Refactor authentication and token handling.

pages/api/auth/login.js

@@ -1,32 +1,44 @@
-import { ok, unauthorized, badRequest, checkPassword, createSecureToken } from 'next-basics';
+import {
+  ok,
+  unauthorized,
+  badRequest,
+  checkPassword,
+  createSecureToken,
+  methodNotAllowed,
+  getRandomChars,
+} from 'next-basics';
 import { getUser } from 'queries';
 import { secret } from 'lib/crypto';
 import redis from 'lib/redis';
-import { generateAuthToken } from 'lib/auth';
 
 export default async (req, res) => {
-  const { username, password } = req.body;
+  if (req.method === 'POST') {
+    const { username, password } = req.body;
 
-  if (!username || !password) {
-    return badRequest(res);
-  }
+    if (!username || !password) {
+      return badRequest(res);
+    }
 
-  const user = await getUser({ username });
+    const user = await getUser({ username });
 
-  if (user && checkPassword(password, user.password)) {
-    if (redis.enabled) {
-      const token = generateAuthToken();
+    if (user && checkPassword(password, user.password)) {
+      if (redis.enabled) {
+        const key = `auth:${getRandomChars(32)}`;
 
-      await redis.set(token, user);
+        await redis.set(key, user);
+
+        const token = createSecureToken(key, secret());
+
+        return ok(res, { token, user });
+      }
+
+      const token = createSecureToken(user.id, secret());
 
       return ok(res, { token, user });
     }
 
-    const { id: userId, username, isAdmin } = user;
-    const token = createSecureToken({ userId, username, isAdmin }, secret());
-
-    return ok(res, { token, user });
+    return unauthorized(res, 'Incorrect username and/or password.');
   }
 
-  return unauthorized(res);
+  return methodNotAllowed(res);
 };

pages/api/auth/logout.js

@@ -8,7 +8,7 @@ export default async (req, res) => {
 
   if (req.method === 'POST') {
     if (redis.enabled) {
-      await redis.del(`auth:${getAuthToken(req)}`);
+      await redis.del(getAuthToken(req));
     }
 
     return ok(res);

pages/api/auth/verify.js

@@ -1,22 +1,8 @@
 import { useAuth } from 'lib/middleware';
-import { ok, unauthorized } from 'next-basics';
-import redis from 'lib/redis';
-import { secret } from 'lib/crypto';
-import { getAuthToken } from 'lib/auth';
+import { ok } from 'next-basics';
 
 export default async (req, res) => {
-  if (redis.enabled) {
-    const token = await getAuthToken(req, secret());
-    const user = await redis.get(token);
+  await useAuth(req, res);
 
-    return ok(res, user);
-  } else {
-    await useAuth(req, res);
-
-    if (req.auth) {
-      return ok(res, req.auth);
-    }
-  }
-
-  return unauthorized(res);
+  return ok(res, req.auth);
 };

pages/sso.js

@@ -1,38 +1,19 @@
 import { useEffect } from 'react';
-import debug from 'debug';
 import { useRouter } from 'next/router';
 import { setItem } from 'next-basics';
 import { AUTH_TOKEN } from 'lib/constants';
-import useApi from 'hooks/useApi';
-import { setUser } from 'store/app';
-
-const log = debug('umami:sso');
 
 export default function SingleSignOnPage() {
   const router = useRouter();
-  const { get } = useApi();
   const { token, url } = router.query;
 
   useEffect(() => {
-    async function verify() {
+    if (url && token) {
       setItem(AUTH_TOKEN, token);
 
-      const { ok, data } = await get('/auth/verify');
-
-      if (ok) {
-        log(data);
-        setUser(data);
-
-        if (url) {
-          await router.push(url);
-        }
-      }
+      router.push(url);
     }
-
-    if (token) {
-      verify();
-    }
-  }, [token]);
+  }, [url, token]);
 
   return null;
 }