Use token model for freeswitch

controllers/freeswitch.moon

@@ -2,6 +2,7 @@ lapis = require "lapis"
 
 import respond_to from require "lapis.application"
 
+require "models.token"
 require "models.user"
 
 class Freeswitch extends lapis.Application
@@ -9,8 +10,13 @@ class Freeswitch extends lapis.Application
     POST: =>
       uid = @params["user"] or @params["sip_auth_username"]
       @user = Users\find extension: uid
+      @tokens = Tokens\select "where user_id = ?", uid
+
+      if #@tokens == 0
+        return status: 404, layout: false, "no auth tokens for " .. uid
+
       if not @user
-        return status: 404, "no such user"
+        return status: 404, layout: false, "no such user " .. uid
 
       render: true, layout: false
   }

controllers/users.moon

@@ -10,6 +10,12 @@ require "models.user"
 
 class User extends lapis.Application
   [list: "/list"]: =>
+    if @session.user
+      if not Users\find id: @session.user
+        @write redirect_to: @url_for "login"
+    else
+      @write redirect_to: @url_for "login"
+
     user = Users\find id: @session.user
     @list = Users\select!
     render: true
@@ -28,11 +34,10 @@ class User extends lapis.Application
         { "name", exists: true, min_length: 3}
       }
 
-      @params.password = encoding.encode_base64 encoding.hmac_sha1("ninjas", @params.password)
+      @params.password = encoding.encode_base64 encoding.hmac_sha1(@params.email, @params.password)
       @params.password_again = nil
       @params.csrf_token = nil
       @params.extension = "#{1000}"
-      @params.registrar_password = encoding.encode_base64 encoding.hmac_sha1(@params.email, os.time!)
 
       if Users\find email: @params.email
         @title = "Failure"
@@ -40,8 +45,14 @@ class User extends lapis.Application
 
       user = Users\create @params
       user\write_session @
+
       user.extension = "#{1000 + user.id}"
-      Users\update user
+      assert Users\update user
+
+      token = Tokens\create {
+        user_id: user.extension
+        token: encoding.encode_base64 encoding.hmac_sha1(@params.email, os.time!)
+      }
 
       @title = "Success"
 
@@ -52,8 +63,8 @@ class User extends lapis.Application
         p ->
           text "Your extension is " .. user.extension
         p ->
-          text "Your sip password is "
-          code user.registrar_password
+          text "Your one-time sip token is "
+          code token.token
 
         p "This will not be shown again so please be sure to write this down."
 
@@ -73,11 +84,16 @@ class User extends lapis.Application
 
       user = Users\find email: @params.email
 
-      cmppass = encoding.encode_base64 encoding.hmac_sha1("ninjas", @params.password)
+      cmppass = encoding.encode_base64 encoding.hmac_sha1(@params.email, @params.password)
 
       if user.password == cmppass
         user\write_session @
 
+        token = Tokens\create {
+          user_id: user.extension
+          token: encoding.encode_base64 encoding.hmac_sha1(@params.email, os.time!)
+        }
+
         @title = "Login successful"
 
         return "Hi " .. user.name

models/user.moon

@@ -6,4 +6,3 @@ export class Users extends Model
 
   write_session: (r) =>
     r.session.user = @id
-    r.session.sippw = @registrar_password

views/freeswitch.moon

@@ -10,9 +10,10 @@ class Freeswitch extends Widget
           groups ->
             group name: "default", ->
               users ->
+                for _, token in pairs @tokens
                   user id: "#{@user.extension}", ->
                     params ->
-                    param name: "password", value: "#{@user.registrar_password}"
+                      param name: "password", value: "#{token.token}"
                     variables ->
                       variable name: "accountcode", value: "#{@user.extension}"
                       variable name: "user_context", value: "default"