Method login

server/controllers/UserController.js:279–318

(email, password)

  }

  async login(email, password) {
    try {
      const foundUser = await db.User.findOne({ where: { email: { [Op.like]: email } } });

      if (!foundUser) {
        throw new Error(401);
      }

      let isAuthenticated = false;

      if (foundUser.password.startsWith("$2a$") || foundUser.password.startsWith("$2b$") || foundUser.password.startsWith("$2y$")) {
        isAuthenticated = await bcrypt.compare(password, foundUser.password);
      } else {
        isAuthenticated = (foundUser.password === sc.encrypt(password));

        if (isAuthenticated) {
          const bcryptHash = await bcrypt.hash(password, 10);
          await db.User.update({ password: bcryptHash }, { where: { email } });
        }
      }

      if (!isAuthenticated) {
        throw new Error(401);
      }

      const user2FA = await db.User2fa.findOne({
        where: { user_id: foundUser.id, isEnabled: true }
      });

      if (user2FA?.id) {
        return new Promise((resolve) => resolve({
          user_id: foundUser.id, method_id: user2FA.id, method: user2FA.method,
        }));
      }

      return foundUser;
    } catch (error) {
      throw new Error(error.message);
    }
  }

  async validate2FaLogin(userId, methodId, token) {
    const user2FA = await db.User2fa.findByPk(methodId);