"use strict";
exports.id = 3408;
exports.ids = [3408];
exports.modules = {

/***/ 26438:
/***/ ((__unused_webpack_module, __webpack_exports__, __webpack_require__) => {

/* harmony export */ __webpack_require__.d(__webpack_exports__, {
/* harmony export */   "Z": () => (/* binding */ getParams)
/* harmony export */ });
function getParams(req) {
    if (req?.method == "POST") {
        return new Proxy({}, {
            get (_, key) {
                return req.body?.[key];
            }
        });
    /*
    // Disabled, since this could lead to a sneaky click on a link attack.
    // Should only be enabled for dev purposes.
    } else if (req?.method == "GET") {
    return new Proxy(
      {},
      {
        get(_, key) {
          if (typeof key != "string") {
            return undefined;
          }
          return req.query?.[key];
        },
      }
    );
*/ } else {
        // only support params for POST requests.
        return {};
    }
};


/***/ }),

/***/ 403408:
/***/ ((__unused_webpack_module, __webpack_exports__, __webpack_require__) => {

__webpack_require__.r(__webpack_exports__);
/* harmony export */ __webpack_require__.d(__webpack_exports__, {
/* harmony export */   "default": () => (/* binding */ signIn),
/* harmony export */   "getAccount": () => (/* binding */ getAccount),
/* harmony export */   "signUserIn": () => (/* binding */ signUserIn)
/* harmony export */ });
/* harmony import */ var password_hash__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(922687);
/* harmony import */ var password_hash__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(password_hash__WEBPACK_IMPORTED_MODULE_0__);
/* harmony import */ var _cocalc_database_pool__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(541808);
/* harmony import */ var _cocalc_database_pool__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(_cocalc_database_pool__WEBPACK_IMPORTED_MODULE_1__);
/* harmony import */ var _cocalc_server_auth_remember_me__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(820540);
/* harmony import */ var _cocalc_server_auth_remember_me__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(_cocalc_server_auth_remember_me__WEBPACK_IMPORTED_MODULE_2__);
/* harmony import */ var _cocalc_server_auth_throttle__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(796016);
/* harmony import */ var _cocalc_server_auth_throttle__WEBPACK_IMPORTED_MODULE_3___default = /*#__PURE__*/__webpack_require__.n(_cocalc_server_auth_throttle__WEBPACK_IMPORTED_MODULE_3__);
/* harmony import */ var cookies__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(770640);
/* harmony import */ var cookies__WEBPACK_IMPORTED_MODULE_4___default = /*#__PURE__*/__webpack_require__.n(cookies__WEBPACK_IMPORTED_MODULE_4__);
/* harmony import */ var lib_api_get_params__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(26438);
/*
 *  This file is part of CoCalc: Copyright © 2020 Sagemath, Inc.
 *  License: AGPLv3 s.t. "Commons Clause" – see LICENSE.md for details
 */ /*
Sign in works as follows:

1. Query the database for the account_id and password_hash
   with the given username.

2. Use the password-hash library to determine whether or
   not the given password hashes properly.  If so, create and
   set a secure remember_me http cookie confirming that the
   client is that user and tell user they are now authenticated.
   If not, send an error back.
*/ 





// import reCaptcha from "@cocalc/server/auth/recaptcha";
async function signIn(req, res) {
    let { email , password  } = (0,lib_api_get_params__WEBPACK_IMPORTED_MODULE_5__/* ["default"] */ .Z)(req);
    email = email.toLowerCase().trim();
    const check = (0,_cocalc_server_auth_throttle__WEBPACK_IMPORTED_MODULE_3__.signInCheck)(email, req.ip);
    if (check) {
        res.json({
            error: check
        });
        return;
    }
    let account_id;
    try {
        // Don't bother checking reCaptcha for *sign in* for now, since it causes trouble
        // when large classes all sign in from one point.  Also, it's much less important
        // for sign in, than for sign up and payment.
        // await reCaptcha(req);
        account_id = await getAccount(email, password);
    } catch (err) {
        res.json({
            error: `Problem signing into account -- ${err.message}.`
        });
        (0,_cocalc_server_auth_throttle__WEBPACK_IMPORTED_MODULE_3__.recordFail)(email, req.ip);
        return;
    }
    await signUserIn(req, res, account_id);
};
async function getAccount(email_address, password) {
    const pool = _cocalc_database_pool__WEBPACK_IMPORTED_MODULE_1___default()();
    const { rows  } = await pool.query("SELECT account_id, password_hash FROM accounts WHERE email_address=$1", [
        email_address
    ]);
    if (rows.length == 0) {
        throw Error(`no account with email address '${email_address}'`);
    }
    const { account_id , password_hash  } = rows[0];
    if (!(0,password_hash__WEBPACK_IMPORTED_MODULE_0__.verify)(password, password_hash)) {
        throw Error(`password for '${email_address}' is incorrect`);
    }
    return account_id;
}
async function signUserIn(req, res, account_id) {
    let value, ttl_s;
    try {
        ({ value , ttl_s  } = await (0,_cocalc_server_auth_remember_me__WEBPACK_IMPORTED_MODULE_2__.createRememberMeCookie)(account_id));
    } catch (err) {
        res.json({
            error: `Problem creating session cookie -- ${err.message}.`
        });
        return;
    }
    try {
        const cookies = new (cookies__WEBPACK_IMPORTED_MODULE_4___default())(req, res, {
            maxAge: ttl_s * 1000
        });
        cookies.set(_cocalc_server_auth_remember_me__WEBPACK_IMPORTED_MODULE_2__.COOKIE_NAME, value);
    } catch (err1) {
        res.json({
            error: `Problem setting cookie -- ${err1.message}.`
        });
        return;
    }
    res.json({
        account_id
    });
}


/***/ }),

/***/ 796016:
/***/ (function(__unused_webpack_module, exports, __webpack_require__) {


/*
Some simple sign in throttling to reduce the impact of brute force
attacks.  This is in memory per-backend server, and doesn't touch
the database.
*/
var __importDefault = (this && this.__importDefault) || function (mod) {
    return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", ({ value: true }));
exports.recordFail = exports.signInCheck = void 0;
var lru_cache_1 = __importDefault(__webpack_require__(336942));
var emailShortCache = new lru_cache_1.default({
    max: 10000,
    maxAge: 1000 * 60,
});
var emailLongCache = new lru_cache_1.default({
    max: 20000,
    maxAge: 1000 * 60 * 60,
});
var ipShortCache = new lru_cache_1.default({ max: 10000, maxAge: 1000 * 60 });
var ipLongCache = new lru_cache_1.default({
    max: 20000,
    maxAge: 1000 * 60 * 60,
});
function signInCheck(email, ip) {
    var _a, _b, _c, _d;
    if (((_a = emailShortCache.get(email)) !== null && _a !== void 0 ? _a : 0) > 5) {
        // A given email address is allowed at most 5 failed login attempts per minute
        return "Too many attempts per minute to sign in as \"".concat(email, "\". Wait one minute, then try again.");
    }
    if (((_b = emailLongCache.get(email)) !== null && _b !== void 0 ? _b : 0) > 50) {
        // A given email address is allowed at most 50 failed login attempts per hour.
        return "Too many attempts per hour to sign in as \"".concat(email, "\". Wait about an hour, then try again.");
    }
    if (ip != null && ((_c = ipShortCache.get(ip)) !== null && _c !== void 0 ? _c : 0) > 30) {
        // A given ip address is allowed at most 30 failed login attempts per minute.
        return "Too many attempts per minute to sign in from your computer. Wait one minute, then try again.";
    }
    if (ip != null && ((_d = ipLongCache.get(ip)) !== null && _d !== void 0 ? _d : 0) > 200) {
        // A given ip address is allowed at most 200 failed login attempts per hour.
        return "Too many attempts per hour to sign in from your computer. Wait about an hour, then try again.";
    }
}
exports.signInCheck = signInCheck;
function recordFail(email, ip) {
    var _a, _b, _c, _d;
    emailShortCache.set(email, ((_a = emailShortCache.get(email)) !== null && _a !== void 0 ? _a : 0) + 1);
    emailLongCache.set(email, ((_b = emailLongCache.get(email)) !== null && _b !== void 0 ? _b : 0) + 1);
    if (ip != null) {
        ipShortCache.set(ip, ((_c = ipShortCache.get(ip)) !== null && _c !== void 0 ? _c : 0) + 1);
        ipLongCache.set(ip, ((_d = ipLongCache.get(ip)) !== null && _d !== void 0 ? _d : 0) + 1);
    }
}
exports.recordFail = recordFail;
//# sourceMappingURL=throttle.js.map

/***/ })

};
;