implement account locking on too many attempts and unlocking after time window

2020-09-25 14:22:13 -04:00
parent 57c6afa3a9
commit c19ccd5df4
5 changed files with 56 additions and 4 deletions
--- a/src/auth/operations/login.js
+++ b/src/auth/operations/login.js
@@ -35,9 +35,15 @@ async function login(args) {
  if (!userDoc || (args.collection.config.auth.emailVerification && !userDoc._verified)) {
    throw new AuthenticationError();
  }
+  if (userDoc && userDoc.isLocked) {
+    throw new AuthenticationError();
+  }
  const authResult = await userDoc.authenticate(password);

-  if (!authResult.user) {
+  if (authResult.user) {
+    await authResult.user.resetLoginAttempts();
+  } else {
+    await userDoc.incLoginAttempts();
    throw new AuthenticationError();
  }