Mohan Ki
53 lines
1.8 KiB
JavaScript
53 lines
1.8 KiB
JavaScript
const jwt = require('jsonwebtoken');
|
|
const { Pool } = require('pg');
|
|
|
|
const pgPool = new Pool({
|
|
host: process.env.PGHOST || 'postgres',
|
|
port: process.env.PGPORT || 5432,
|
|
user: process.env.PGUSER || 'postgres',
|
|
password: process.env.PGPASSWORD || 'postgres',
|
|
database: process.env.PGDATABASE || 'ckqr',
|
|
});
|
|
|
|
const verifyToken = (req, res, next) => {
|
|
let token = req.headers['authorization'];
|
|
|
|
// Check cookies if no auth header
|
|
if (!token && req.cookies && req.cookies.token) {
|
|
token = req.cookies.token;
|
|
} else if (token && token.startsWith('Bearer ')) {
|
|
token = token.slice(7, token.length).trimLeft();
|
|
}
|
|
|
|
if (!token) return res.status(403).json({ error: 'Token missing from header' });
|
|
|
|
jwt.verify(token, process.env.JWT_SECRET || 'supersecret123', (err, decoded) => {
|
|
if (err) return res.status(401).json({ error: 'Unauthorized' });
|
|
req.user = decoded;
|
|
next();
|
|
});
|
|
};
|
|
|
|
const requireEmailVerification = async (req, res, next) => {
|
|
try {
|
|
const userCheck = await pgPool.query('SELECT is_email_verified, created_at FROM users WHERE id = $1', [req.user.id]);
|
|
if (userCheck.rows.length === 0) return res.status(403).json({ error: 'User not found' });
|
|
|
|
const user = userCheck.rows[0];
|
|
if (!user.is_email_verified) {
|
|
const createdAt = new Date(user.created_at);
|
|
const now = new Date();
|
|
const daysSinceCreation = (now.getTime() - createdAt.getTime()) / (1000 * 60 * 60 * 24);
|
|
if (daysSinceCreation > 5) {
|
|
return res.status(403).json({ error: 'Email verification grace period expired (5 days)' });
|
|
}
|
|
}
|
|
next();
|
|
} catch (err) {
|
|
console.error(err);
|
|
res.status(500).json({ error: 'Server error checking verification' });
|
|
}
|
|
};
|
|
|
|
module.exports = { verifyToken, requireEmailVerification };
|