d

apps/api/src/index.ts

@@ -1,5 +1,5 @@
 import { Elysia } from "elysia";
-import { login, logout, getAnonymousSession, getSessionFromRequest, seedAdminAccount, createTotpSecret, enableTotp, disableTotp } from "./auth/service";
+import { login, getAnonymousSession, getSessionFromRequest, seedAdminAccount, createTotpSecret, enableTotp, disableTotp } from "./auth/service";
 import { HttpError } from "./lib/errors";
 import { errorResponse, fileResponse, jsonResponse, parseJson, emptyResponse } from "./lib/http";
 import { config } from "./lib/config";
@@ -55,16 +55,15 @@ app.get(
 app.post(
   "/api/auth/login",
   route(async (request) => {
-    enforceLimiter(loginLimiter, request, "login", config.loginRateLimit, config.loginWindowMs);
+    if (!config.allowInsecureLogin) {
+      enforceLimiter(loginLimiter, request, "login", config.loginRateLimit, config.loginWindowMs);
+    }
     const body = await parseJson(request, loginSchema);
     const result = await login(body.email, body.password, body.totpCode, request);
     return jsonResponse(
       request,
       200,
-      { session: result.session },
-      {
-        "Set-Cookie": result.cookie
-      }
+      { session: result.session }
     );
   })
 );
@@ -72,21 +71,14 @@ app.post(
 app.post(
   "/api/auth/logout",
   route(async (request) => {
-    const session = await getSessionFromRequest(request, { requireCsrf: true });
-    const expiredCookie = logout(request);
-    return jsonResponse(
-      request,
-      200,
-      { session: getAnonymousSession(), email: session.email },
-      { "Set-Cookie": expiredCookie }
-    );
+    return jsonResponse(request, 200, { session: getAnonymousSession() });
   })
 );
 
 app.post(
   "/api/auth/totp/setup",
   route(async (request) => {
-    const session = await getSessionFromRequest(request, { requireCsrf: true });
+    const session = await getSessionFromRequest(request);
     const setup = await createTotpSecret(session.email);
     return jsonResponse(request, 200, setup);
   })
@@ -95,7 +87,7 @@ app.post(
 app.post(
   "/api/auth/totp/enable",
   route(async (request) => {
-    const session = await getSessionFromRequest(request, { requireCsrf: true });
+    const session = await getSessionFromRequest(request);
     const body = await parseJson(request, totpCodeSchema);
     await enableTotp(session.email, body.code);
     return emptyResponse(request, 204);
@@ -105,7 +97,7 @@ app.post(
 app.post(
   "/api/auth/totp/disable",
   route(async (request) => {
-    const session = await getSessionFromRequest(request, { requireCsrf: true });
+    const session = await getSessionFromRequest(request);
     const body = await parseJson(request, totpCodeSchema);
     await disableTotp(session.email, body.code);
     return emptyResponse(request, 204);
@@ -123,7 +115,7 @@ app.get(
 app.patch(
   "/api/settings/profile",
   route(async (request) => {
-    const session = await getSessionFromRequest(request, { requireCsrf: true });
+    const session = await getSessionFromRequest(request);
     const body = await parseJson(request, profileSchema);
     return jsonResponse(request, 200, updateDisplayName(session.email, body.displayName));
   })
@@ -132,7 +124,7 @@ app.patch(
 app.post(
   "/api/settings/avatar",
   route(async (request) => {
-    const session = await getSessionFromRequest(request, { requireCsrf: true });
+    const session = await getSessionFromRequest(request);
     const formData = await request.formData();
     const avatar = formData.get("avatar");
     if (!(avatar instanceof File)) {
@@ -169,7 +161,7 @@ app.get(
 app.put(
   "/api/settings/forwarding",
   route(async (request) => {
-    const session = await getSessionFromRequest(request, { requireCsrf: true });
+    const session = await getSessionFromRequest(request);
     const body = await parseJson(request, forwardingSchema);
     const rule = await updateForwarding(session.email, body.enabled, body.target);
     return jsonResponse(request, 200, rule);
@@ -200,7 +192,7 @@ app.get(
 app.post(
   "/api/mail/send",
   route(async (request) => {
-    const session = await getSessionFromRequest(request, { requireCsrf: true });
+    const session = await getSessionFromRequest(request);
     enforceLimiter(routeLimiter, request, "send-mail", 10, 60_000, session.email);
     const body = await parseJson(request, composeSchema);
     await composeAndSendMessage(session.email, body.to, body.subject, body.textBody);