1 let router
= require("express").Router();
2 const UserModel
= require('../models/User');
3 const sendEmail
= require('../utils/mailer');
4 const genToken
= require("../utils/tokenGenerator");
5 const access
= require("../utils/access");
6 const params
= require("../config/parameters");
8 router
.post('/register', access
.unlogged
, access
.ajax
, (req
,res
) => {
9 const name
= req
.body
.name
;
10 const email
= req
.body
.email
;
11 const notify
= !!req
.body
.notify
;
12 if (UserModel
.checkNameEmail({name: name
, email: email
}))
14 UserModel
.create(name
, email
, notify
, (err
,ret
) => {
17 const msg
= err
.code
== "SQLITE_CONSTRAINT"
18 ? "User name or email already in use"
19 : "User creation failed. Try again";
20 res
.json({errmsg: msg
});
29 setAndSendLoginToken("Welcome to " + params
.siteURL
, user
, res
);
36 // NOTE: this method is safe because the sessionToken must be guessed
37 router
.get("/whoami", access
.ajax
, (req
,res
) => {
38 const callback
= (user
) => {
46 const anonymous
= {name:"", email:"", id:0, notify:false};
47 if (!req
.cookies
.token
)
49 else if (req
.cookies
.token
.match(/^[a-z0-9]+$/))
51 UserModel
.getOne("sessionToken", req
.cookies
.token
, (err
, user
) => {
52 callback(user
|| anonymous
);
57 // NOTE: this method is safe because only IDs and names are returned
58 router
.get("/users", access
.ajax
, (req
,res
) => {
59 const ids
= req
.query
["ids"];
60 if (ids
.match(/^([0-9]+,?)+$/)) //NOTE: slightly too permissive
62 UserModel
.getByIds(ids
, (err
,users
) => {
63 res
.json({users:users
});
68 router
.put('/update', access
.logged
, access
.ajax
, (req
,res
) => {
69 const name
= req
.body
.name
;
70 const email
= req
.body
.email
;
71 if (UserModel
.checkNameEmail({name: name
, email: email
}));
77 notify: !!req
.body
.notify
,
79 UserModel
.updateSettings(user
);
84 // Special route to update newsRead timestamp:
85 router
.put('/newsread', access
.logged
, access
.ajax
, (req
,res
) => {
86 UserModel
.setNewsRead(req
.userId
);
90 // Authentication-related methods:
92 // to: object user (to who we send an email)
93 function setAndSendLoginToken(subject
, to
, res
)
95 // Set login token and send welcome(back) email with auth link
96 const token
= genToken(params
.token
.length
);
97 UserModel
.setLoginToken(token
, to
.id
);
99 "Hello " + to
.name
+ " !" + `
101 "Access your account here: " +
102 params
.siteURL
+ "/#/authenticate/" + token
+ `
104 "Token will expire in " + params
.token
.expire
/(1000*60) + " minutes."
105 sendEmail(params
.mail
.noreply
, to
.email
, subject
, body
);
108 router
.get('/sendtoken', access
.unlogged
, access
.ajax
, (req
,res
) => {
109 const nameOrEmail
= decodeURIComponent(req
.query
.nameOrEmail
);
110 const type
= (nameOrEmail
.indexOf('@') >= 0 ? "email" : "name");
111 if (UserModel
.checkNameEmail({[type
]: nameOrEmail
}))
113 UserModel
.getOne(type
, nameOrEmail
, (err
,user
) => {
114 access
.checkRequest(res
, err
, user
, "Unknown user", () => {
115 setAndSendLoginToken("Token for " + params
.siteURL
, user
, res
);
122 router
.get('/authenticate', access
.unlogged
, access
.ajax
, (req
,res
) => {
123 if (!req
.query
.token
.match(/^[a-z0-9]+$/))
124 return res
.json({errmsg: "Bad token"});
125 UserModel
.getOne("loginToken", req
.query
.token
, (err
,user
) => {
126 access
.checkRequest(res
, err
, user
, "Invalid token", () => {
127 // If token older than params.tokenExpire, do nothing
128 if (Date
.now() > user
.loginTime
+ params
.token
.expire
)
129 res
.json({errmsg: "Token expired"});
132 // Generate session token (if not exists) + destroy login token
133 UserModel
.trySetSessionToken(user
.id
, (token
) => {
134 res
.cookie("token", token
, {
136 secure: !!params
.siteURL
.match(/^https/),
137 maxAge: params
.cookieExpire
,
151 router
.get('/logout', access
.logged
, access
.ajax
, (req
,res
) => {
152 res
.clearCookie("token");
156 module
.exports
= router
;