{
+ map[prop] = lang.t('signIn.requiredField');
+ return map;
+ }, {});
+ this.setState({errors});
}
handleChange(e) {
@@ -71,29 +78,23 @@ class SignInContainer extends Component {
validation(name, value) {
const {addError} = this;
const {formData} = this.state;
- const {checkAvailability} = this.props;
if (!value.length) {
- addError(name, 'Please, fill this field');
+ addError(name, lang.t('signIn.requiredField'));
} else if (name === 'confirmPassword' && formData.confirmPassword !== formData.password) {
- addError('confirmPassword', 'Passwords don`t match. Please, check again');
+ addError('confirmPassword', lang.t('signIn.passwordsDontMatch'));
} else if (!validate[name](value)) {
addError(name, errorMsj[name]);
} else {
const { [name]: prop, ...errors } = this.state.errors; // eslint-disable-line
// Removes Error
this.setState(state => ({...state, errors}));
- // Checks Email Availability
- if (name === 'email') {
- debounce(() => checkAvailability({[name]: value}), 200, {'maxWait': 1000})();
- }
}
}
isCompleted() {
const {formData} = this.state;
- const {emailAvailable} = this.props.auth;
- return !Object.keys(formData).filter(prop => !formData[prop].length).length && emailAvailable;
+ return !Object.keys(formData).filter(prop => !formData[prop].length).length;
}
displayErrors(show = true) {
@@ -103,9 +104,13 @@ class SignInContainer extends Component {
handleSignUp(e) {
e.preventDefault();
const {errors} = this.state;
+ const {fetchSignUp, validForm, invalidForm} = this.props;
this.displayErrors();
if (this.isCompleted() && !Object.keys(errors).length) {
- this.props.fetchSignUp(this.state.formData);
+ fetchSignUp(this.state.formData);
+ validForm();
+ } else {
+ invalidForm(lang.t('signIn.checkTheForm'));
}
}
@@ -118,10 +123,6 @@ class SignInContainer extends Component {
this.props.hideSignInDialog();
}
- changeView(view) {
- this.props.changeView(view);
- }
-
render() {
const {auth, showSignInDialog} = this.props;
return (
@@ -147,14 +148,15 @@ const mapStateToProps = state => ({
const mapDispatchToProps = dispatch => ({
facebookCallback: (err, data) => dispatch(facebookCallback(err, data)),
- fetchSignUp: (formData) => dispatch(fetchSignUp(formData)),
- fetchSignIn: (formData) => dispatch(fetchSignIn(formData)),
+ fetchSignUp: formData => dispatch(fetchSignUp(formData)),
+ fetchSignIn: formData => dispatch(fetchSignIn(formData)),
fetchSignInFacebook: () => dispatch(fetchSignInFacebook()),
- fetchForgotPassword: (formData) => dispatch(fetchForgotPassword(formData)),
+ fetchForgotPassword: formData => dispatch(fetchForgotPassword(formData)),
showSignInDialog: () => dispatch(showSignInDialog()),
- changeView: (view) => dispatch(changeView(view)),
+ changeView: view => dispatch(changeView(view)),
handleClose: () => dispatch(hideSignInDialog()),
- checkAvailability: (formData) => dispatch(fetchCheckAvailability(formData))
+ invalidForm: error => dispatch(invalidForm(error)),
+ validForm: () => dispatch(validForm())
});
export default connect(
diff --git a/client/coral-sign-in/translations.js b/client/coral-sign-in/translations.js
index fdf7de0a0..4e1d35805 100644
--- a/client/coral-sign-in/translations.js
+++ b/client/coral-sign-in/translations.js
@@ -16,7 +16,10 @@ export default {
displayName: 'Display Name',
alreadyHaveAnAccount: 'Already have an account?',
recoverPassword: 'Recover password',
- emailInUse: 'Email address already in use'
+ emailInUse: 'Email address already in use',
+ requiredField: 'This field is required',
+ passwordsDontMatch: 'Passwords don\'t match.',
+ checkTheForm: 'Invalid Form. Please, check the fields'
}
},
es: {
@@ -36,7 +39,10 @@ export default {
displayName: 'Nombre',
alreadyHaveAnAccount: 'Ya tienes una cuenta?',
recoverPassword: 'Recuperar contraseña',
- emailInUse: 'Este email se encuentra en uso'
+ emailInUse: 'Este email se encuentra en uso',
+ requiredField: 'Este campo es requerido',
+ passwordsDontMatch: 'Las contraseñas no coinciden',
+ checkTheForm: 'Formulario Inválido. Por favor, completa los campos'
}
}
};
diff --git a/models/setting.js b/models/setting.js
index a35a1aba4..fb35e1eef 100644
--- a/models/setting.js
+++ b/models/setting.js
@@ -1,6 +1,13 @@
const mongoose = require('../mongoose');
const Schema = mongoose.Schema;
+/**
+ * this Schema manages application settings that get used on front- and backend
+ * NOTE: when you set a setting here, it will not automatically be exposed to
+ * the front end. You must add it to the whitelist in the settings route
+ * in /routes/api/settings/index.js
+ * @type {Schema}
+ */
const SettingSchema = new Schema({
id: {type: String, default: '1'},
moderation: {type: String, enum: ['pre', 'post'], default: 'pre'},
diff --git a/models/user.js b/models/user.js
index e38912c8a..0b43ff695 100644
--- a/models/user.js
+++ b/models/user.js
@@ -1,6 +1,7 @@
const mongoose = require('../mongoose');
const uuid = require('uuid');
const bcrypt = require('bcrypt');
+const jwt = require('jsonwebtoken');
// SALT_ROUNDS is the number of rounds that the bcrypt algorithm will run
// through during the salting process.
@@ -18,6 +19,14 @@ const USER_STATUS = [
'banned'
];
+// In the event that the TALK_SESSION_SECRET is missing but we are testing, then
+// set the process.env.TALK_SESSION_SECRET.
+if (process.env.NODE_ENV === 'test' && !process.env.TALK_SESSION_SECRET) {
+ process.env.TALK_SESSION_SECRET = 'keyboard cat';
+} else if (!process.env.TALK_SESSION_SECRET) {
+ throw new Error('TALK_SESSION_SECRET must be defined to encode JSON Web Tokens and other auth functionality');
+}
+
// UserSchema is the mongoose schema defined as the representation of a User in
// MongoDB.
const UserSchema = new mongoose.Schema({
@@ -140,10 +149,14 @@ const UserService = module.exports = {};
* @param {Function} done [description]
*/
UserService.findLocalUser = (email, password) => {
+ if (!email || typeof email !== 'string') {
+ return Promise.reject('email is required for findLocalUser');
+ }
+
return UserModel.findOne({
profiles: {
$elemMatch: {
- id: email,
+ id: email.toLowerCase(),
provider: 'local'
}
}
@@ -247,6 +260,7 @@ UserService.changePassword = (id, password) => {
})
.then((hashedPassword) => {
return UserModel.update({id}, {
+ $inc: {__v: 1},
$set: {
password: hashedPassword
}
@@ -278,6 +292,8 @@ UserService.createLocalUser = (email, password, displayName) => {
return Promise.reject('email is required');
}
+ email = email.toLowerCase();
+
if (!password) {
return Promise.reject('password is required');
}
@@ -306,9 +322,11 @@ UserService.createLocalUser = (email, password, displayName) => {
user.save((err) => {
if (err) {
+ if (err.code === 11000) {
+ return reject('Email address already in use');
+ }
return reject(err);
}
-
return resolve(user);
});
});
@@ -430,6 +448,57 @@ UserService.findByIdArray = (ids) => {
});
};
+/**
+ * Creates a JWT from a user email. Only works for local accounts.
+ * @param {String} email of the local user
+ */
+UserService.createPasswordResetToken = function (email) {
+ if (!email || typeof email !== 'string') {
+ return Promise.reject('email is required when creating a JWT for resetting passord');
+ }
+
+ email = email.toLowerCase();
+
+ return UserModel.findOne({profiles: {$elemMatch: {id: email}}})
+ .then(user => {
+
+ if (user === null) {
+ // since we don't want to reveal that the email does/doesn't exist
+ // just go ahead and resolve the Promise with null and check in the endpoint
+ return Promise.resolve(null);
+ }
+
+ const payload = {email, jti: uuid.v4(), userId: user.id, version: user.__v};
+ const token = jwt.sign(payload, process.env.TALK_SESSION_SECRET, {expiresIn: '1d'});
+
+ return token;
+ });
+};
+
+/**
+ * verifies a jwt and returns the associated user
+ * @param {String} token the JSON Web Token to verify
+ */
+UserService.verifyPasswordResetToken = token => {
+ return new Promise((resolve, reject) => {
+ jwt.verify(token, process.env.TALK_SESSION_SECRET, (error, decoded) => {
+ if (error) {
+ return reject(error);
+ }
+
+ resolve(decoded);
+ });
+ })
+ .then(decoded => {
+ /**
+ * TODO: check the jti from this decoded token in redis
+ * and make an entry if it does not exist.
+ * reject if entry already exists.
+ */
+ return UserService.findById(decoded.userId);
+ });
+};
+
/**
* Finds a user using a value which gets compared using a prefix match against
* the user's email address and/or their display name.
@@ -464,22 +533,6 @@ UserService.search = (value) => {
});
};
-/**
- * Finds users by email and returns the count. The result should be 1 or 0 (bool) indicating email availability
- * @param {String} email to search by
- * @return {Promise}
- */
-UserService.availabilityCheck = (email) => {
- return UserModel.count({
- profiles: {
- $elemMatch: {
- id: email,
- provider: 'local'
- }
- }
- });
-};
-
/**
* Returns a count of the current users.
* @return {Promise}
diff --git a/package.json b/package.json
index d7f04a921..dd9f8db8a 100644
--- a/package.json
+++ b/package.json
@@ -16,13 +16,8 @@
"config": {
"pre-git": {
"commit-msg": [],
- "pre-commit": [
- "npm run lint",
- "npm test"
- ],
- "pre-push": [
- "npm test"
- ],
+ "pre-commit": ["npm run lint", "npm test"],
+ "pre-push": ["npm test"],
"post-commit": [],
"post-merge": []
}
@@ -31,12 +26,7 @@
"type": "git",
"url": "git+https://github.com/coralproject/talk.git"
},
- "keywords": [
- "talk",
- "coral",
- "coralproject",
- "ask"
- ],
+ "keywords": ["talk", "coral", "coralproject", "ask"],
"author": "",
"license": "Apache-2.0",
"bugs": {
@@ -60,6 +50,11 @@
"passport": "^0.3.2",
"passport-facebook": "^2.1.1",
"passport-local": "^1.0.0",
+ "jsonwebtoken": "^7.1.9",
+ "lodash": "^4.16.6",
+ "mongoose": "^4.6.5",
+ "morgan": "^1.7.0",
+ "nodemailer": "^2.6.4",
"prompt": "^1.0.0",
"redis": "^2.6.3",
"uuid": "^2.0.3"
diff --git a/redis.js b/redis.js
index 0f2f211f9..c37fcc64e 100644
--- a/redis.js
+++ b/redis.js
@@ -4,7 +4,7 @@ const url = process.env.TALK_REDIS_URL || 'redis://localhost';
const client = redis.createClient(url, {
retry_strategy: function(options) {
- if (options.error.code === 'ECONNREFUSED') {
+ if (options.error && options.error.code === 'ECONNREFUSED') {
// End reconnecting on a specific error and flush all commands with a individual error
return new Error('The server refused the connection');
@@ -26,10 +26,6 @@ const client = redis.createClient(url, {
}
});
-// client.on('error', (err) => {
-// throw err;
-// });
-
client.ping((err) => {
if (err) {
console.error('Can\'t ping the redis server!');
diff --git a/routes/admin/index.js b/routes/admin/index.js
index 52957f54a..2b967708a 100644
--- a/routes/admin/index.js
+++ b/routes/admin/index.js
@@ -1,11 +1,15 @@
const express = require('express');
-
const router = express.Router();
router.get('/embed/stream/preview', (req, res) => {
res.render('embed-stream', {basePath: '/client/embed/stream'});
});
+router.get('/password-reset/:token', (req, res, next) => {
+ // render a page or something?
+ res.send('ok');
+});
+
router.get('*', (req, res) => {
res.render('admin', {basePath: '/client/coral-admin'});
});
diff --git a/routes/api/settings/index.js b/routes/api/settings/index.js
index 585bf083a..2665cacc8 100644
--- a/routes/api/settings/index.js
+++ b/routes/api/settings/index.js
@@ -1,3 +1,4 @@
+const _ = require('lodash');
const express = require('express');
const router = express.Router();
const Setting = require('../../../models/setting');
@@ -5,7 +6,10 @@ const Setting = require('../../../models/setting');
router.get('/', (req, res, next) => {
Setting
.getSettings()
- .then(settings => res.json(settings))
+ .then(settings => {
+ const whitelist = ['moderation'];
+ res.json(_.pick(settings, whitelist));
+ })
.catch(next);
});
diff --git a/routes/api/user/index.js b/routes/api/user/index.js
index 4e51203ac..96da13406 100644
--- a/routes/api/user/index.js
+++ b/routes/api/user/index.js
@@ -1,6 +1,12 @@
const express = require('express');
const router = express.Router();
const User = require('../../../models/user');
+const mailer = require('../../../services/mailer');
+const ejs = require('ejs');
+const fs = require('fs');
+const path = require('path');
+const resetEmailFile = fs.readFileSync(path.resolve(__dirname, '../../../views/password-reset-email.ejs'));
+const resetEmailTemplate = ejs.compile(resetEmailFile.toString());
router.get('/', (req, res, next) => {
const {
@@ -75,22 +81,67 @@ router.post('/', (req, res, next) => {
});
});
-router.post('/availability', (req, res, next) => {
+/**
+ * expects 2 fields in the body of the request
+ * 1) the token that was in the url of the email link {String}
+ * 2) the new password {String}
+ */
+router.post('/update-password', (req, res, next) => {
+ const {token, password} = req.body;
+
+ User.verifyPasswordResetToken(token)
+ .then(user => {
+ return User.changePassword(user.id, password);
+ })
+ .then(() => {
+ res.status(204).end();
+ })
+ .catch(error => {
+ console.error(error);
+ res.status(401).send('Not Authorized');
+ });
+});
+
+/**
+ * this endpoint takes an email (username) and checks if it belongs to a User account
+ * if it does, create a JWT and send an email
+ */
+router.post('/request-password-reset', (req, res, next) => {
const {email} = req.body;
- if (email) {
- return User.availabilityCheck(email)
- .then(count => {
- if (count) {
- return res.json({status: 'unavailable'});
- }
- return res.json({status: 'available'});
- })
- .catch(err => {
- next(err);
- });
+ if (!email) {
+ return next();
}
- return res.status(404).send('Wrong parameters');
+
+ User
+ .createPasswordResetToken(email)
+ .then(token => {
+ if (token === null) {
+ return Promise.resolve('the email was not found in the db.');
+ }
+
+ const options = {
+ subject: 'Password Reset Requested - Talk',
+ from: 'noreply@coralproject.net',
+ to: email,
+ html: resetEmailTemplate({
+ token,
+ // probably more clear to explicitly pass this
+ rootURL: process.env.TALK_ROOT_URL
+ })
+ };
+ return mailer.sendSimple(options);
+ })
+ .then(() => {
+ // we want to send a 204 regardless of the user being found in the db
+ // if we fail on missing emails, it would reveal if people are registered or not.
+ res.status(204).send('OK');
+ })
+ .catch(error => {
+ const errorMsg = typeof error === 'string' ? error : error.message;
+
+ res.status(500).json({error: errorMsg});
+ });
});
module.exports = router;
diff --git a/services/mailer.js b/services/mailer.js
new file mode 100644
index 000000000..4da8024ca
--- /dev/null
+++ b/services/mailer.js
@@ -0,0 +1,34 @@
+const nodemailer = require('nodemailer');
+
+if (!process.env.TALK_SMTP_CONNECTION_URL) {
+ console.error('TALK_SMTP_CONNECTION_URL should be defined if you would like to send password reset emails from Talk');
+}
+
+const defaultTransporter = nodemailer.createTransport(process.env.TALK_SMTP_CONNECTION_URL);
+
+const mailer = {
+
+ /**
+ * sendSimple
+ *
+ * @param {Object} {from, to, subject, text = '', html = ''}
+ * @returns
+ */
+ sendSimple({from, to, subject, text = '', html = '', transporter = defaultTransporter}) {
+ return new Promise((resolve, reject) => {
+ if (!from) {
+ reject('sendSimple requires a from address');
+ }
+ if (!to) {
+ reject('sendSimple requires a comma-separated list of "to" addresses');
+ }
+ if (!subject) {
+ reject('sendSimple requires a subject for the email');
+ }
+
+ return resolve(transporter.sendMail({from, to, subject, text, html}));
+ });
+ }
+};
+
+module.exports = mailer;
diff --git a/swagger.yaml b/swagger.yaml
index ba945e2e1..16ae9a960 100644
--- a/swagger.yaml
+++ b/swagger.yaml
@@ -162,6 +162,36 @@ paths:
responses:
204:
description: OK
+
+ /user/request-password-reset:
+ post:
+ tags:
+ - Users
+ description: trigger a reset password email. sends a success code whether email was found or no.
+ responses:
+ 204:
+ description: OK
+
+ /user/update-password:
+ post:
+ tags:
+ - Users
+ description: Update existing user password
+ parameters:
+ - name: token
+ type: string
+ in: body
+ description: JSON Web token taken taken from emailed link
+ required: true
+ - name: password
+ type: string
+ in: body
+ description: new password to be settings
+ required: true
+ responses:
+ 204:
+ description: OK
+
/asset:
get:
tags:
@@ -276,7 +306,7 @@ definitions:
description: A summary of the asset, inferred on initial load.
section:
type: string
- description: The section the asset is in.
+ description: The section the asset is in.
subsection:
type: string
description: The subsection that the asset is in.
diff --git a/views/password-reset-email.ejs b/views/password-reset-email.ejs
new file mode 100644
index 000000000..0637b6bb2
--- /dev/null
+++ b/views/password-reset-email.ejs
@@ -0,0 +1,6 @@
+
+We received a request to reset your password. If you did not request this change, you can ignore this email.
+If you did, please click here to reset password.
+<% if (process.env.NODE_ENV !== 'production') { %>
+ <%= token %>
+<% } %>