organisation

Author: Swaggeroo

routes/users.js

@@ -90,8 +90,7 @@ router.put('/me/password', auth, async (req, res) => {
 
     debugRoute("PUT /api/users/me/password - 200 - Password changed");
 
-    //let otp = user.otp_enabled && user.otp_verified;
-    res.send({token: generateAuthToken(user.sub,false, false,false)}); //TODO change me
+    res.send({token: generateAuthToken(user.sub,user.admin, req.user.otp,(user.totp_secret !== undefined && user.totp_confirmed))});
 });
 
 router.post('/password/reset/request/:email', async (req, res) => {
@@ -100,18 +99,23 @@ router.post('/password/reset/request/:email', async (req, res) => {
         return res.status(400).send("Invalid Email");
     }
 
-    //TODO fetch user from database
-    //TODO test if email verified
-    //if (Date.now() - user.lastSecurityUpdate < 60000) {
-    //    debugRoute("GET /api/users/password/reset/:email - 400 - Password reset already requested");
-    //    return res.status(400).send("Password reset already requested");
-    //}
-    let user = {};
-    user.passwordResetCode = generateVerificationCode();
-    user.lastSecurityUpdate = Date.now();
-    user.passwordResetTime = Date.now()
+    let user = await dbAdapter.getUserByEmail(req.params.email);
+
+    if (!user) {
+        debugRoute("GET /api/users/password/reset/:email - 404 - User not found");
+        return res.status(404).send("User not found");
+    }
 
-    //TODO push to server
+    if (!user.email_confirmed){
+        debugRoute("GET /api/users/password/reset/:email - 403 - Email not verified");
+        return res.status(403).send("Email not verified");
+    }
+
+    user.email_verification_code = generateVerificationCode();
+    user.last_security_change = Date.now();
+    user.last_email_send = Date.now()
+
+    await dbAdapter.updateUser(user);
 
     await sendPasswordResetEmail(user);
     debugRoute("GET /api/users/password/reset/:email - 200 - Reset code sent");
@@ -135,8 +139,8 @@ router.put('/password/reset/:code', async (req, res) => {
         return res.status(400).send(error.details[0].message);
     }
 
-    //TODO Fetch User from database
-    let user = {};
+    //TODO get user from database
+    //let user = dbAdapter;
     //if (Date.now() - user.passwordResetTime > 600000) {
     //    debugRoute("GET /api/users/password/reset/:code - 400 - Reset code expired");
     //    return res.status(400).send("Reset code expired");