }})
                        }
                    })
                        
                } else {
                    callback({error: {
                        "type": "INVALID_SHAREDKEY",
                        "message": "Fatal Error: Shared Key does not match wallet, update aborted"
                    }})
                }
            } else {
                callback({error: {
                    "type": "WALLET_NOT_FOUND",
                    "message": "There is no wallet with that identifier"
                    }
                })
            }
        });
    };

    User.prototype.readAccount = function(identifier, shared_key, callback) {
        mysql.query('SELECT * FROM users WHERE identifier = ?', [identifier], function(err, rows) {
            if(err) {
                callback(db_error());
            }
            if (rows.length > 0) {
                var row = rows[0];
                if (row.shared_key === shared_key) {
                    callback({error: false,
                        data:
                        {
                            email: rows[0].email
                        }
                    });
                } else {
                    callback({error: {
                        "type": "INVALID_SHAREDKEY",
                        "message": "Fatal Error: Shared Key does not match wallet, update aborted"
                    }})
                }
            } else {
                callback({error: {
                    "type": "WALLET_NOT_FOUND",
                    "message": "There is no wallet with that identifier"
                }
                })
            }
        });
    };

    return User;
})();

module.exports = User;