akhilmeka/permit-api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: block user after 5 failed login attemtps

Browse Source
This commit is contained in:
Akhil Meka
2025-08-04 11:59:52 +05:30
parent 85d98250a7
commit e4817ffdf7
3 changed files with 25 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
src/auth/auth.route.ts
View File

@@ -44,6 +44,8 @@ export async function authRoutes(fastify: FastifyInstance) {
const hashedPassword = await hash(password);
userInDB.passwordHash = hashedPassword;
userInDB.blocked = false;
userInDB.faliedLoginCount = 0;
await userInDB.save();
} catch (err) {
return err;
@@ -79,9 +81,20 @@ export async function authRoutes(fastify: FastifyInstance) {
if (!userInDB.passwordHash)
return res.code(401).send({ error: "invalid email or password" });
if (userInDB.blocked)
return res
.code(401)
.send({ error: "Account blocked. Contact admin." });
const match = await verify(userInDB.passwordHash, password);
if (!match)
if (!match) {
if (!userInDB.faliedLoginCount) userInDB.faliedLoginCount = 0;
if (userInDB.faliedLoginCount >= 4) userInDB.blocked = true;
userInDB.faliedLoginCount++;
await userInDB.save();
return res.code(401).send({ error: "invalid email or password" });
}
const newSession = await createSession(
userInDB.id,
@@ -90,6 +103,7 @@ export async function authRoutes(fastify: FastifyInstance) {
);
userInDB.lastLogin = new Date();
userInDB.faliedLoginCount = 0;
await userInDB.save();
res.send({ session_token: newSession.sid });