|
@@ -12,8 +12,12 @@ function setUserSession(req, res, username, UserId, admin) {
|
|
req.session.UserId = UserId
|
|
req.session.UserId = UserId
|
|
|
|
|
|
res.cookie('username', username)
|
|
res.cookie('username', username)
|
|
|
|
+ //Not for security purposes, just so client side can determine
|
|
|
|
+ //to show certain parts of ui or not (i.e. could trivially be spoofed
|
|
|
|
+ //but the server would not accept any api requests)
|
|
|
|
+ res.cookie('admin', !!admin)
|
|
|
|
|
|
- if(admin) req.session.admin = true
|
|
|
|
|
|
+ if(admin) { req.session.admin = true }
|
|
}
|
|
}
|
|
router.post('/', async (req, res) => {
|
|
router.post('/', async (req, res) => {
|
|
let user, adminUser, hash, token
|
|
let user, adminUser, hash, token
|
|
@@ -220,6 +224,7 @@ router.post('/:username/login', async (req, res) => {
|
|
|
|
|
|
res.json({
|
|
res.json({
|
|
username: user.username,
|
|
username: user.username,
|
|
|
|
+ admin: user.admin,
|
|
success: true
|
|
success: true
|
|
})
|
|
})
|
|
} else {
|
|
} else {
|
|
@@ -254,6 +259,7 @@ router.post('/:username/login', async (req, res) => {
|
|
router.post('/:username/logout', async (req, res) => {
|
|
router.post('/:username/logout', async (req, res) => {
|
|
req.session.destroy(() => {
|
|
req.session.destroy(() => {
|
|
res.clearCookie('username')
|
|
res.clearCookie('username')
|
|
|
|
+ res.clearCookie('admin')
|
|
res.json({
|
|
res.json({
|
|
success: true
|
|
success: true
|
|
})
|
|
})
|
|
@@ -370,6 +376,7 @@ router.delete('/:username', async (req, res) => {
|
|
|
|
|
|
req.session.destroy(() => {
|
|
req.session.destroy(() => {
|
|
res.clearCookie('username')
|
|
res.clearCookie('username')
|
|
|
|
+ res.clearCookie('admin')
|
|
res.json({ success: true })
|
|
res.json({ success: true })
|
|
})
|
|
})
|
|
|
|
|