app.js

import express from "express";
import session from "express-session";
import { FriendlyCaptchaClient } from "@friendlycaptcha/server-sdk";
import * as store from "./store.js";

const app = express();
const port = process.env.PORT || 3000;

const frcClient = new FriendlyCaptchaClient({
  apiKey: process.env.FRC_APIKEY,
  sitekey: process.env.FRC_SITEKEY,
});

app.set("views", "./views");
app.set("view engine", "pug");

app.use(
  session({
    secret: process.env.SESSIONS_SECRET || "don't do this in production",
    resave: false,
    saveUninitialized: true,
  }),
);

app.get("/", (req, res) => {
  if (!req.session.username) return res.redirect("/login");

  const user = store.getUser(req.session.username);
  return res.render("index", {
    title: "Welcome",
    username: user.name,
    count: user.loginCount,
  });
});

app.get("/login", (req, res) => {
  if (req.session.username) return res.redirect("/");

  res.render("login", { title: "Log In" });
});

app.post(
  "/login",
  express.urlencoded({ extended: false }),
  async (req, res) => {
    const user = store.authenticate(req.body.username);
    const browser = await getBrowser(req.body["frc-risk-intelligence-token"]);

    let nextRoute;
    if (store.shouldConfirm(user.name, browser)) {
      // Here you might generate a confirmation code and email it to the user's account,
      // but we're going to skip it as part of this tutorial for the sake of simplicity.
      nextRoute = "/confirm";
      // Store the browser in the session so we can use it in the POST /confirm route.
      req.session.browser = browser;
    } else {
      nextRoute = "/";
      store.recordLogin(user.name, browser);
    }

    req.session.username = user.name;
    req.session.save(() => res.redirect(nextRoute));
  },
);

app.get("/confirm", (req, res) => {
  if (!req.session.username) return res.redirect("/login");

  res.render("confirm", {
    title: "Confirm Login",
    username: req.session.username,
  });
});

app.post("/confirm", express.urlencoded({ extended: false }), (req, res) => {
  // The confirmation code is available in req.body.confirmation.
  // You would compare it to the one you generated in the POST /login handler.
  store.recordLogin(req.session.username, req.session.browser);
  res.redirect("/");
});

app.post("/logout", function (req, res) {
  req.session.username = null;
  req.session.save(() => res.redirect("/login"));
});

async function getBrowser(token) {
  if (!token) {
    return console.warn(
      "Empty token, skipping Risk Intelligence data retrieval.",
    );
  }

  const result = await frcClient.retrieveRiskIntelligence(token);

  // Check if we were able to retrieve the risk intelligence data
  if (result.wasAbleToRetrieve()) {
    // Check if the token is valid and data was retrieved successfully
    if (result.isValid()) {
      const response = result.getResponse();
      const { browser } = response.data.risk_intelligence.client;
      return `${browser.name}, version ${browser.version}`;
    } else {
      // Token was invalid or expired
      const error = result.getResponseError();
      console.log("Error:", error?.error_code, error?.detail);
    }
  } else {
    // Network issue or configuration problem
    if (result.isClientError()) {
      console.log("Configuration error - check your API key");
    } else {
      console.log("Network issue or service temporarily unavailable");
    }
  }
}

app.listen(port, () => {
  console.log(`Server listening on port ${port}`);
});