server/routes/users.js

   1 // AJAX methods to get, create, update or delete a user
   2
   3 var router = require("express").Router();
   4 var UserModel = require('../models/User');
   5 var sendEmail = require('../utils/mailer');
   6 var genToken = require("../utils/tokenGenerator");
   7 var access = require("../utils/access");
   8 var params = require("../config/parameters");
   9 var checkNameEmail = require("../data/userCheck")
  10
  11 // to: object user (to who we send an email)
  12 function setAndSendLoginToken(subject, to, res)
  13 {
  14     // Set login token and send welcome(back) email with auth link
  15     const token = genToken(params.token.length);
  16     UserModel.setLoginToken(token, to.id, err => {
  17         if (!!err)
  18             return res.json({errmsg: err.toString()});
  19         const body =
  20             "Hello " + to.name + "!\n" +
  21             "Access your account here: " +
  22             params.siteURL + "/authenticate?token=" + token + "\\n" +
  23             "Token will expire in " + params.token.expire/(1000*60) + " minutes."
  24         sendEmail(params.mail.noreply, to.email, subject, body, err => {
  25             // "id" is generally the only info missing on client side,
  26             // but the name is also unknown if log-in with the email.
  27             res.json(err || {id: to.id, name: to.name});
  28         });
  29     });
  30 }
  31
  32 router.post('/register', access.unlogged, access.ajax, (req,res) => {
  33     const name = req.body.name;
  34     const email = req.body.email;
  35     const notify = !!req.body.notify;
  36     const error = checkNameEmail({name: name, email: email});
  37     if (!!error)
  38         return res.json({errmsg: error});
  39     UserModel.create(name, email, notify, (err,uid) => {
  40         if (!!err)
  41             return res.json({errmsg: err.toString()});
  42         const user = {
  43             id: uid["rowid"],
  44             name: name,
  45             email: email,
  46         };
  47         setAndSendLoginToken("Welcome to " + params.siteURL, user, res);
  48     });
  49 });
  50
  51 router.get('/sendtoken', access.unlogged, access.ajax, (req,res) => {
  52     const nameOrEmail = decodeURIComponent(req.query.nameOrEmail);
  53     const type = (nameOrEmail.indexOf('@') >= 0 ? "email" : "name");
  54     const error = checkNameEmail({[type]: nameOrEmail});
  55     if (!!error)
  56         return res.json({errmsg: error});
  57     UserModel.getOne(type, nameOrEmail, (err,user) => {
  58         access.checkRequest(res, err, user, "Unknown user", () => {
  59             setAndSendLoginToken("Token for " + params.siteURL, user, res);
  60         });
  61     });
  62 });
  63
  64 router.get('/authenticate', access.unlogged, (req,res) => {
  65     UserModel.getOne("loginToken", req.query.token, (err,user) => {
  66         access.checkRequest(res, err, user, "Invalid token", () => {
  67             // If token older than params.tokenExpire, do nothing
  68             if (Date.now() > user.loginTime + params.token.expire)
  69                 return res.json({errmsg: "Token expired"});
  70             // Generate session token (if not exists) + destroy login token
  71             UserModel.trySetSessionToken(user.id, (err,token) => {
  72                 if (!!err)
  73                     return res.json({errmsg: err.toString()});
  74                 // Set cookie
  75                 res.cookie("token", token, {
  76                     httpOnly: true,
  77                     secure: !!params.siteURL.match(/^https/),
  78                     maxAge: params.cookieExpire,
  79                 });
  80                 res.redirect("/");
  81             });
  82         });
  83     });
  84 });
  85
  86 router.put('/update', access.logged, access.ajax, (req,res) => {
  87     const name = req.body.name;
  88     const email = req.body.email;
  89     const error = checkNameEmail({name: name, email: email});
  90     if (!!error)
  91         return res.json({errmsg: error});
  92     const user = {
  93         id: req.userId,
  94         name: name,
  95         email: email,
  96         notify: !!req.body.notify,
  97     };
  98     UserModel.updateSettings(user, err => {
  99         res.json(err ? {errmsg: err.toString()} : {});
 100     });
 101 });
 102
 103 // Logout on server because the token cookie is httpOnly
 104 router.get('/logout', access.logged, (req,res) => {
 105     res.clearCookie("token");
 106     res.redirect('/');
 107 });
 108
 109 module.exports = router;