Merge pull request #727 from PenguinMod/token_through_headers

Token through headers

Author: Ianyourgod

src/resources/authentication.js

@@ -78,11 +78,14 @@ class Authentication {
     static authenticate(iframe = true) {
         const currentUrl = new URL(window.location.href);
         const redirect = currentUrl.searchParams.get("redirect");
-        const url = `${window.location.origin}/signin?${redirect ? `redirect=${encodeURIComponent(redirect)}&`
-            : (window.location.pathname !== "/signin" && window.location.pathname !== "/signup")
-                    ? `redirect=${encodeURIComponent(currentUrl.href)}&`
-                    : ""
-            }embed=${iframe}`;
+        const url = `${window.location.origin}/signin?${
+            redirect
+                ? `redirect=${encodeURIComponent(redirect)}&`
+                : window.location.pathname !== "/signin" &&
+                    window.location.pathname !== "/signup"
+                  ? `redirect=${encodeURIComponent(currentUrl.href)}&`
+                  : ""
+        }embed=${iframe}`;
 
         if (!iframe) {
             window.location.href = url;
@@ -122,9 +125,11 @@ class Authentication {
 
     static verifyToken(username, token) {
         return new Promise((resolve, reject) => {
-            fetch(
-                `${ProjectApi.OriginApiUrl}/api/v1/users/tokenlogin?username=${username}&token=${token}`,
-            )
+            fetch(`${ProjectApi.OriginApiUrl}/api/v1/users/tokenlogin`, {
+                headers: {
+                    Authorization: `Bearer ${token}`,
+                },
+            })
                 .then((r) =>
                     r
                         .json()
@@ -153,17 +158,12 @@ class Authentication {
     }
     static logout() {
         return new Promise((resolve, reject) => {
-            const username = localStorage.getItem("username");
             const token = localStorage.getItem("token");
             fetch(`${ProjectApi.OriginApiUrl}/api/v1/users/logout`, {
                 method: "POST",
                 headers: {
-                    "Content-Type": "application/json",
+                    Authorization: `Bearer ${token}`,
                 },
-                body: JSON.stringify({
-                    username: username,
-                    token: token,
-                }),
             })
                 .then((res) => {
                     if (!res.ok) return reject("Not OK");
@@ -183,17 +183,29 @@ class Authentication {
         });
     }
     static async usernameFromCode(_username, token) {
-        // name is a misnomer, was just to lazy to change after new api update.
-        // TODO: make this less misleading
+        // name is a misnomer, was just too lazy to change after new api update.
+        // doesn't really matter now bc of newhome
         const j = await fetch(
-            `${ProjectApi.OriginApiUrl}/api/v1/users/userfromcode?token=${token}`,
+            `${ProjectApi.OriginApiUrl}/api/v1/users/userfromcode`,
+            {
+                headers: {
+                    Authorization: `Bearer ${token}`,
+                },
+            },
         ).then((r) => r.json());
 
         if (j.error) throw j.error;
 
+        // this is stupid - basically if any of these are false, we bypass the cache.
+        // its stupid but also easy. so i won't be changing it for now.
         if (!j.birthdayEntered || !j.countryEntered || !j.isEmailVerified) {
             const extra = await fetch(
-                `${ProjectApi.OriginApiUrl}/api/v1/users/extrainfostatus?token=${token}`,
+                `${ProjectApi.OriginApiUrl}/api/v1/users/extrainfostatus`,
+                {
+                    headers: {
+                        Authorization: `Bearer ${token}`,
+                    },
+                },
             ).then((r) => r.json());
 
             j.birthdayEntered = extra.birthdayEntered;
@@ -214,10 +226,9 @@ class Authentication {
                 method: "POST",
                 headers: {
                     "Content-Type": "application/json",
+                    Authorization: `Bearer ${token}`,
                 },
                 body: JSON.stringify({
-                    username,
-                    token,
                     old_password: oldPassword,
                     new_password: newPassword,
                 }),
@@ -297,8 +308,8 @@ class Authentication {
                     method: "POST",
                     headers: {
                         "Content-Type": "application/json",
+                        Authorization: `Bearer ${token}`,
                     },
-                    body: JSON.stringify({ username, token }),
                 },
             )
                 .then((r) =>
@@ -320,8 +331,9 @@ class Authentication {
                 method: "POST",
                 headers: {
                     "Content-Type": "application/json",
+                    Authorization: `Bearer ${token}`,
                 },
-                body: JSON.stringify({ username, token, newUsername }),
+                body: JSON.stringify({ newUsername }),
             })
                 .then((r) =>
                     r
@@ -331,7 +343,7 @@ class Authentication {
 
                             // clear userfromcode cache
                             Authentication.usernameFromCode(
-                                username,
+                                newUsername,
                                 token,
                                 true,
                             );