feat(invite-friends): obfuscated invite

src/controllers/user.js

@@ -411,7 +411,7 @@ api.cast = function(req, res, next) {
 api.inviteFriends = function(req, res, next) {
   Group.findOne({type:'party', members:{'$in': [res.locals.user._id]}}).select('_id name').exec(function(err,party){
     if (err) return next(err);
-    var link = nconf.get('BASE_URL') + '?' + qs.stringify({partyInvite:{id:party._id, inviter:res.locals.user._id, name:party.name}});
+    var link = nconf.get('BASE_URL')+'?partyInvite='+ utils.encrypt(JSON.stringify({id:party._id, inviter:res.locals.user._id, name:party.name}));
     _.each(req.body.emails, function(invite){
       if (invite.email) {
         var variables = [
@@ -426,17 +426,28 @@ api.inviteFriends = function(req, res, next) {
     res.send(200);
   })
 }
+
 api.sessionPartyInvite = function(req,res,next){
-  if (req.session.partyInvite) {
-    var inv = res.locals.user.invitations;
-    if (!(inv.party && inv.party.id)) {
+  if (!req.session.partyInvite) return next();
+  var inv = res.locals.user.invitations;
+  if (inv.party && inv.party.id) return next(); // already invited to a party
+  async.waterfall([
+    function(cb){
+      Group.findOne({_id:req.session.partyInvite.id, type:'party', members:{$in:[req.session.partyInvite.inviter]}})
+      .select('invites members').exec(cb);
+    },
+    function(group, cb){
+      if (!group) return cb("Inviter not in party");
       inv.party = req.session.partyInvite;
-      Group.update({_id:req.session.partyInvite.id},{$addToSet:{invites:res.locals.user._id}});
       delete req.session.partyInvite;
-      return res.locals.user.save(next);
+      if (!~group.invites.indexOf(res.locals.user._id))
+        group.invites.push(res.locals.user._id); //$addToSt
+      group.save(cb);
+    },
+    function(saved, cb){
+      res.locals.user.save(cb);
     }
-  }
-  next();
+  ], next);
 }
 
 /**

src/middleware.js

@@ -12,7 +12,7 @@ var shared = require('habitrpg-shared');
 var request = require('request');
 var os = require('os');
 var moment = require('moment');
-var qs = require('qs');
+var utils = require('./utils');
 
 module.exports.apiThrottle = function(app) {
   if (nconf.get('NODE_ENV') !== 'production') return;
@@ -200,9 +200,9 @@ module.exports.locals = function(req, res, next) {
   };
 
   // Put query-string party invitations into session to be handled later
-  var partyInvite = qs.parse(req.query.partyInvite);
-  if (partyInvite && partyInvite.id)
-    req.session.partyInvite = partyInvite;
+  try{
+    req.session.partyInvite = JSON.parse(utils.decrypt(req.query.partyInvite))
+  } catch(e){}
 
   next();
 }

src/utils.js

@@ -90,4 +90,19 @@ module.exports.setupConfig = function(){
     require('newrelic');
 
   module.exports.ga = require('universal-analytics')(nconf.get('GA_ID'));
-};
+};
+
+var algorithm = 'aes-256-ctr';
+module.exports.encrypt = function(text){
+  var cipher = crypto.createCipher(algorithm,nconf.get('SESSION_SECRET'))
+  var crypted = cipher.update(text,'utf8','hex')
+  crypted += cipher.final('hex');
+  return crypted;
+}
+
+module.exports.decrypt = function(text){
+  var decipher = crypto.createDecipher(algorithm,nconf.get('SESSION_SECRET'))
+  var dec = decipher.update(text,'hex','utf8')
+  dec += decipher.final('utf8');
+  return dec;
+}