1+ import APIError from '../helpers/APIError' ;
2+ import httpStatus from 'http-status' ;
13import User from '../models/user.model' ;
4+ import _ from 'lodash' ;
25
36/**
47 * Load user and append to req.
58 */
69function load ( req , res , next , id ) {
710 User . get ( id )
811 . then ( ( user ) => {
9- req . user = user ; // eslint-disable-line no-param-reassign
12+ delete user . password ;
13+ req . userLoaded = user ; // eslint-disable-line no-param-reassign
1014 return next ( ) ;
1115 } )
1216 . catch ( e => next ( e ) ) ;
1317}
14-
1518/**
16- * Get user
19+ * Get currently logged in user
1720 * @returns {User }
1821 */
19- function get ( req , res ) {
20- return res . json ( req . user ) ;
22+ function me ( req , res , next ) {
23+ User . get ( req . user . _id )
24+ . then ( ( user ) => {
25+ user . password = null ;
26+ return res . json ( user ) ;
27+ } )
28+ . catch ( e => {
29+ return next ( err ) ;
30+ } ) ;
2131}
2232
33+ // TODO: maybe a quick version of me that only loads a shallow verison of
34+ // user id
35+
2336/**
24- * Create new user
25- * @property {string } req.body.username - The username of user.
26- * @property {string } req.body.mobileNumber - The mobileNumber of user.
37+ * Get user
2738 * @returns {User }
2839 */
29- function create ( req , res , next ) {
30- const user = new User ( {
31- username : req . body . username ,
32- mobileNumber : req . body . mobileNumber
33- } ) ;
34-
35- user . save ( )
36- . then ( savedUser => res . json ( savedUser ) )
37- . catch ( e => next ( e ) ) ;
40+ function get ( req , res ) {
41+ return res . json ( req . userLoaded ) ;
3842}
3943
4044/**
@@ -44,37 +48,33 @@ function create(req, res, next) {
4448 * @returns {User }
4549 */
4650function update ( req , res , next ) {
47- const user = req . user ;
48- user . username = req . body . username ;
49- user . mobileNumber = req . body . mobileNumber ;
50-
51- user . save ( )
52- . then ( savedUser => res . json ( savedUser ) )
53- . catch ( e => next ( e ) ) ;
54- }
55-
56- /**
57- * Get user list.
58- * @property {number } req.query.skip - Number of users to be skipped.
59- * @property {number } req.query.limit - Limit number of users to be returned.
60- * @returns {User[] }
61- */
62- function list ( req , res , next ) {
63- const { limit = 50 , skip = 0 } = req . query ;
64- User . list ( { limit, skip } )
65- . then ( users => res . json ( users ) )
66- . catch ( e => next ( e ) ) ;
67- }
68-
69- /**
70- * Delete user.
71- * @returns {User }
72- */
73- function remove ( req , res , next ) {
74- const user = req . user ;
75- user . remove ( )
76- . then ( deletedUser => res . json ( deletedUser ) )
77- . catch ( e => next ( e ) ) ;
78- }
51+ const user = req . userLoaded ;
52+ const username = req . body . username ;
53+ // We gotta check a few things:
54+ // First we make sure we are the actual user we are modifying.
55+ if ( ! req . user || user . _id != req . user . _id ) {
56+ let err = new APIError ( 'Not enough permissions to modify that user.' , httpStatus . UNAUTHORIZED , true ) ; //eslint-disable-line
57+ return next ( err ) ;
58+ }
59+ // Next we are making sure the username doens't already exist:
60+ User . findOne ( { username } )
61+ . exec ( )
62+ . then ( ( _user ) => {
63+ if ( _user && _user . id != user . id ) {
64+ let err = new APIError ( 'User already exists.' , httpStatus . UNAUTHORIZED , true ) ; //eslint-disable-line
65+ return next ( err ) ;
66+ }
67+ // Using _.pick to only get a few properties:
68+ // otherwise user can set themselves to verified, etc :)
69+ const newValues = _ . pick ( req . body , User . updatableFields ) ;
70+ Object . assign ( user , newValues ) ;
71+ delete user . password ;
72+ user . save ( ) ;
73+ delete user . password ; // Why doesn't this work?
74+ user . password = null ;
75+ res . json ( user ) ;
76+ } )
77+ . catch ( e => next ( e ) ) ;
78+ }
7979
80- export default { load, get, create , update, list , remove } ;
80+ export default { load, get, me , update} ;
0 commit comments