server/routes/users.js

   1 // AJAX methods to get, create, update or delete a user
   2
   3 var router = require("express").Router();
   4 var UserModel = require('../models/User');
   5 var sendEmail = require('../utils/mailer');
   6 var genToken = require("../utils/tokenGenerator");
   7 var access = require("../utils/access");
   8 var params = require("../config/parameters");
   9
  10 // to: object user (to who we send an email)
  11 function setAndSendLoginToken(subject, to, res)
  12 {
  13     // Set login token and send welcome(back) email with auth link
  14     const token = genToken(params.token.length);
  15     UserModel.setLoginToken(token, to.id, err => {
  16         if (!!err)
  17             return res.json({errmsg: err.toString()});
  18         const body =
  19             "Hello " + to.name + "!\n" +
  20             "Access your account here: " +
  21             params.siteURL + "/authenticate?token=" + token + "\\n" +
  22             "Token will expire in " + params.token.expire/(1000*60) + " minutes."
  23         sendEmail(params.mail.noreply, to.email, subject, body, err => {
  24
  25       console.log("send login infos ::");
  26       console.log(to);
  27
  28       // "id" is generally the only info missing on client side,
  29             // but the name is also unknown if log-in with the email.
  30             res.json(err || {id: to.id, name: to.name});
  31         });
  32     });
  33 }
  34
  35 router.post('/register', access.unlogged, access.ajax, (req,res) => {
  36     const name = req.body.name;
  37     const email = req.body.email;
  38     const notify = !!req.body.notify;
  39     const error = UserModel.checkNameEmail({name: name, email: email});
  40     if (!!error)
  41         return res.json({errmsg: error});
  42     UserModel.create(name, email, notify, (err,uid) => {
  43         if (!!err)
  44             return res.json({errmsg: err.toString()});
  45         const user = {
  46             id: uid["rowid"],
  47             name: name,
  48             email: email,
  49         };
  50         setAndSendLoginToken("Welcome to " + params.siteURL, user, res);
  51     });
  52 });
  53
  54 router.get('/sendtoken', access.unlogged, access.ajax, (req,res) => {
  55     const nameOrEmail = decodeURIComponent(req.query.nameOrEmail);
  56     const type = (nameOrEmail.indexOf('@') >= 0 ? "email" : "name");
  57     const error = UserModel.checkNameEmail({[type]: nameOrEmail});
  58     if (!!error)
  59         return res.json({errmsg: error});
  60     UserModel.getOne(type, nameOrEmail, (err,user) => {
  61         access.checkRequest(res, err, user, "Unknown user", () => {
  62             setAndSendLoginToken("Token for " + params.siteURL, user, res);
  63         });
  64     });
  65 });
  66
  67 router.get('/authenticate', access.unlogged, (req,res) => {
  68     UserModel.getOne("loginToken", req.query.token, (err,user) => {
  69         access.checkRequest(res, err, user, "Invalid token", () => {
  70             // If token older than params.tokenExpire, do nothing
  71             if (Date.now() > user.loginTime + params.token.expire)
  72                 return res.json({errmsg: "Token expired"});
  73             // Generate session token (if not exists) + destroy login token
  74             UserModel.trySetSessionToken(user.id, (err,token) => {
  75                 if (!!err)
  76                     return res.json({errmsg: err.toString()});
  77                 // Set cookie
  78                 res.cookie("token", token, {
  79                     httpOnly: true,
  80                     secure: !!params.siteURL.match(/^https/),
  81                     maxAge: params.cookieExpire,
  82                 });
  83                 res.redirect("/");
  84             });
  85         });
  86     });
  87 });
  88
  89 router.put('/update', access.logged, access.ajax, (req,res) => {
  90     const name = req.body.name;
  91     const email = req.body.email;
  92     const error = UserModel.checkNameEmail({name: name, email: email});
  93     if (!!error)
  94         return res.json({errmsg: error});
  95     const user = {
  96         id: req.userId,
  97         name: name,
  98         email: email,
  99         notify: !!req.body.notify,
 100     };
 101     UserModel.updateSettings(user, err => {
 102         res.json(err ? {errmsg: err.toString()} : {});
 103     });
 104 });
 105
 106 // Logout on server because the token cookie is httpOnly
 107 router.get('/logout', access.logged, (req,res) => {
 108     res.clearCookie("token");
 109     res.redirect('/');
 110 });
 111
 112 module.exports = router;