From 72b5fc9357f0100f4cc560c1430f7ea2d849eb40 Mon Sep 17 00:00:00 2001
From: Jan Tuomi <jan.tuomi@eficode.com>
Date: Wed, 5 Feb 2020 22:31:16 +0200
Subject: Implement account activation

---
 backend/src/authn.js | 60 ++++++++++++++++++++++++++++++++++++++++++++++------
 1 file changed, 53 insertions(+), 7 deletions(-)

(limited to 'backend/src/authn.js')

diff --git a/backend/src/authn.js b/backend/src/authn.js
index 1980aed..52ba862 100644
--- a/backend/src/authn.js
+++ b/backend/src/authn.js
@@ -64,7 +64,7 @@ const authMiddleware = async (req, res, next) => {
 };
 
 const registerRoute = async (req, res) => {
-  const { username, password } = req.body;
+  const { username, password, email } = req.body;
   if (!username || !password) {
     res.status(400);
     return res.json({
@@ -110,16 +110,21 @@ const registerRoute = async (req, res) => {
   const sessionToken = shortid.generate();
   const sessionTokenHash = sha512(salt + sessionToken);
 
-  const user = (await db('users').insert({ username, password: pwHash, salt }).returning('*'))[0];
-  await db('tokens').insert({ user_id: user.id, type: 'session', value: sessionTokenHash });
+  const insertedUsers = await db('users').insert({ username, password: pwHash, email, salt }).returning('*');
+  const user = insertedUsers[0];
+
+  const activationToken = shortid.generate();
+  await db('tokens').insert({ user_id: user.id, type: 'activation', value: activationToken });
 
-  res.set('Set-Cookie', buildSessionCookie({ username, sessionToken, remember: false, isLogout: false }));
+  // await db('tokens').insert({ user_id: user.id, type: 'session', value: sessionTokenHash });
+  // res.set('Set-Cookie', buildSessionCookie({ username, sessionToken, remember: false, isLogout: false }));
 
   await consoleBackend.send({
     recipients: [ username ],
     subject: `Welcome to the service, ${username}!`,
-    body: `Welcome.\n\nLog in at http://localhost:3000.\n\nBR,\nTeam`,
+    body: `Welcome.\n\nActivate your account at http://localhost:3000/activate/${activationToken}.\n\nBR,\nTeam`,
   });
+
   return res.json({
     username,
   });
@@ -135,10 +140,17 @@ const loginRoute = async (req, res) => {
   }
 
   const user = await db('users').where({ username }).first();
+  if (!user) {
+    res.status(400);
+    res.json({
+      error: 'Wrong username or password',
+    });
+  }
+
   const salt = user.salt;
   const pwHash = sha512(salt + password);
 
-  if (!user || pwHash !== user.password) {
+  if (pwHash !== user.password) {
     res.status(400);
     res.json({
       error: 'Wrong username or password',
@@ -150,7 +162,7 @@ const loginRoute = async (req, res) => {
 
   await db('tokens').insert({ user_id: user.id, type: 'session', value: sessionTokenHash });
 
-  res.set('Set-Cookie', buildSessionCookie({ username, sessionToken, remember, isLogout: false }));
+  res.set('Set-Cookie', buildSessionCookie({ username, sessionToken, isLogout: false }));
 
   return res.json({
     username,
@@ -164,10 +176,44 @@ const logoutRoute = async (req, res) => {
   res.send();
 };
 
+const activateRoute = async (req, res) => {
+  const { activationToken } = req.body;
+  if (!activationToken) {
+    res.status(400);
+    return res.json({
+      error: 'Missing or invalid activation token.',
+    });
+  }
+
+  const tokenObj = await db('tokens').where({ type: 'activation', value: activationToken }).first();
+  if (!tokenObj) {
+    res.status(400);
+    return res.json({
+      error: 'Missing or invalid activation token.',
+    });
+  }
+
+  const updatedUsers = await db('users').where({ id: tokenObj.user_id }).update({ activated: true }).returning('*');
+  const user = updatedUsers[0];
+  await db('tokens').where({ type: 'activation', value: activationToken }).delete();
+
+  const { username } = user;
+  const sessionToken = shortid.generate();
+  const sessionTokenHash = sha512(user.salt + sessionToken);
+
+  await db('tokens').insert({ user_id: user.id, type: 'session', value: sessionTokenHash });
+
+  res.set('Set-Cookie', buildSessionCookie({ username, sessionToken, isLogout: false }));
+  return res.json({
+    username,
+  });
+};
+
 module.exports = {
   buildSessionCookie,
   authMiddleware,
   registerRoute,
   loginRoute,
   logoutRoute,
+  activateRoute,
 };
-- 
cgit v1.3