Release v2.2.0

src/web/routes/auth/index.js

@@ -1,3 +1,5 @@
+// Authentication route registration for the web app.
+
 module.exports = function registerAuthRoutes(app, deps) {
   const pool = deps.pool;
   const pages = deps.pages;
@@ -5,6 +7,8 @@ module.exports = function registerAuthRoutes(app, deps) {
   const setSessionCookie = deps.setSessionCookie;
   const clearSessionCookie = deps.clearSessionCookie;
   const parseCookies = deps.parseCookies;
+  const consumeAuthMessageCookie = deps.consumeAuthMessageCookie;
+  const setAuthMessageCookie = deps.setAuthMessageCookie;
   const hashSessionToken = deps.hashSessionToken;
   const verifyPassword = deps.verifyPassword;
   const sessionCookieName = deps.sessionCookieName;
@@ -17,7 +21,11 @@ module.exports = function registerAuthRoutes(app, deps) {
     if (req.currentUser) {
       return res.redirect('/dashboard');
     }
-    res.send(pages.renderLoginPage(req.query.message ? String(req.query.message) : ''));
+
+    const message = typeof consumeAuthMessageCookie === 'function'
+      ? consumeAuthMessageCookie(req, res)
+      : (req.query.message ? String(req.query.message) : '');
+    res.send(pages.renderLoginPage(message));
   });
 
   app.post('/login', async function (req, res, next) {
@@ -31,7 +39,12 @@ module.exports = function registerAuthRoutes(app, deps) {
       const [rows] = await pool.query('SELECT id, name, username, password_hash, password_salt, password_iterations FROM a_users WHERE username = ? LIMIT 1', [username]);
       const user = rows[0] || null;
       if (!user || !verifyPassword(password, user)) {
-        return res.redirect('/login?message=' + encodeURIComponent('Invalid username or password.'));
+        if (typeof setAuthMessageCookie === 'function') {
+          setAuthMessageCookie(res, 'Invalid username or password.');
+          return res.redirect('/login');
+        }
+
+        return res.status(401).send(pages.renderLoginPage('Invalid username or password.'));
       }
 
       const token = await createUserSession(pool, user.id);
@@ -50,7 +63,12 @@ module.exports = function registerAuthRoutes(app, deps) {
         await pool.query('DELETE FROM a_sessions WHERE session_hash = ?', [hashSessionToken(token)]);
       }
       clearSessionCookie(res);
-      res.redirect('/login?message=' + encodeURIComponent('You have been signed out.'));
+      if (typeof setAuthMessageCookie === 'function') {
+        setAuthMessageCookie(res, 'You have been signed out.');
+        return res.redirect('/login');
+      }
+
+      res.redirect('/login');
     } catch (error) {
       next(error);
     }

src/web/routes/auth/login.js

@@ -1,3 +1,5 @@
+// Sign-in page renderer for the authentication flow.
+
 const { renderView } = require('../../view');
 
 module.exports = function renderLoginPage(message) {