various improvements

server/api/signup.post.ts

@@ -1,17 +1,22 @@
-import bcryptjs from "bcryptjs";
-import { v4 as uuidv4 } from "uuid";
-import { PrismaClient } from '@prisma/client'
-import { IUser, SafeUser } from "~/types";
-const prisma = new PrismaClient()
+import bcryptjs from 'bcryptjs';
+import { v4 as uuidv4 } from 'uuid';
+import * as dotenv from 'dotenv';
+import crypto from 'node:crypto';
+import { PrismaClient } from '@prisma/client';
+import { IUser, SafeUser } from '~/types';
+const prisma = new PrismaClient();
+dotenv.config();
 
 export default defineEventHandler(async (event) => {
-	const body = await readBody(event)
+	if (!process.env.SESSION_SECRET_KEY) throw new Error('Session secret missing');
+
+	const body = await readBody(event);
 
 	if (!body.username || !body.password || !body.email) {
-		event.node.res.statusCode = 400;
-		return {
-			message: 'A username, a password, and an email address are required to singup'
-		}
+		throw createError({
+			statusCode: 400,
+			statusMessage: 'A username, a password, and an email address are required to singup',
+		});
 	}
 
 	const preExistingUser = await prisma.user.findFirst({
@@ -25,16 +30,16 @@ export default defineEventHandler(async (event) => {
 				}
 			]
 		}
-	}) as SafeUser
+	}) as SafeUser;
 
 	if (preExistingUser) {
-		event.node.res.statusCode = 409;
-		return {
-			message: `User with username ${body.username} or email ${body.email} already exists`
-		}
+		throw createError({
+			statusCode: 409,
+			statusMessage: `User with username ${body.username} or email ${body.email} already exists`,
+		});
 	}
 
-	const passwordhash = await bcryptjs.hash(body.password, 10)
+	const passwordhash = await bcryptjs.hash(body.password, 10);
 
 	const user = await prisma.user.create({
 		data: {
@@ -46,35 +51,39 @@ export default defineEventHandler(async (event) => {
 			id: true,
 			username: true,
 			servers: {
-				participants: {
-					select: {
-						id: true,
-						username: true
-					}
-				},
-				channels: {
-					select: {
-						id: true,
-						DM: true,
-						name: true,
-					}
-				},
+				select: {
+					participants: {
+						select: {
+							id: true,
+							username: true
+						}
+					},
+					channels: {
+						select: {
+							id: true,
+							DM: true,
+							name: true,
+						}
+					},
+				}
 			}
 		},
-	}) as unknown as IUser
+	}) as unknown as IUser;
 
-	const token = uuidv4()
+	const token = crypto.createHmac('sha1', process.env.SESSION_SECRET_KEY)
+		.update(uuidv4())
+		.digest('hex');
 
 	await prisma.session.create({
 		data: {
 			token,
 			userId: user.id
 		}
-	})
+	});
 
 	return {
 		token,
 		userId: user.id,
 		user
-	}
-})
+	};
+});