function asflogin()

in custom/asf.js [74:115]

• 39 lines of code
• 10 McCabe index (conditional complexity)

function asflogin (req, res) {
    sess = req.session;
    if (req.query.code) {
	const userinfo_endpoint= 'https://oauth.apache.org/token'
	uri = userinfo_endpoint+"?code="+req.query.code
	request(uri, {json:true},(err,cbres,body) => {
	    if (err) {res.send(err);}
	    else if (cbres.statusCode != 200) {res.send(body);}
	    else if (body.state != sess.state) { res.send("auth is broken") }
	    else {
		pmcs = body.pmcs;
		for (i=0; i< body.projects.length; i++) {
		    if (!pmcs.includes(body.projects[i])) {
			// we're a committer to project, but not in the PMC
			if (conf.pmcswithsecurityemails.includes(body.projects[i])|| body.projects[i] == "security") {
			    // but this project has a security list
			    console.log("User "+body.uid+" is committer to "+body.projects[i]+" but not PMC, allowed");
			    pmcs.push(body.projects[i]);
			} else {
			    console.log("User "+body.uid+" is committer to "+body.projects[i]+" but not PMC, ignored");
			}
		    }
		}  
		sess.user = {username:body.uid, email:body.email, name:body.fullname, pmcs:pmcs};
		//sess.user = {username:body.uid, email:body.email, name:body.fullname, pmcs:["airflow"]};		
		if (sess.returnTo) {
		    res.redirect(req.session.returnTo);
		    delete req.session.returnTo;
		} else {
		    res.redirect("/");
		}
		console.log(body);
	    }
	});
    } else {
	delete  sess.user;
	sess.state = uuidv4();
	const authorization_endpoint= 'https://oauth.apache.org/auth'
	redirecturl = authorization_endpoint+"?state="+sess.state+"&redirect_uri=https://"+req.get('host')+req.originalUrl;
	res.redirect(redirecturl)
    }
}