"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.twoFactorRouter = void 0;
const tslib_1 = require("tslib");
const express_1 = tslib_1.__importDefault(require("express"));
const otp_1 = require("../../../helpers/otp");
const peertube_crypto_1 = require("../../../helpers/peertube-crypto");
const config_1 = require("../../../initializers/config");
const redis_1 = require("../../../lib/redis");
const middlewares_1 = require("../../../middlewares");
const two_factor_1 = require("../../../middlewares/validators/two-factor");
const twoFactorRouter = express_1.default.Router();
exports.twoFactorRouter = twoFactorRouter;
twoFactorRouter.post('/:id/two-factor/request', middlewares_1.authenticate, (0, middlewares_1.asyncMiddleware)((0, middlewares_1.usersCheckCurrentPasswordFactory)(req => req.params.id)), (0, middlewares_1.asyncMiddleware)(two_factor_1.requestOrConfirmTwoFactorValidator), (0, middlewares_1.asyncMiddleware)(requestTwoFactor));
twoFactorRouter.post('/:id/two-factor/confirm-request', middlewares_1.authenticate, (0, middlewares_1.asyncMiddleware)(two_factor_1.requestOrConfirmTwoFactorValidator), two_factor_1.confirmTwoFactorValidator, (0, middlewares_1.asyncMiddleware)(confirmRequestTwoFactor));
twoFactorRouter.post('/:id/two-factor/disable', middlewares_1.authenticate, (0, middlewares_1.asyncMiddleware)((0, middlewares_1.usersCheckCurrentPasswordFactory)(req => req.params.id)), (0, middlewares_1.asyncMiddleware)(two_factor_1.disableTwoFactorValidator), (0, middlewares_1.asyncMiddleware)(disableTwoFactor));
function requestTwoFactor(req, res) {
    return tslib_1.__awaiter(this, void 0, void 0, function* () {
        const user = res.locals.user;
        const { secret, uri } = (0, otp_1.generateOTPSecret)(user.email);
        const encryptedSecret = yield (0, peertube_crypto_1.encrypt)(secret, config_1.CONFIG.SECRETS.PEERTUBE);
        const requestToken = yield redis_1.Redis.Instance.setTwoFactorRequest(user.id, encryptedSecret);
        return res.json({
            otpRequest: {
                requestToken,
                secret,
                uri
            }
        });
    });
}
function confirmRequestTwoFactor(req, res) {
    return tslib_1.__awaiter(this, void 0, void 0, function* () {
        const requestToken = req.body.requestToken;
        const otpToken = req.body.otpToken;
        const user = res.locals.user;
        const encryptedSecret = yield redis_1.Redis.Instance.getTwoFactorRequestToken(user.id, requestToken);
        if (!encryptedSecret) {
            return res.fail({
                message: 'Invalid request token',
                status: 403
            });
        }
        if ((yield (0, otp_1.isOTPValid)({ encryptedSecret, token: otpToken })) !== true) {
            return res.fail({
                message: 'Invalid OTP token',
                status: 403
            });
        }
        user.otpSecret = encryptedSecret;
        yield user.save();
        return res.sendStatus(204);
    });
}
function disableTwoFactor(req, res) {
    return tslib_1.__awaiter(this, void 0, void 0, function* () {
        const user = res.locals.user;
        user.otpSecret = null;
        yield user.save();
        return res.sendStatus(204);
    });
}
//# sourceMappingURL=two-factor.js.map