[WIP] login to server via signing a message

.eslintrc

@@ -1,3 +1,12 @@
 {
-  "extends": "loopback"
+  "extends": "loopback",
+  "rules": {
+    "max-len": "off",
+    "object-curly-spacing": ["error", "always"],
+    "padded-blocks": "off",
+    "one-var": "off"
+  },
+  "parserOptions": {
+    "ecmaVersion": 2017
+  }
 }

common/models/account.js

@@ -1,32 +1,21 @@
+'use strict';
+
 var ethUtil = require('ethereumjs-util');
 var sigUtil = require('eth-sig-util');
 
 module.exports = function(Account) {
 
-  Account.observe('before save', function(ctx, next) {
-    if (ctx.options.skipSignatureCheck) {
-      next();
-    } else {
-      const data = ctx.instance ? ctx.instance : ctx.data;
-
-      // Check that timestamp is within the last 10 minutes
-      const timestamp = parseInt(data.timestamp);
-      const now = new Date().getTime();
-      if (now - timestamp > 10 * 60 * 1000) {
-        next(new Error('Invalid signature'));
-        return;
-      }
-
-      const text = "Please sign this message to confirm your request to update your profile to name '" + data.name + "' and description '" + data.description + "'. There's no gas cost to you. Timestamp:" + data.timestamp;
-      const msg = ethUtil.bufferToHex(Buffer.from(text, 'utf8'));
-      const recoveredAddress = sigUtil.recoverPersonalSignature({ data: msg, sig: data.signature });
-
-      if (recoveredAddress == data.ethereumAccountAddress) {
-        next();
-      } else {
-        next(new Error('Must include valid signature to update your account profile.'))
-      }
+  Account.getAddressNonce = async function(address, cb) {
+    let account = await Account.findOne({ where: { ethereumAccountAddress: address } });
+    if (!account) {
+      account = new Account();
+      account.ethereumAccountAddress = address;
     }
-  });
+
+    // Always generate a new nonce so each login is unique
+    account.loginNonce = Math.floor(Math.random() * 1000000);
+    account.save();
+    return account.loginNonce;
+  };
 
 };

common/models/account.json

@@ -3,8 +3,8 @@
   "idInjection": false,
   "properties": {
     "ethereumAccountAddress": {
-      "id": true,
       "type": "string",
+      "id": true,
       "required": true
     },
     "description": {
@@ -14,8 +14,7 @@
       "type": "string"
     },
     "name": {
-      "type": "string",
-      "required": true
+      "type": "string"
     },
     "facebookURL": {
       "type": "string"
@@ -28,6 +27,9 @@
     },
     "userId": {
       "type": "string"
+    },
+    "loginNonce": {
+      "type": "string"
     }
   },
   "validations": [],
@@ -38,6 +40,13 @@
       "foreignKey": "userId"
     }
   },
-  "acls": [],
+  "acls": [
+    {
+      "accessType": "WRITE",
+      "principalType": "ROLE",
+      "principalId": "$unauthenticated",
+      "permission": "DENY"
+    }
+  ],
   "methods": {}
 }

common/models/proposal.json

@@ -2,9 +2,21 @@
   "name": "Proposal",
   "base": "PersistedModel",
   "idInjection": true,
+  "indexes": {
+    "arcId_index": {
+      "arcId": 1
+    },
+    "daoAvatarAddress_index": {
+      "daoAvatarAddress": 1
+    },
+    "descriptionHash_index": {
+      "descriptionHash": 1
+    }
+  },
   "options": {
     "validateUpsert": true
   },
+  "replaceOnPUT": false,
   "properties": {
     "arcId": {
       "type": "string"
@@ -30,14 +42,8 @@
       "required": true
     }
   },
-  "indexes": {
-    "arcId_index": {"arcId": 1},
-    "daoAvatarAddress_index": {"daoAvatarAddress": 1},
-    "descriptionHash_index": {"descriptionHash": 1}
-  },
   "validations": [],
   "relations": {},
   "acls": [],
-  "methods": {},
-  "replaceOnPUT": false
+  "methods": {}
 }