routes/users.js

   1 var router = require("express").Router();
   2 var UserModel = require('../models/User');
   3 var sendEmail = require('../utils/mailer');
   4 var TokenGen = require("../utils/tokenGenerator");
   5 var access = require("../utils/access");
   6 var params = require("../config/parameters");
   7 var checkNameEmail = require("../public/javascripts/shared/userCheck")
   8
   9 // to: object user
  10 function setAndSendLoginToken(subject, to, res)
  11 {
  12     // Set login token and send welcome(back) email with auth link
  13     let token = TokenGen.generate(params.token.length);
  14     UserModel.setLoginToken(token, to._id, (err,ret) => {
  15         access.checkRequest(res, err, ret, "Cannot set login token", () => {
  16             const body =
  17                 "Hello " + to.name + "!\n" +
  18                 "Access your account here: " +
  19                 params.siteURL + "/authenticate?token=" + token + "\\n" +
  20                 "Token will expire in " + params.token.expire/(1000*60) + " minutes."
  21             sendEmail(params.mail.from, to.email, subject, body, err => {
  22                 res.json(err || {});
  23             });
  24         });
  25     });
  26 }
  27
  28 // AJAX user life cycle...
  29
  30 router.post('/register', access.unlogged, access.ajax, (req,res) => {
  31     const name = req.body.name;
  32     const email = req.body.email;
  33     const notify = !!req.body.notify;
  34     const error = checkNameEmail({name: name, email: email});
  35     if (!!error)
  36         return res.json({errmsg: error});
  37     UserModel.create(name, email, notify, (err,user) => {
  38         access.checkRequest(res, err, user, "Registration failed", () => {
  39             setAndSendLoginToken("Welcome to " + params.siteURL, user, res);
  40         });
  41     });
  42 });
  43
  44 router.get('/sendtoken', access.unlogged, access.ajax, (req,res) => {
  45     const nameOrEmail = decodeURIComponent(req.query.nameOrEmail);
  46     const type = (nameOrEmail.indexOf('@') >= 0 ? "email" : "name");
  47     const error = checkNameEmail({[type]: nameOrEmail});
  48     if (!!error)
  49         return res.json({errmsg: error});
  50     UserModel.getOne(type, nameOrEmail, (err,user) => {
  51         access.checkRequest(res, err, user, "Unknown user", () => {
  52             setAndSendLoginToken("Token for " + params.siteURL, user, res);
  53         });
  54     });
  55 });
  56
  57 router.get('/authenticate', access.unlogged, (req,res) => {
  58     UserModel.getByLoginToken(req.query.token, (err,user) => {
  59         access.checkRequest(res, err, user, "Invalid token", () => {
  60             // If token older than params.tokenExpire, do nothing
  61             if (Date.now() > user.loginTime + params.token.expire)
  62                 return res.json({errmsg: "Token expired"});
  63             // Generate session token (if not exists) + destroy login token
  64             UserModel.trySetSessionToken(user._id, (err,token) => {
  65                 if (!!err)
  66                     return res.json(err);
  67                 // Set cookie
  68                 res.cookie("token", token, {
  69                     httpOnly: true,
  70                     secure: true,
  71                     maxAge: params.cookieExpire
  72                 });
  73                 res.redirect("/");
  74             });
  75         });
  76     });
  77 });
  78
  79 router.put('/settings', access.logged, access.ajax, (req,res) => {
  80     let user = JSON.parse(req.body.user);
  81     const error = checkNameEmail({name: user.name, email: user.email});
  82     if (!!error)
  83         return res.json({errmsg: error});
  84     user.notify = !!user.notify; //in case of...
  85     user._id = res.locals.user._id; //in case of...
  86     UserModel.updateSettings(user, (err,ret) => {
  87         access.checkRequest(res, err, ret, "Settings update failed", () => {
  88             res.json({});
  89         });
  90     });
  91 });
  92
  93 // Logout on server because the token cookie is secured + http-only
  94 router.get('/logout', access.logged, (req,res) => {
  95     res.clearCookie("token");
  96     res.redirect('/');
  97 });
  98
  99 module.exports = router;