Posting Authority check before logging in

src/repositories/hive/hive.repository.ts

@@ -148,4 +148,18 @@ export class HiveRepository {
       PrivateKey.fromString(process.env.DELEGATED_ACCOUNT_POSTING),
     )
   }
+
+  async verifyPostingAuth(account: any) {
+    let doWe = false
+    if (Array.isArray(account.posting.account_auths)) {
+      account.posting.account_auths.forEach(function (item) {
+        if (item[0] === 'threespeak') {
+          doWe = true
+        }
+      })
+      return doWe
+    } else {
+      return false
+    }
+  }
 }

src/services/auth/auth.controller.ts

@@ -63,7 +63,17 @@ export class AuthController {
         this.hiveRepository.verifyHiveMessage(cryptoUtils.sha256(JSON.stringify(proof_payload)), body.proof, accountDetails) &&
         new Date(proof_payload.ts) > moment().subtract('1', 'minute').toDate() //Extra safety to prevent request reuse
       ) {
-        return await this.authService.authenticateUser(proof_payload.account)
+        if (this.hiveRepository.verifyPostingAuth(accountDetails)) {
+          return await this.authService.authenticateUser(proof_payload.account)
+        } else {
+          throw new HttpException(
+            {
+              reason: `Hive Account @${proof_payload.account} has not granted posting authority to @threespeak`,
+              errorType: "MISSING_POSTING_AUTHORITY"
+            },
+            HttpStatus.BAD_REQUEST,
+          )
+        }
       } else {
         throw new HttpException(
           {