transactions-express-passport/lib/signup.js

'use strict';

Object.defineProperty(exports, "__esModule", {
  value: true
});
exports.checkEmailExists = checkEmailExists;
exports.generateUserId = generateUserId;
exports.generateActivationHash = generateActivationHash;
exports.generateHash = generateHash;
exports.formatUserForFrontend = formatUserForFrontend;
exports.useSignup = useSignup;

var _bcryptNodejs = require('bcrypt-nodejs');

var _bcryptNodejs2 = _interopRequireDefault(_bcryptNodejs);

var _mongodb = require('mongodb');

var _passport = require('passport');

var _passport2 = _interopRequireDefault(_passport);

var _passportLocal = require('passport-local');

var _shortid = require('shortid');

var _shortid2 = _interopRequireDefault(_shortid);

var _jwt = require('./jwt');

function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }

// from: http://stackoverflow.com/a/46181
// NOTE: is it good enough?
/* eslint-disable */
var VALID_EMAIL_REGEXP = /^(([^<>()\[\]\.,;:\s@\"]+(\.[^<>()\[\]\.,;:\s@\"]+)*)|(\".+\"))@(([^<>()[\]\.,;:\s@\"]+\.)+[^<>()[\]\.,;:\s@\"]{2,})$/i;
var MIN_PASSWORD_LENGTH = 6;
var globalUserFields = [];

function checkEmailExists(email, usersCollection) {
  return new Promise(function (resolve) {
    usersCollection.findOne({ 'local.email': email }).then(function (existingUser) {
      resolve(!!existingUser);
    });
  });
}

function generateUserId() {
  return 'user_' + _shortid2.default.generate();
}

// hack to create a longer id here (without additional dependency),
// to decrease likelyhood that someone can guess/bruteforce the id
function generateActivationHash() {
  return _shortid2.default.generate() + _shortid2.default.generate();
}

function generateHash(password) {
  return new Promise(function (resolve, reject) {
    _bcryptNodejs2.default.genSalt(8, function (err, result) {
      if (err) {
        reject(err);
        return;
      }
      return resolve(result);
    });
  }).then(function (salt) {
    return new Promise(function (resolve, reject) {
      _bcryptNodejs2.default.hash(password, salt, null, function (err, hashed) {
        if (err) {
          reject(err);
          return;
        }
        return resolve(hashed);
      });
    });
  });
}

function formatUserForFrontend(user) {
  // create a modified user object to return to frontend
  // NOTE: we assume it was a local user sign in, i.e. not via oauth
  var userCopy = Object.assign({}, user.local, {
    id: user.id,
    active: user.active,
    admin: user.admin,
    slug: user.slug
  });
  delete userCopy.password;
  delete userCopy.passwordResetToken;
  // also delete in local
  return userCopy;
}

function useSignup(app, config) {
  // unpack
  var createJWTforUser = config.createJWTforUser,
      db = config.db,
      getUserSlug = config.getUserSlug,
      isAdmin = config.isAdmin,
      logger = config.logger,
      _config$mailer = config.mailer,
      accountName = _config$mailer.accountName,
      activationRoute = _config$mailer.activationRoute,
      senderName = _config$mailer.senderName,
      projectName = _config$mailer.projectName,
      send = _config$mailer.send,
      senderMail = _config$mailer.senderMail,
      requiredFields = config.requiredFields,
      routePath = config.routePath;
  // users

  var usersCollection = db.collection('users');
  // passport hook
  function signupUser(signupData, usersCollection) {
    return new Promise(function (resolve, reject) {
      // any existing user with this email?
      checkEmailExists(signupData.email, usersCollection).then(function (emailExists) {
        if (emailExists) {
          logger.debug('signupUser: email already existed');
          reject(new Error('USER_EMAIL_ALREADY_TAKEN'));
        } else {
          logger.debug('signupUser: this email is new');
        }
        // validate the new user
        return new Promise(function (resolve) {
          var validationError = validateUserSignup(signupData);
          if (validationError) {
            reject(validationError);
            return;
          }
          resolve(signupData);
        });
      }).then(function (validated) {
        if (!validated) return;
        // new signup
        var newUser = {
          id: generateUserId(),
          // id: ObjectId(),
          created_at: Date.now(),
          activationHash: generateActivationHash(),
          active: false,
          local: Object.keys(signupData)
          // TODO: in future, probably invert logic - explicitly list what should go into local,
          // and the rest goes globally at root level on new user object
          .reduce(function (newUserLocal, key) {
            // for now just drop empty fields (''),
            // and fields that go globally on user
            if (signupData[key].length && !globalUserFields.includes(key)) {
              newUserLocal[key] = signupData[key];
            }
            return newUserLocal;
          }, {}),
          // it is a slug helpful for retrieving the user via an url
          slug: getUserSlug(signupData)
        };
        return newUser;
      }).then(function (validatedNewUser) {
        if (!validatedNewUser) return;
        // hash the password
        // NOTE: we do this after validation, so we catch short passwords first
        return generateHash(signupData.password).then(function (hashedPassword) {
          validatedNewUser.local.password = hashedPassword;
          return validatedNewUser;
        });
      }).then(function (newUserWithHashedPassword) {
        if (!newUserWithHashedPassword) return;
        // save user and return
        return usersCollection.insertOne(newUserWithHashedPassword).then(function () {
          // DONE
          resolve(newUserWithHashedPassword);
        });
      });
    });
  }
  // NOTE: only returning first error, not all..
  // all modern browsers except Safari should catch the errors in browser.
  function validateUserSignup(user) {
    if (!VALID_EMAIL_REGEXP.test(user.email)) {
      return new Error('Please enter a valid email');
    }
    if (user.password.length < MIN_PASSWORD_LENGTH) {
      return new Error('Password must be at least 6 characters long');
    }
    var error = void 0;
    requiredFields.forEach(function (field) {
      if (!user[field] || user[field].trim().length === 0) {
        error = new Error(field + ' is required');
        return;
      }
    });
    return error;
  }
  function sendActivationEmail(email, activationHash) {
    var activationUrl = activationRoute + '=' + activationHash;
    var mailerConfig = {
      from: projectName + ' <' + senderMail + '>',
      to: email,
      subject: 'Confirm your ' + accountName + ' account',
      html: '<h1>Account confirmation</h1>\n        <p>Thanks for signing up.</p>\n        <p>Please click on the following link to activate your ' + accountName + ' account:</p>\n        <p><a href="' + activationUrl + '">' + activationUrl + '</a></p>\n        <br />\n        <p>If you did not create this account, please ignore it and the created account will be deleted.<p>\n        <br />\n        <p>If clicking the link above does not work, please copy and paste the URL into a new browser window instead.<p>\n        <br />\n        <p>If you have any questions or problems, please let us know by repling to this email.<p>\n        <p>Thanks,\n        ' + senderName + ' from ' + projectName + '</p>\n      '
    };
    send(mailerConfig).catch(function (err) {
      logger.warn('[unhandled] ERROR in sendActivationEmail:', err);
    });
  }

  // (local) SIGNUP
  // serialize
  // used for serializing the user for the session
  _passport2.default.serializeUser(function (user, done) {
    done(null, user.id);
  });
  // de-serializing
  _passport2.default.deserializeUser(function (id, done) {
    usersCollection.findOne({ id: id }).then(function (user) {
      if (!user) {
        done(null, false);
        return;
      }
      var formattedUser = formatUserForFrontend(user);
      // add auth token, for api access
      if (!user.authToken || !user.authTokenExpiry) {
        var jwtConfig = createJWTforUser(formattedUser);
        formattedUser.authToken = jwtConfig.token;
        formattedUser.authTokenExpiry = jwtConfig.expiry;
      }
      done(null, formattedUser);
    }).catch(done);
  });
  _passport2.default.use('local-signup', new _passportLocal.Strategy({
    usernameField: 'email',
    passwordField: 'password',
    passReqToCallback: true // get access to full request in callback
  }, function (req, email, password, done) {
    // store the pushed data so we can keep the form populated in case of failure
    req.flash('signupBody', req.body);
    signupUser(req.body, usersCollection).then(function (finalUser) {
      // NOTE: sending this email is async; not blocking on this.
      sendActivationEmail(email, finalUser.activationHash);
      // done
      done(null, finalUser);
      return;
    }).catch(function (err) {
      if (err.message === 'USER_EMAIL_ALREADY_TAKEN') {
        done(null, false, req.flash('signupMessage', 'That email is already taken.'));
      }
      // TODO: handle this error!
      logger.warn('[unhandled] ERROR in handleSignup:', err);
      // done(null, false, req.flash('signup', validationError.message))
      done(null, false, req.flash('signupMessage', err.message || 'Signup failed.'));
    });
  }));
  // apis
  app.post(routePath + '/signup', _passport2.default.authenticate('local-signup', {
    successRedirect: '/',
    failureRedirect: '/signup',
    failureFlash: true // allow flash messages
  }));
  // if some server problem causes user to try to
  // reach these endpoints via GET requests from browser
  app.get(routePath + '/signup', function (req, res) {
    return res.redirect('/');
  });
  // activate
  app.post(routePath + '/activate-account', function (req, res) {
    var code = req.body.code;

    if (!code) {
      res.json({ error: 'Activation code required.' });
      return;
    }
    usersCollection.findOneAndUpdate({ activationHash: code }, { $set: {
        active: true,
        admin: isAdmin(req.user)
      } },
    // return updated
    { returnOriginal: false }).then(function (_ref) {
      var user = _ref.value;

      if (!user) {
        res.json({ error: 'Invalid activation code' });
        return;
      }
      res.json({ user: formatUserForFrontend(user) });
    }).catch(function (err) {
      res.json({ error: err.message });
      return;
    });
  });
  // reactivate
  app.get(routePath + '/ask-activate-account', function (req, res) {
    usersCollection.findOne({
      id: req.user.id
    }).then(function (_ref2) {
      var activationHash = _ref2.activationHash,
          email = _ref2.local.email;

      sendActivationEmail(email, activationHash);
      res.json({
        text: 'We sent you an email to ' + email
      });
    });
  });
}