Initial Commit

server/api/user/index.js

@@ -0,0 +1,16 @@
+'use strict';
+
+import {Router} from 'express';
+import * as controller from './user.controller';
+import * as auth from '../../auth/auth.service';
+
+var router = new Router();
+
+router.get('/', auth.hasRole('admin'), controller.index);
+router.delete('/:id', auth.hasRole('admin'), controller.destroy);
+router.get('/me', auth.isAuthenticated(), controller.me);
+router.put('/:id/password', auth.isAuthenticated(), controller.changePassword);
+router.get('/:id', auth.isAuthenticated(), controller.show);
+router.post('/', controller.create);
+
+module.exports = router;

server/api/user/index.spec.js

@@ -0,0 +1,95 @@
+'use strict';
+
+/* globals sinon, describe, expect, it */
+
+var proxyquire = require('proxyquire').noPreserveCache();
+
+var userCtrlStub = {
+  index: 'userCtrl.index',
+  destroy: 'userCtrl.destroy',
+  me: 'userCtrl.me',
+  changePassword: 'userCtrl.changePassword',
+  show: 'userCtrl.show',
+  create: 'userCtrl.create'
+};
+
+var authServiceStub = {
+  isAuthenticated() {
+    return 'authService.isAuthenticated';
+  },
+  hasRole(role) {
+    return `authService.hasRole.${role}`;
+  }
+};
+
+var routerStub = {
+  get: sinon.spy(),
+  put: sinon.spy(),
+  post: sinon.spy(),
+  delete: sinon.spy()
+};
+
+// require the index with our stubbed out modules
+var userIndex = proxyquire('./index', {
+  express: {
+    Router() {
+      return routerStub;
+    }
+  },
+  './user.controller': userCtrlStub,
+  '../../auth/auth.service': authServiceStub
+});
+
+describe('User API Router:', function() {
+  it('should return an express router instance', function() {
+    expect(userIndex).to.equal(routerStub);
+  });
+
+  describe('GET /api/users', function() {
+    it('should verify admin role and route to user.controller.index', function() {
+      expect(routerStub.get
+        .withArgs('/', 'authService.hasRole.admin', 'userCtrl.index')
+        ).to.have.been.calledOnce;
+    });
+  });
+
+  describe('DELETE /api/users/:id', function() {
+    it('should verify admin role and route to user.controller.destroy', function() {
+      expect(routerStub.delete
+        .withArgs('/:id', 'authService.hasRole.admin', 'userCtrl.destroy')
+        ).to.have.been.calledOnce;
+    });
+  });
+
+  describe('GET /api/users/me', function() {
+    it('should be authenticated and route to user.controller.me', function() {
+      expect(routerStub.get
+        .withArgs('/me', 'authService.isAuthenticated', 'userCtrl.me')
+        ).to.have.been.calledOnce;
+    });
+  });
+
+  describe('PUT /api/users/:id/password', function() {
+    it('should be authenticated and route to user.controller.changePassword', function() {
+      expect(routerStub.put
+        .withArgs('/:id/password', 'authService.isAuthenticated', 'userCtrl.changePassword')
+        ).to.have.been.calledOnce;
+    });
+  });
+
+  describe('GET /api/users/:id', function() {
+    it('should be authenticated and route to user.controller.show', function() {
+      expect(routerStub.get
+        .withArgs('/:id', 'authService.isAuthenticated', 'userCtrl.show')
+        ).to.have.been.calledOnce;
+    });
+  });
+
+  describe('POST /api/users', function() {
+    it('should route to user.controller.create', function() {
+      expect(routerStub.post
+        .withArgs('/', 'userCtrl.create')
+        ).to.have.been.calledOnce;
+    });
+  });
+});

server/api/user/user.controller.js

@@ -0,0 +1,122 @@
+'use strict';
+
+import User from './user.model';
+import config from '../../config/environment';
+import jwt from 'jsonwebtoken';
+
+function validationError(res, statusCode) {
+  statusCode = statusCode || 422;
+  return function(err) {
+    return res.status(statusCode).json(err);
+  };
+}
+
+function handleError(res, statusCode) {
+  statusCode = statusCode || 500;
+  return function(err) {
+    return res.status(statusCode).send(err);
+  };
+}
+
+/**
+ * Get list of users
+ * restriction: 'admin'
+ */
+export function index(req, res) {
+  return User.find({}, '-salt -password').exec()
+    .then(users => {
+      res.status(200).json(users);
+    })
+    .catch(handleError(res));
+}
+
+/**
+ * Creates a new user
+ */
+export function create(req, res) {
+  var newUser = new User(req.body);
+  newUser.provider = 'local';
+  newUser.role = 'user';
+  newUser.save()
+    .then(function(user) {
+      var token = jwt.sign({ _id: user._id }, config.secrets.session, {
+        expiresIn: 60 * 60 * 5
+      });
+      res.json({ token });
+    })
+    .catch(validationError(res));
+}
+
+/**
+ * Get a single user
+ */
+export function show(req, res, next) {
+  var userId = req.params.id;
+
+  return User.findById(userId).exec()
+    .then(user => {
+      if(!user) {
+        return res.status(404).end();
+      }
+      res.json(user.profile);
+    })
+    .catch(err => next(err));
+}
+
+/**
+ * Deletes a user
+ * restriction: 'admin'
+ */
+export function destroy(req, res) {
+  return User.findByIdAndRemove(req.params.id).exec()
+    .then(function() {
+      res.status(204).end();
+    })
+    .catch(handleError(res));
+}
+
+/**
+ * Change a users password
+ */
+export function changePassword(req, res) {
+  var userId = req.user._id;
+  var oldPass = String(req.body.oldPassword);
+  var newPass = String(req.body.newPassword);
+
+  return User.findById(userId).exec()
+    .then(user => {
+      if(user.authenticate(oldPass)) {
+        user.password = newPass;
+        return user.save()
+          .then(() => {
+            res.status(204).end();
+          })
+          .catch(validationError(res));
+      } else {
+        return res.status(403).end();
+      }
+    });
+}
+
+/**
+ * Get my info
+ */
+export function me(req, res, next) {
+  var userId = req.user._id;
+
+  return User.findOne({ _id: userId }, '-salt -password').exec()
+    .then(user => { // don't ever give out the password or salt
+      if(!user) {
+        return res.status(401).end();
+      }
+      res.json(user);
+    })
+    .catch(err => next(err));
+}
+
+/**
+ * Authentication callback
+ */
+export function authCallback(req, res) {
+  res.redirect('/');
+}

server/api/user/user.events.js

@@ -0,0 +1,35 @@
+/**
+ * User model events
+ */
+
+'use strict';
+
+import {EventEmitter} from 'events';
+var UserEvents = new EventEmitter();
+
+// Set max event listeners (0 == unlimited)
+UserEvents.setMaxListeners(0);
+
+// Model events
+var events = {
+  save: 'save',
+  remove: 'remove'
+};
+
+// Register the event emitter to the model events
+function registerEvents(User) {
+  for(var e in events) {
+    let event = events[e];
+    User.post(e, emitEvent(event));
+  }
+}
+
+function emitEvent(event) {
+  return function(doc) {
+    UserEvents.emit(`${event}:${doc._id}`, doc);
+    UserEvents.emit(event, doc);
+  };
+}
+
+export {registerEvents};
+export default UserEvents;

server/api/user/user.integration.js

@@ -0,0 +1,67 @@
+'use strict';
+
+/* globals describe, expect, it, before, after, beforeEach, afterEach */
+
+import app from '../..';
+import User from './user.model';
+import request from 'supertest';
+
+describe('User API:', function() {
+  var user;
+
+  // Clear users before testing
+  before(function() {
+    return User.remove().then(function() {
+      user = new User({
+        name: 'Fake User',
+        email: 'test@example.com',
+        password: 'password'
+      });
+
+      return user.save();
+    });
+  });
+
+  // Clear users after testing
+  after(function() {
+    return User.remove();
+  });
+
+  describe('GET /api/users/me', function() {
+    var token;
+
+    before(function(done) {
+      request(app)
+        .post('/auth/local')
+        .send({
+          email: 'test@example.com',
+          password: 'password'
+        })
+        .expect(200)
+        .expect('Content-Type', /json/)
+        .end((err, res) => {
+          token = res.body.token;
+          done();
+        });
+    });
+
+    it('should respond with a user profile when authenticated', function(done) {
+      request(app)
+        .get('/api/users/me')
+        .set('authorization', `Bearer ${token}`)
+        .expect(200)
+        .expect('Content-Type', /json/)
+        .end((err, res) => {
+          expect(res.body._id.toString()).to.equal(user._id.toString());
+          done();
+        });
+    });
+
+    it('should respond with a 401 when not authenticated', function(done) {
+      request(app)
+        .get('/api/users/me')
+        .expect(401)
+        .end(done);
+    });
+  });
+});

server/api/user/user.model.js

@@ -0,0 +1,258 @@
+'use strict';
+/*eslint no-invalid-this:0*/
+import crypto from 'crypto';
+mongoose.Promise = require('bluebird');
+import mongoose, {Schema} from 'mongoose';
+import {registerEvents} from './user.events';
+
+const authTypes = ['github', 'twitter', 'facebook', 'google'];
+
+var UserSchema = new Schema({
+  name: String,
+  email: {
+    type: String,
+    lowercase: true,
+    required() {
+      if(authTypes.indexOf(this.provider) === -1) {
+        return true;
+      } else {
+        return false;
+      }
+    }
+  },
+  role: {
+    type: String,
+    default: 'user'
+  },
+  password: {
+    type: String,
+    required() {
+      if(authTypes.indexOf(this.provider) === -1) {
+        return true;
+      } else {
+        return false;
+      }
+    }
+  },
+  provider: String,
+  salt: String,
+  facebook: {},
+  google: {},
+  github: {}
+});
+
+/**
+ * Virtuals
+ */
+
+// Public profile information
+UserSchema
+  .virtual('profile')
+  .get(function() {
+    return {
+      name: this.name,
+      role: this.role
+    };
+  });
+
+// Non-sensitive info we'll be putting in the token
+UserSchema
+  .virtual('token')
+  .get(function() {
+    return {
+      _id: this._id,
+      role: this.role
+    };
+  });
+
+/**
+ * Validations
+ */
+
+// Validate empty email
+UserSchema
+  .path('email')
+  .validate(function(email) {
+    if(authTypes.indexOf(this.provider) !== -1) {
+      return true;
+    }
+    return email.length;
+  }, 'Email cannot be blank');
+
+// Validate empty password
+UserSchema
+  .path('password')
+  .validate(function(password) {
+    if(authTypes.indexOf(this.provider) !== -1) {
+      return true;
+    }
+    return password.length;
+  }, 'Password cannot be blank');
+
+// Validate email is not taken
+UserSchema
+  .path('email')
+  .validate(function(value) {
+    if(authTypes.indexOf(this.provider) !== -1) {
+      return true;
+    }
+
+    return this.constructor.findOne({ email: value }).exec()
+      .then(user => {
+        if(user) {
+          if(this.id === user.id) {
+            return true;
+          }
+          return false;
+        }
+        return true;
+      })
+      .catch(function(err) {
+        throw err;
+      });
+  }, 'The specified email address is already in use.');
+
+var validatePresenceOf = function(value) {
+  return value && value.length;
+};
+
+/**
+ * Pre-save hook
+ */
+UserSchema
+  .pre('save', function(next) {
+    // Handle new/update passwords
+    if(!this.isModified('password')) {
+      return next();
+    }
+
+    if(!validatePresenceOf(this.password)) {
+      if(authTypes.indexOf(this.provider) === -1) {
+        return next(new Error('Invalid password'));
+      } else {
+        return next();
+      }
+    }
+
+    // Make salt with a callback
+    this.makeSalt((saltErr, salt) => {
+      if(saltErr) {
+        return next(saltErr);
+      }
+      this.salt = salt;
+      this.encryptPassword(this.password, (encryptErr, hashedPassword) => {
+        if(encryptErr) {
+          return next(encryptErr);
+        }
+        this.password = hashedPassword;
+        return next();
+      });
+    });
+  });
+
+/**
+ * Methods
+ */
+UserSchema.methods = {
+  /**
+   * Authenticate - check if the passwords are the same
+   *
+   * @param {String} password
+   * @param {Function} callback
+   * @return {Boolean}
+   * @api public
+   */
+  authenticate(password, callback) {
+    if(!callback) {
+      return this.password === this.encryptPassword(password);
+    }
+
+    this.encryptPassword(password, (err, pwdGen) => {
+      if(err) {
+        return callback(err);
+      }
+
+      if(this.password === pwdGen) {
+        return callback(null, true);
+      } else {
+        return callback(null, false);
+      }
+    });
+  },
+
+  /**
+   * Make salt
+   *
+   * @param {Number} [byteSize] - Optional salt byte size, default to 16
+   * @param {Function} callback
+   * @return {String}
+   * @api public
+   */
+  makeSalt(...args) {
+    let byteSize;
+    let callback;
+    let defaultByteSize = 16;
+
+    if(typeof args[0] === 'function') {
+      callback = args[0];
+      byteSize = defaultByteSize;
+    } else if(typeof args[1] === 'function') {
+      callback = args[1];
+    } else {
+      throw new Error('Missing Callback');
+    }
+
+    if(!byteSize) {
+      byteSize = defaultByteSize;
+    }
+
+    return crypto.randomBytes(byteSize, (err, salt) => {
+      if(err) {
+        return callback(err);
+      } else {
+        return callback(null, salt.toString('base64'));
+      }
+    });
+  },
+
+  /**
+   * Encrypt password
+   *
+   * @param {String} password
+   * @param {Function} callback
+   * @return {String}
+   * @api public
+   */
+  encryptPassword(password, callback) {
+    if(!password || !this.salt) {
+      if(!callback) {
+        return null;
+      } else {
+        return callback('Missing password or salt');
+      }
+    }
+
+    var defaultIterations = 10000;
+    var defaultKeyLength = 64;
+    var salt = new Buffer(this.salt, 'base64');
+
+    if(!callback) {
+      // eslint-disable-next-line no-sync
+      return crypto.pbkdf2Sync(password, salt, defaultIterations,
+          defaultKeyLength, 'sha1')
+        .toString('base64');
+    }
+
+    return crypto.pbkdf2(password, salt, defaultIterations, defaultKeyLength,
+      'sha1', (err, key) => {
+        if(err) {
+          return callback(err);
+        } else {
+          return callback(null, key.toString('base64'));
+        }
+      });
+  }
+};
+
+registerEvents(UserSchema);
+export default mongoose.model('User', UserSchema);

server/api/user/user.model.spec.js

@@ -0,0 +1,164 @@
+'use strict';
+
+import app from '../..';
+import User from './user.model';
+var user;
+var genUser = function() {
+  user = new User({
+    provider: 'local',
+    name: 'Fake User',
+    email: 'test@example.com',
+    password: 'password'
+  });
+  return user;
+};
+
+describe('User Model', function() {
+  before(function() {
+    // Clear users before testing
+    return User.remove();
+  });
+
+  beforeEach(function() {
+    genUser();
+  });
+
+  afterEach(function() {
+    return User.remove();
+  });
+
+  it('should begin with no users', function() {
+    return expect(User.find({}).exec()).to
+      .eventually.have.length(0);
+  });
+
+  it('should fail when saving a duplicate user', function() {
+    return expect(user.save()
+      .then(function() {
+        var userDup = genUser();
+        return userDup.save();
+      })).to.be.rejected;
+  });
+
+  describe('#email', function() {
+    it('should fail when saving with a blank email', function() {
+      user.email = '';
+      return expect(user.save()).to.be.rejected;
+    });
+
+    it('should fail when saving with a null email', function() {
+      user.email = null;
+      return expect(user.save()).to.be.rejected;
+    });
+
+    it('should fail when saving without an email', function() {
+      user.email = undefined;
+      return expect(user.save()).to.be.rejected;
+    });
+
+    describe('given user provider is google', function() {
+      beforeEach(function() {
+        user.provider = 'google';
+      });
+
+      it('should succeed when saving without an email', function() {
+        user.email = null;
+        return expect(user.save()).to.be.fulfilled;
+      });
+    });
+
+    describe('given user provider is facebook', function() {
+      beforeEach(function() {
+        user.provider = 'facebook';
+      });
+
+      it('should succeed when saving without an email', function() {
+        user.email = null;
+        return expect(user.save()).to.be.fulfilled;
+      });
+    });
+
+    describe('given user provider is github', function() {
+      beforeEach(function() {
+        user.provider = 'github';
+      });
+
+      it('should succeed when saving without an email', function() {
+        user.email = null;
+        return expect(user.save()).to.be.fulfilled;
+      });
+    });
+  });
+
+  describe('#password', function() {
+    it('should fail when saving with a blank password', function() {
+      user.password = '';
+      return expect(user.save()).to.be.rejected;
+    });
+
+    it('should fail when saving with a null password', function() {
+      user.password = null;
+      return expect(user.save()).to.be.rejected;
+    });
+
+    it('should fail when saving without a password', function() {
+      user.password = undefined;
+      return expect(user.save()).to.be.rejected;
+    });
+
+    describe('given the user has been previously saved', function() {
+      beforeEach(function() {
+        return user.save();
+      });
+
+      it('should authenticate user if valid', function() {
+        expect(user.authenticate('password')).to.be.true;
+      });
+
+      it('should not authenticate user if invalid', function() {
+        expect(user.authenticate('blah')).to.not.be.true;
+      });
+
+      it('should remain the same hash unless the password is updated', function() {
+        user.name = 'Test User';
+        return expect(user.save()
+          .then(function(u) {
+            return u.authenticate('password');
+          })).to.eventually.be.true;
+      });
+    });
+
+    describe('given user provider is google', function() {
+      beforeEach(function() {
+        user.provider = 'google';
+      });
+
+      it('should succeed when saving without a password', function() {
+        user.password = null;
+        return expect(user.save()).to.be.fulfilled;
+      });
+    });
+
+    describe('given user provider is facebook', function() {
+      beforeEach(function() {
+        user.provider = 'facebook';
+      });
+
+      it('should succeed when saving without a password', function() {
+        user.password = null;
+        return expect(user.save()).to.be.fulfilled;
+      });
+    });
+
+    describe('given user provider is github', function() {
+      beforeEach(function() {
+        user.provider = 'github';
+      });
+
+      it('should succeed when saving without a password', function() {
+        user.password = null;
+        return expect(user.save()).to.be.fulfilled;
+      });
+    });
+  });
+});