Kai/habitica
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #6274 from crookedneighbor/api-v3-user-local-spike

Browse Source 
Api v3 user local spike
This commit is contained in:
Matteo Pagliazzi
2015-11-22 11:59:28 +01:00
parent 7ce554c578 867efd7078
commit dcfd7eb6d0
2 changed files with 35 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
website/src/controllers/api-v3/user.js
+35 -29
View File
@@ -20,7 +20,7 @@ let api = {};
* @apiParam {String} username Username of the new user
* @apiParam {String} email Email address of the new user
* @apiParam {String} password Password for the new user account
* @apiParam {String} passwordConfirmation Password confirmation
* @apiParam {String} confirmPassword Password confirmation
*
* @apiSuccess {Object} user The user object
*/
@@ -28,32 +28,19 @@ api.registerLocal = {
method: 'POST',
url: '/user/auth/local/register',
handler (req, res, next) {
let email = req.body.email && req.body.email.toLowerCase();
let username = req.body.username;
let { email, username, password, confirmPassword } = req.body;
// Validate required params
if (!username) return next(new NotAuthorized(res.t('missingUsername')));
if (!email) return next(new NotAuthorized(res.t('missingEmail')));
if (!validator.isEmail(email)) return next(new NotAuthorized(res.t('invalidEmail')));
if (!password) return next(new NotAuthorized(res.t('missingPassword')));
if (password !== confirmPassword) return next(new NotAuthorized(res.t('passwordConfirmationMatch')));
// Get the lowercase version of username to check that we do not have duplicates
// So we can search for it in the database and then reject the choosen username if 1 or more results are found
let lowerCaseUsername = username && username.toLowerCase();
let newUser = new User({
auth: {
local: {
username,
lowerCaseUsername, // Store the lowercase version of the username
email, // Store email as lowercase
salt: passwordUtils.makeSalt(),
password: req.body.password,
passwordConfirmation: req.body.passwordConfirmation,
},
},
preferences: {
language: req.language,
},
});
newUser.registeredThrough = req.headers['x-client']; // TODO is this saved somewhere?
let validationErrors = newUser.validateSync(); // Validate synchronously for speed, remove if we add any async validator
if (validationErrors) return next(validationErrors);
email = email.toLowerCase();
let lowerCaseUsername = username.toLowerCase();
// Search for duplicates using lowercase version of username
User.findOne({$or: [
@@ -63,11 +50,30 @@ api.registerLocal = {
.exec()
.then((user) => {
if (user) {
if (email === user.auth.local.email) return next(new NotAuthorized(res.t('emailTaken')));
if (email === user.auth.local.email) throw new NotAuthorized(res.t('emailTaken'));
// Check that the lowercase username isn't already used
if (lowerCaseUsername === user.auth.local.lowerCaseUsername) return next(new NotAuthorized(res.t('usernameTaken')));
if (lowerCaseUsername === user.auth.local.lowerCaseUsername) throw new NotAuthorized(res.t('usernameTaken'));
}
let salt = passwordUtils.makeSalt();
let hashed_password = passwordUtils.encrypt(password, salt); // eslint-disable-line camelcase
let newUser = new User({
auth: {
local: {
username,
lowerCaseUsername,
email,
salt,
hashed_password, // eslint-disable-line camelcase
},
},
preferences: {
language: req.language,
},
});
newUser.registeredThrough = req.headers['x-client']; // TODO is this saved somewhere?
return newUser.save();
})
.then((savedUser) => {
@@ -75,8 +81,8 @@ api.registerLocal = {
// Clean previous email preferences
EmailUnsubscription
.remove({email: savedUser.auth.local.email})
.then(() => sendTxnEmail(savedUser, 'welcome'));
.remove({email: savedUser.auth.local.email})
.then(() => sendTxnEmail(savedUser, 'welcome'));
res.analytics.track('register', {
category: 'acquisition',
website/src/models/user.js
-44
View File
@@ -1,7 +1,6 @@
// User schema and model
import mongoose from 'mongoose';
import shared from '../../../common';
import passwordUtils from '../libs/api-v3/password';
import _ from 'lodash';
import validator from 'validator';
import moment from 'moment';
@@ -42,15 +41,6 @@ export let schema = new Schema({
lowerCaseUsername: String,
hashed_password: String, // eslint-disable-line camelcase
salt: String,
// password and passwordConfirmation are not stored in the database, used only for validation
password: {
type: String,
trim: true,
},
passwordConfirmation: {
type: String,
trim: true,
},
},
timestamps: {
created: {type: Date, default: Date.now},
@@ -609,41 +599,7 @@ function _setProfileName (user) {
return localUsername || facebookUsername || anonymous;
}
schema.pre('validate', function beforeValidateUser (next) {
if (!this.auth.facebook.id || this.auth.local.email || this.auth.local.username) {
if (!this.auth.local.email) {
this.invalidate('auth.local.email', shared.i18n.t('missingEmail'));
return next();
}
if (!this.auth.local.username) {
this.invalidate('auth.local.username', shared.i18n.t('missingUsername'));
return next();
}
}
// Validate password and password confirmation and create hashed version
if (this.isModified('auth.local.password') || this.isNew() && !this.auth.facebook.id) { // TODO this does not catch when you already have social auth and password isn't passedß
if (!this.auth.local.password) {
this.invalidate('auth.local.password', shared.i18n.t('missingPassword'));
return next();
}
if (this.auth.local.password !== this.auth.local.passwordConfirmation) {
this.invalidate('auth.local.passwordConfirmation', shared.i18n.t('passwordConfirmationMatch'));
return next();
}
this.hashed_password = passwordUtils.encrypt(this.auth.local.password, this.auth.local.salt); // eslint-disable-line camelcase
}
next();
});
schema.pre('save', function postSaveUser (next) {
// Do not store password and passwordConfirmation
this.auth.local.password = this.local.auth.passwordConfirmation = undefined;
// Populate new users with default content
if (this.isNew) {
_populateDefaultsForNewUser(this);