a5399b66 · permissionBRICK/SillyTavern

src/endpoints/anthropic.js+1 -1 Viewed

         if (!result.ok) {
             const text = await result.text();
             console.errorwarn(`Claude API returned error: ${result.status} ${result.statusText}`, text);
             return response.status(result.status).send({ error: true });
+        }

src/endpoints/azure.js+6 -6 Viewed

         const key = readSecret(req.user.directories, SECRET_KEYS.AZURE_TTS);
         if (!key) {
             console.errorwarn('Azure TTS API Key not set');
             return res.sendStatus(403);
+        }
         const region = req.body.region;
         if (!region) {
             console.errorwarn('Azure TTS region not set');
             return res.sendStatus(400);
+        }

         });
         if (!response.ok) {
             console.errorwarn('Azure Request failed', response.status, response.statusText);
             return res.sendStatus(500);
+        }

         const key = readSecret(req.user.directories, SECRET_KEYS.AZURE_TTS);
         if (!key) {
             console.errorwarn('Azure TTS API Key not set');
             return res.sendStatus(403);
+        }
         const { text, voice, region } = req.body;
         if (!text || !voice || !region) {
             console.errorwarn('Missing required parameters');
             return res.sendStatus(400);
+        }

         });
         if (!response.ok) {
             console.errorwarn('Azure Request failed', response.status, response.statusText);
             return res.sendStatus(500);
+        }

src/endpoints/backends/chat-completions.js+17 -17 Viewed

@@ -114,7 +114,7 @@ async function sendClaudeRequest(request, response) {
114	114	}
115	115
116	116	if (!apiKey) {
117	117	console.logwarn(color.red(`Claude API key is missing.\n${divider}`));
118	118	return response.status(400).send({ error: true });
119	119	}
120	120

     const apiKey = readSecret(request.user.directories, SECRET_KEYS.SCALE);
     if (!apiKey) {
         console.logwarn('Scale API key is missing.');
         return response.status(400).send({ error: true });
+    }

         });
         if (!generateResponse.ok) {
             console.errorwarn(`Scale API returned error: ${generateResponse.status} ${generateResponse.statusText} ${await generateResponse.text()}`);
             return response.status(500).send({ error: true });
+        }

     const apiKey = request.body.reverse_proxy ? request.body.proxy_password : readSecret(request.user.directories, SECRET_KEYS.MAKERSUITE);
     if (!request.body.reverse_proxy && !apiKey) {
         console.errorwarn('Google AI Studio API key is missing.');
         return response.status(400).send({ error: true });
+    }

@@ -373,7 +373,7 @@ async function sendMakerSuiteRequest(request, response) {
373	373	}
374	374	} else {
375	375	if (!generateResponse.ok) {
376	376	console.errorwarn(`Google AI Studio API returned error: ${generateResponse.status} ${generateResponse.statusText} ${await generateResponse.text()}`);
377	377	return response.status(generateResponse.status).send({ error: true });
378	378	}
379	379

@@ -391,12 +391,12 @@ async function sendMakerSuiteRequest(request, response) {
391	391	}
392	392
393	393	const responseContent = candidates[0].content ?? candidates[0].output;
394	394	console.errorwarn('Google AI Studio response:', responseContent);
395	395
396	396	const responseText = typeof responseContent === 'string' ? responseContent : responseContent?.parts?.filter(part => !part.thought)?.map(part => part.text)?.join('\n\n');
397	397	if (!responseText) {
398	398	let message = 'Google AI Studio Candidate text empty';
399	399	console.errorwarn(message, generateResponseJson);
400	400	return response.send({ error: { message } });
401	401	}
402	402

         } else {
             if (!generateResponse.ok) {
                 const errorText = await generateResponse.text();
                 console.errorwarn(`AI21 API returned error: ${generateResponse.status} ${generateResponse.statusText} ${errorText}`);
                 const errorJson = tryParse(errorText) ?? { error: true };
                 return response.status(500).send(errorJson);
+            }

     const apiKey = request.body.reverse_proxy ? request.body.proxy_password : readSecret(request.user.directories, SECRET_KEYS.MISTRALAI);
     if (!apiKey) {
         console.errorwarn('MistralAI API key is missing.');
         return response.status(400).send({ error: true });
+    }

         } else {
             if (!generateResponse.ok) {
                 const errorText = await generateResponse.text();
                 console.errorwarn(`MistralAI API returned error: ${generateResponse.status} ${generateResponse.statusText} ${errorText}`);
                 const errorJson = tryParse(errorText) ?? { error: true };
                 return response.status(500).send(errorJson);
+            }

     });
     if (!apiKey) {
         console.errorwarn('Cohere API key is missing.');
         return response.status(400).send({ error: true });
+    }

             const generateResponse = await fetch(apiUrl, config);
             if (!generateResponse.ok) {
                 const errorText = await generateResponse.text();
                 console.errorwarn(`Cohere API returned error: ${generateResponse.status} ${generateResponse.statusText} ${errorText}`);
                 const errorJson = tryParse(errorText) ?? { error: true };
                 return response.status(500).send(errorJson);
+            }

     const apiKey = request.body.reverse_proxy ? request.body.proxy_password : readSecret(request.user.directories, SECRET_KEYS.DEEPSEEK);
     if (!apiKey && !request.body.reverse_proxy) {
         console.logwarn('DeepSeek API key is missing.');
         return response.status(400).send({ error: true });
+    }

         api_key_openai = request.body.reverse_proxy ? request.body.proxy_password : readSecret(request.user.directories, SECRET_KEYS.DEEPSEEK);
         headers = {};
     } else {
         console.errorwarn('This chat completion source is not supported yet.');
         return response_getstatus_openai.status(400).send({ error: true });
+    }
     if (!api_key_openai && !request.body.reverse_proxy && request.body.chat_completion_source !== CHAT_COMPLETION_SOURCES.CUSTOM) {
         console.errorwarn('Chat Completion API key is missing.');
         return response_getstatus_openai.status(400).send({ error: true });
+    }

         headers = {};
         bodyParams = {};
     } else {
         console.errorwarn('This chat completion source is not supported yet.');
         return response.status(400).send({ error: true });
+    }
     if (!apiKey && !request.body.reverse_proxy && request.body.chat_completion_source !== CHAT_COMPLETION_SOURCES.CUSTOM) {
         console.errorwarn('OpenAI API key is missing.');
         return response.status(400).send({ error: true });
+    }

src/endpoints/backends/kobold.js+1 -1 Viewed

             } else {
                 if (!response.ok) {
                     const errorText = await response.text();
                     console.errorwarn(`Kobold returned error: ${response.status} ${response.statusText} ${errorText}`);
                     try {
                         const errorJson = JSON.parse(errorText);

src/endpoints/caption.js+1 -1 Viewed

         const rawImage = await getRawImage(image);
         if (!rawImage) {
             console.errorwarn('Failed to parse captioned image');
             return res.sendStatus(400);
+        }

src/endpoints/characters.js+8 -8 Viewed

 router.post('/edit', urlencodedParser, validateAvatarUrlMiddleware, async function (request, response) {
     if (!request.body) {
         console.errorwarn('Error: no response body detected');
         response.status(400).send('Error: no response body detected');
         return;
+    }
     if (request.body.ch_name === '' || request.body.ch_name === undefined || request.body.ch_name === '.') {
         console.errorwarn('Error: invalid name.');
         response.status(400).send('Error: invalid name.');
         return;
+    }

 router.post('/edit-attribute', jsonParser, validateAvatarUrlMiddleware, async function (request, response) {
     console.debug(request.body);
     if (!request.body) {
         console.errorwarn('Error: no response body detected');
         return response.status(400).send('Error: no response body detected');
+    }
     if (request.body.ch_name === '' || request.body.ch_name === undefined || request.body.ch_name === '.') {
         console.errorwarn('Error: invalid name.');
         return response.status(400).send('Error: invalid name.');
+    }

         const char = JSON.parse(charJSON);
         //check if the field exists
         if (char[request.body.field] === undefined && char.data[request.body.field] === undefined) {
             console.errorwarn('Error: invalid field.');
             response.status(400).send('Error: invalid field.');
             return;
+        }

             await writeCharacterData(avatarPath, JSON.stringify(character), targetImg, request);
             response.sendStatus(200);
         } else {
             console.errorwarn(validator.lastValidationError);
             response.status(400).send({ message: `Validation failed for ${character.name}`, error: validator.lastValidationError });
+        }
     } catch (exception) {

         const fileName = await importFunction(uploadPath, { request, response }, preservedFileName);
         if (!fileName) {
             console.errorwarn('Failed to import character');
             return response.sendStatus(400);
+        }

 router.post('/duplicate', jsonParser, validateAvatarUrlMiddleware, async function (request, response) {
     try {
         if (!request.body.avatar_url) {
             console.errorwarn('avatar URL not found in request body');
             console.debug(request.body);
             return response.sendStatus(400);
+        }

src/endpoints/horde.js+1 -1 Viewed

             { token: api_key_horde });
         if (!generation.id) {
             console.errorwarn('Image generation request is not satisfyable:', generation.message || 'unknown error');
             return response.sendStatus(400);
+        }

src/endpoints/novelai.js+6 -6 Viewed

     const api_key_novel = readSecret(req.user.directories, SECRET_KEYS.NOVEL);
     if (!api_key_novel) {
         console.errorwarn('NovelAI Access Token is missing.');
         return res.sendStatus(400);
+    }

@@ -141,7 +141,7 @@ router.post('/status', jsonParser, async function (req, res) {
141	141	return res.send({ error: true });
142	142	}
143	143	else {
144	144	console.errorwarn('NovelAI returned an error:', response.statusText);
145	145	return res.send({ error: true });
146	146	}
147	147	} catch (error) {

     const api_key_novel = readSecret(req.user.directories, SECRET_KEYS.NOVEL);
     if (!api_key_novel) {
         console.errorwarn('NovelAI Access Token is missing.');
         return res.sendStatus(400);
+    }

             if (!response.ok) {
                 const text = await response.text();
                 let message = text;
                 console.errorwarn(`Novel API returned error: ${response.status} ${response.statusText} ${text}`);
                 try {
                     const data = JSON.parse(text);

     const key = readSecret(request.user.directories, SECRET_KEYS.NOVEL);
     if (!key) {
         console.errorwarn('NovelAI Access Token is missing.');
         return response.sendStatus(400);
+    }

         if (!generateResult.ok) {
             const text = await generateResult.text();
             console.errorwarn('NovelAI returned an error.', generateResult.statusText, text);
             return response.sendStatus(500);
+        }

src/endpoints/openai.js+12 -12 Viewed

@@ -63,7 +63,7 @@ router.post('/caption-image', jsonParser, async (request, response) => {
63	63	}
64	64
65	65	if (!key && !request.body.reverse_proxy && ['custom', 'ooba', 'koboldcpp', 'vllm'].includes(request.body.api) === false) {
66	66	console.errorwarn('No key found for API', request.body.api);
67	67	return response.sendStatus(400);
68	68	}
69	69

@@ -93,7 +93,7 @@ router.post('/caption-image', jsonParser, async (request, response) => {
93	93	excludeKeysByYaml(body, request.body.custom_exclude_body);
94	94	}
95	95
96	96	console.errordebug('Multimodal captioning request', body);
97	97
98	98	let apiUrl = '';
99	99

         if (!result.ok) {
             const text = await result.text();
             console.errorwarn('Multimodal captioning request failed', result.statusText, text);
             return response.status(500).send(text);
+        }

@@ -184,12 +184,12 @@ router.post('/transcribe-audio', urlencodedParser, async (request, response) =>
184	184	const key = readSecret(request.user.directories, SECRET_KEYS.OPENAI);
185	185
186	186	if (!key) {
187	187	console.errorwarn('No OpenAI key found');
188	188	return response.sendStatus(400);
189	189	}
190	190
191	191	if (!request.file) {
192	192	console.errorwarn('No audio file found');
193	193	return response.sendStatus(400);
194	194	}
195	195

         if (!result.ok) {
             const text = await result.text();
             console.errorwarn('OpenAI request failed', result.statusText, text);
             return response.status(500).send(text);
+        }

         const key = readSecret(request.user.directories, SECRET_KEYS.OPENAI);
         if (!key) {
             console.errorwarn('No OpenAI key found');
             return response.sendStatus(400);
+        }

         if (!result.ok) {
             const text = await result.text();
             console.errorwarn('OpenAI request failed', result.statusText, text);
             return response.status(500).send(text);
+        }

         const key = readSecret(request.user.directories, SECRET_KEYS.OPENAI);
         if (!key) {
             console.errorwarn('No OpenAI key found');
             return response.sendStatus(400);
+        }

         if (!result.ok) {
             const text = await result.text();
             console.errorwarn('OpenAI request failed', result.statusText, text);
             return response.status(500).send(text);
+        }

         const { input, provider_endpoint, response_format, voice, speed, model } = request.body;
         if (!provider_endpoint) {
             console.errorwarn('No OpenAI-compatible TTS provider endpoint provided');
             return response.sendStatus(400);
+        }

         if (!result.ok) {
             const text = await result.text();
             console.errorwarn('OpenAI request failed', result.statusText, text);
             return response.status(500).send(text);
+        }

src/endpoints/stable-diffusion.js+26 -26 Viewed

         const key = readSecret(request.user.directories, SECRET_KEYS.TOGETHERAI);
         if (!key) {
             console.errorwarn('TogetherAI key not found.');
             return response.sendStatus(400);
+        }

         });
         if (!modelsResponse.ok) {
             console.errorwarn('TogetherAI returned an error.');
             return response.sendStatus(500);
+        }
         const data = await modelsResponse.json();
         if (!Array.isArray(data)) {
             console.errorwarn('TogetherAI returned invalid data.');
             return response.sendStatus(500);
+        }

         const key = readSecret(request.user.directories, SECRET_KEYS.TOGETHERAI);
         if (!key) {
             console.errorwarn('TogetherAI key not found.');
             return response.sendStatus(400);
+        }

         });
         if (!result.ok) {
             console.errorwarn('TogetherAI returned an error.', { body: await result.text() });
             return response.sendStatus(500);
+        }

         const result = await fetch(modelsUrl);
         if (!result.ok) {
             console.errorwarn('Pollinations returned an error.', result.status, result.statusText);
             throw new Error('Pollinations request failed.');
+        }
         const data = await result.json();
         if (!Array.isArray(data)) {
             console.errorwarn('Pollinations returned invalid data.');
             throw new Error('Pollinations request failed.');
+        }

         const result = await fetch(promptUrl);
         if (!result.ok) {
             console.errorwarn('Pollinations returned an error.', result.status, result.statusText);
             throw new Error('Pollinations request failed.');
+        }

         const key = readSecret(request.user.directories, SECRET_KEYS.STABILITY);
         if (!key) {
             console.errorwarn('Stability AI key not found.');
             return response.sendStatus(400);
+        }

         if (!result.ok) {
             const text = await result.text();
             console.errorwarn('Stability AI returned an error.', result.status, result.statusText, text);
             return response.sendStatus(500);
+        }

         const key = readSecret(request.user.directories, SECRET_KEYS.BLOCKENTROPY);
         if (!key) {
             console.errorwarn('Block Entropy key not found.');
             return response.sendStatus(400);
+        }

         });
         if (!modelsResponse.ok) {
             console.errorwarn('Block Entropy returned an error.');
             return response.sendStatus(500);
+        }
         const data = await modelsResponse.json();
         if (!Array.isArray(data)) {
             console.errorwarn('Block Entropy returned invalid data.');
             return response.sendStatus(500);
+        }
         const models = data.map(x => ({ value: x.name, text: x.name }));

         const key = readSecret(request.user.directories, SECRET_KEYS.BLOCKENTROPY);
         if (!key) {
             console.errorwarn('Block Entropy key not found.');
             return response.sendStatus(400);
+        }

         });
         if (!result.ok) {
             console.errorwarn('Block Entropy returned an error.');
             return response.sendStatus(500);
+        }

         const key = readSecret(request.user.directories, SECRET_KEYS.HUGGINGFACE);
         if (!key) {
             console.errorwarn('Hugging Face key not found.');
             return response.sendStatus(400);
+        }

         });
         if (!result.ok) {
             console.errorwarn('Hugging Face returned an error.');
             return response.sendStatus(500);
+        }

         const key = readSecret(request.user.directories, SECRET_KEYS.NANOGPT);
         if (!key) {
             console.errorwarn('NanoGPT key not found.');
             return response.sendStatus(400);
+        }

         });
         if (!modelsResponse.ok) {
             console.errorwarn('NanoGPT returned an error.');
             return response.sendStatus(500);
+        }

         const imageModels = data?.models?.image;
         if (!imageModels || typeof imageModels !== 'object') {
             console.errorwarn('NanoGPT returned invalid data.');
             return response.sendStatus(500);
+        }

         const key = readSecret(request.user.directories, SECRET_KEYS.NANOGPT);
         if (!key) {
             console.errorwarn('NanoGPT key not found.');
             return response.sendStatus(400);
+        }

         });
         if (!result.ok) {
             console.errorwarn('NanoGPT returned an error.');
             return response.sendStatus(500);
+        }

         const image = data?.data?.[0]?.b64_json;
         if (!image) {
             console.errorwarn('NanoGPT returned invalid data.');
             return response.sendStatus(500);
+        }

         const key = readSecret(request.user.directories, SECRET_KEYS.BFL);
         if (!key) {
             console.errorwarn('BFL key not found.');
             return response.sendStatus(400);
+        }

         });
         if (!result.ok) {
             console.errorwarn('BFL returned an error.');
             return response.sendStatus(500);
+        }

             if (!statusResult.ok) {
                 const text = await statusResult.text();
                 console.errorwarn('BFL returned an error.', text);
                 return response.sendStatus(500);
+            }

src/endpoints/tokenizers.js+2 -2 Viewed

         const result = await fetch(url, args);
         if (!result.ok) {
             console.errorwarn(`API returned error: ${result.status} ${result.statusText}`);
             return response.send({ error: true });
+        }

         const result = await fetch(url, args);
         if (!result.ok) {
             console.errorwarn(`API returned error: ${result.status} ${result.statusText}`);
             return response.send({ error: true });
+        }

src/endpoints/translate.js+8 -8 Viewed

         const url = readSecret(request.user.directories, SECRET_KEYS.LIBRE_URL);
         if (!url) {
             console.errorwarn('LibreTranslate URL is not configured.');
             return response.sendStatus(400);
+        }

         if (!result.ok) {
             const error = await result.text();
             console.errorwarn('LibreTranslate error: ', result.statusText, error);
             return response.sendStatus(500);
+        }

         const result = await fetch(requestUrl);
         if (!result.ok) {
             console.errorwarn('Google Translate error: ', result.statusText);
             return response.sendStatus(500);
+        }

         if (!result.ok) {
             const error = await result.text();
             console.errorwarn('Yandex error: ', result.statusText, error);
             return response.sendStatus(500);
+        }

         if (!result.ok) {
             const error = await result.text();
             console.errorwarn('Lingva error: ', result.statusText, error);
+        }
         /** @type {any} */

         const key = readSecret(request.user.directories, SECRET_KEYS.DEEPL);
         if (!key) {
             console.errorwarn('DeepL key is not configured.');
             return response.sendStatus(400);
+        }

         if (!result.ok) {
             const error = await result.text();
             console.errorwarn('DeepL error: ', result.statusText, error);
             return response.sendStatus(500);
+        }

         if (!result.ok) {
             const error = await result.text();
             console.errorwarn('DeepLX error: ', result.statusText, error);
             return response.sendStatus(500);
+        }

src/endpoints/users-admin.js+13 -13 Viewed

 router.post('/disable', requireAdminMiddleware, jsonParser, async (request, response) => {
     try {
         if (!request.body.handle) {
             console.errorwarn('Disable user failed: Missing required fields');
             return response.status(400).json({ error: 'Missing required fields' });
+        }
         if (request.body.handle === request.user.profile.handle) {
             console.errorwarn('Disable user failed: Cannot disable yourself');
             return response.status(400).json({ error: 'Cannot disable yourself' });
+        }

 router.post('/enable', requireAdminMiddleware, jsonParser, async (request, response) => {
     try {
         if (!request.body.handle) {
             console.errorwarn('Enable user failed: Missing required fields');
             return response.status(400).json({ error: 'Missing required fields' });
+        }

 router.post('/promote', requireAdminMiddleware, jsonParser, async (request, response) => {
     try {
         if (!request.body.handle) {
             console.errorwarn('Promote user failed: Missing required fields');
             return response.status(400).json({ error: 'Missing required fields' });
+        }

 router.post('/demote', requireAdminMiddleware, jsonParser, async (request, response) => {
     try {
         if (!request.body.handle) {
             console.errorwarn('Demote user failed: Missing required fields');
             return response.status(400).json({ error: 'Missing required fields' });
+        }
         if (request.body.handle === request.user.profile.handle) {
             console.errorwarn('Demote user failed: Cannot demote yourself');
             return response.status(400).json({ error: 'Cannot demote yourself' });
+        }

 router.post('/create', requireAdminMiddleware, jsonParser, async (request, response) => {
     try {
         if (!request.body.handle || !request.body.name) {
             console.errorwarn('Create user failed: Missing required fields');
             return response.status(400).json({ error: 'Missing required fields' });
+        }

@@ -167,12 +167,12 @@ router.post('/create', requireAdminMiddleware, jsonParser, async (request, respo
167	167	const handle = lodash.kebabCase(String(request.body.handle).toLowerCase().trim());
168	168
169	169	if (!handle) {
170	170	console.errorwarn('Create user failed: Invalid handle');
171	171	return response.status(400).json({ error: 'Invalid handle' });
172	172	}
173	173
174	174	if (handles.some(x => x === handle)) {
175	175	console.errorwarn('Create user failed: User with that handle already exists');
176	176	return response.status(409).json({ error: 'User already exists' });
177	177	}
178	178

@@ -206,17 +206,17 @@ router.post('/create', requireAdminMiddleware, jsonParser, async (request, respo
206	206	router.post('/delete', requireAdminMiddleware, jsonParser, async (request, response) => {
207	207	try {
208	208	if (!request.body.handle) {
209	209	console.errorwarn('Delete user failed: Missing required fields');
210	210	return response.status(400).json({ error: 'Missing required fields' });
211	211	}
212	212
213	213	if (request.body.handle === request.user.profile.handle) {
214	214	console.errorwarn('Delete user failed: Cannot delete yourself');
215	215	return response.status(400).json({ error: 'Cannot delete yourself' });
216	216	}
217	217
218	218	if (request.body.handle === DEFAULT_USER.handle) {
219	219	console.errorwarn('Delete user failed: Cannot delete default user');
220	220	return response.status(400).json({ error: 'Sorry, but the default user cannot be deleted. It is required as a fallback.' });
221	221	}
222	222

 router.post('/slugify', requireAdminMiddleware, jsonParser, async (request, response) => {
     try {
         if (!request.body.text) {
             console.errorwarn('Slugify failed: Missing required fields');
             return response.status(400).json({ error: 'Missing required fields' });
+        }

src/endpoints/users-private.js+10 -10 Viewed

 router.post('/change-avatar', jsonParser, async (request, response) => {
     try {
         if (!request.body.handle) {
             console.errorwarn('Change avatar failed: Missing required fields');
             return response.status(400).json({ error: 'Missing required fields' });
+        }

         // Avatar is not a data URL or not an empty string
         if (!request.body.avatar.startsWith('data:image/') && request.body.avatar !== '') {
             console.errorwarn('Change avatar failed: Invalid data URL');
             return response.status(400).json({ error: 'Invalid data URL' });
+        }

 router.post('/change-password', jsonParser, async (request, response) => {
     try {
         if (!request.body.handle) {
             console.errorwarn('Change password failed: Missing required fields');
             return response.status(400).json({ error: 'Missing required fields' });
+        }

         const handle = request.body.handle;
         if (!handle) {
             console.errorwarn('Backup failed: Missing required fields');
             return response.status(400).json({ error: 'Missing required fields' });
+        }

         const password = request.body.password;
         if (request.user.profile.password && request.user.profile.password !== getPasswordHash(password, request.user.profile.salt)) {
             console.errorwarn('Reset settings failed: Incorrect password');
             return response.status(403).json({ error: 'Incorrect password' });
+        }

 router.post('/change-name', jsonParser, async (request, response) => {
     try {
         if (!request.body.name || !request.body.handle) {
             console.errorwarn('Change name failed: Missing required fields');
             return response.status(400).json({ error: 'Missing required fields' });
+        }

         const user = await storage.getItem(toKey(request.body.handle));
         if (!user) {
             console.errorwarn('Change name failed: User not found');
             return response.status(404).json({ error: 'User not found' });
+        }

 router.post('/reset-step2', jsonParser, async (request, response) => {
     try {
         if (!request.body.code) {
             console.errorwarn('Recover step 2 failed: Missing required fields');
             return response.status(400).json({ error: 'Missing required fields' });
+        }
         if (request.user.profile.password && request.user.profile.password !== getPasswordHash(request.body.password, request.user.profile.salt)) {
             console.errorwarn('Recover step 2 failed: Incorrect password');
             return response.status(400).json({ error: 'Incorrect password' });
+        }
         const code = RESET_CACHE.get(request.user.profile.handle);
         if (!code || code !== request.body.code) {
             console.errorwarn('Recover step 2 failed: Incorrect code');
             return response.status(400).json({ error: 'Incorrect code' });
+        }

src/endpoints/users-public.js+7 -7 Viewed

 router.post('/login', jsonParser, async (request, response) => {
     try {
         if (!request.body.handle) {
             console.errorwarn('Login failed: Missing required fields');
             return response.status(400).json({ error: 'Missing required fields' });
+        }

@@ -72,12 +72,12 @@ router.post('/login', jsonParser, async (request, response) => {
72	72	}
73	73
74	74	if (!user.enabled) {
75	75	console.errorwarn('Login failed: User', user.handle, 'is disabled');
76	76	return response.status(403).json({ error: 'User is disabled' });
77	77	}
78	78
79	79	if (user.password && user.password !== getPasswordHash(request.body.password, user.salt)) {
80	80	console.errorwarn('Login failed: Incorrect password for', user.handle);
81	81	return response.status(403).json({ error: 'Incorrect credentials' });
82	82	}
83	83

 router.post('/recover-step1', jsonParser, async (request, response) => {
     try {
         if (!request.body.handle) {
             console.errorwarn('Recover step 1 failed: Missing required fields');
             return response.status(400).json({ error: 'Missing required fields' });
+        }

 router.post('/recover-step2', jsonParser, async (request, response) => {
     try {
         if (!request.body.handle || !request.body.code) {
             console.errorwarn('Recover step 2 failed: Missing required fields');
             return response.status(400).json({ error: 'Missing required fields' });
+        }

@@ -158,7 +158,7 @@ router.post('/recover-step2', jsonParser, async (request, response) => {
158	158	}
159	159
160	160	if (!user.enabled) {
161	161	console.errorwarn('Recover step 2 failed: User', user.handle, 'is disabled');
162	162	return response.status(403).json({ error: 'User is disabled' });
163	163	}
164	164

         if (request.body.code !== mfaCode) {
             await recoverLimiter.consume(ip);
             console.errorwarn('Recover step 2 failed: Incorrect code');
             return response.status(403).json({ error: 'Incorrect code' });
+        }

Sparser use of .error