`routes/auth.js`

43 lines
const express = require('express');
const auth = require('../lib/auth');
const router = express.Router();

router.get('/admin/login', (req, res) => {
  if (res.locals.currentBusinessUser) return res.redirect('/admin');
  res.render('admin/login', {
    title: 'Sign in · Ventura Claw',
    next: String(req.query.next || '/admin'),
    error: null,
    email: ''
  });
});

router.post('/admin/login', async (req, res) => {
  const email = auth.normalizeEmail(req.body.email);
  const password = String(req.body.password || '');
  const next = String(req.body.next || req.query.next || '/admin');

  if (!auth.isEmailShape(email) || !password) {
    return res.status(400).render('admin/login', {
      title: 'Sign in · Ventura Claw', next, email,
      error: 'Email and password required.'
    });
  }
  const user = await auth.findUserByEmail(email);
  if (!user || !user.password_hash || !(await auth.verifyPassword(password, user.password_hash))) {
    return res.status(400).render('admin/login', {
      title: 'Sign in · Ventura Claw', next, email,
      error: 'Email or password incorrect. If you just claimed your listing, check your inbox for the link.'
    });
  }
  req.session.businessUserId = user.id;
  await auth.recordLogin(user.id);
  res.redirect(next.startsWith('/admin') ? next : '/admin');
});

router.post('/admin/logout', (req, res) => {
  req.session.destroy(() => res.redirect('/'));
});

module.exports = router;