Added way to soft-delete users. Added minor improvements to CSRF.

Author: neonexus

README.md

@@ -5,7 +5,9 @@
 This is an opinionated base [Sails v1](https://sailsjs.com) application, using Webpack to handle Bootstrap (SASS) and React.
 
 # Branch Warning
-The `master` branch is experimental, and the [release branch](https://github.com/neonexus/sails-react-bootstrap-webpack/tree/release) (or the [`releases section`](https://github.com/neonexus/sails-react-bootstrap-webpack/releases)) is where one should base their use of this template. `master` is **volatile**, likely to change at any time, for any reason; this includes `git push --force` updates.
+The `master` branch is experimental, and the [release branch](https://github.com/neonexus/sails-react-bootstrap-webpack/tree/release) (or the [`releases section`](https://github.com/neonexus/sails-react-bootstrap-webpack/releases)) is where one should base their use of this template.
+
+`master` is **volatile**, likely to change at any time, for any reason; this includes `git push --force` updates.
 
 **FINAL WARNING: DO NOT RELY ON THE MASTER BRANCH!**
 

api/controllers/admin/create-user.js

@@ -52,7 +52,7 @@ module.exports = {
             return exits.badRequest(isPasswordValid);
         }
 
-        const foundUser = await User.findOne({email: inputs.email});
+        const foundUser = await User.findOne({email: inputs.email, deletedAt: null});
 
         if (foundUser) {
             return exits.badRequest('Email is already in-use.');

api/controllers/admin/delete-user.js

@@ -0,0 +1,44 @@
+const moment = require('moment-timezone');
+
+module.exports = {
+    friendlyName: 'Delete User',
+
+    description: 'Delete a user, give its ID',
+
+    inputs: {
+        id: {
+            type: 'string',
+            required: true,
+            isUUID: true
+        }
+    },
+
+    exits: {
+        ok: {
+            responseType: 'ok'
+        },
+        badRequest: {
+            responseType: 'badRequest'
+        },
+        serverError: {
+            responseType: 'serverError'
+        }
+    },
+
+    fn: async (inputs, exits, env) => {
+        const foundUser = await User.findOne({id: inputs.id, deletedAt: null});
+
+        if (!foundUser) {
+            return exits.badRequest('User does not exist');
+        }
+
+        await Session.destroy({user: foundUser.id}); // force logout any active sessions user might have
+
+        await User.update({id: foundUser.id}).set(_.merge({}, foundUser, {
+            deletedAt: moment.tz(sails.config.datastores.default.timezone).toDate(),
+            deletedBy: env.req.session.user.id
+        }));
+
+        return exits.ok();
+    }
+};

api/controllers/admin/login.js

@@ -36,7 +36,7 @@ module.exports = {
         }
 
         const badEmailPass = 'Bad email / password combination.';
-        const foundUser = await User.findOne({email: inputs.email});
+        const foundUser = await User.findOne({email: inputs.email, deletedAt: null});
 
         if (!foundUser) {
             return exits.badRequest(badEmailPass);
@@ -70,6 +70,7 @@ module.exports = {
                     isSession: true
                 }
             ],
+            user: foundUser,
             _csrf: csrf.token
         });
     }

api/helpers/set-cookies.js

@@ -41,7 +41,7 @@ module.exports = {
                 return inputs.res.clearCookie(cookie.name, defaultCookie);
             }
 
-            const newCookie = (cookie.isSession)
+            const newCookie = (!cookie.isSession) // if we don't want to use the default "session" to expire the cookie, we use the maxAge
                               ? _.merge({}, defaultCookie, {maxAge: sails.config.session.cookie.maxAge})
                               : defaultCookie;
 

api/helpers/update-csrf.js

@@ -0,0 +1,40 @@
+module.exports = {
+    friendlyName: 'Update CSRF',
+
+    description: 'Update the CSRF secret, and append the token to the res.',
+
+    inputs: {
+        data: {
+            type: 'ref',
+            required: true
+        },
+
+        req: {
+            type: 'ref',
+            required: true
+        }
+    },
+
+    exits: {},
+
+    fn: async (inputs, exits) => {
+        if (inputs.req.method === 'GET' || !inputs.req.session || !inputs.req.session.user || !inputs.req.session.id) {
+            return exits.success(inputs.data);
+        }
+
+        const foundSession = await Session.findOne({id: inputs.req.session.id});
+
+        const csrf = sails.helpers.generateCsrfToken();
+        const newData = _.merge({}, foundSession.data, {_csrfSecret: csrf.secret});
+
+        Session.update({id: inputs.req.session.id}).set({
+            data: newData
+        }).exec((err) => {
+            if (err) {
+                throw new Error(err);
+            }
+
+            return exits.success(_.merge({}, inputs.data, {_csrf: csrf.token}));
+        });
+    }
+};

api/models/User.js

@@ -50,7 +50,7 @@ module.exports = {
             type: 'string',
             isEmail: true,
             required: true,
-            unique: true,
+            // unique: true,
             columnType: 'varchar(191)'
         },
 

api/responses/created.js

@@ -12,6 +12,7 @@ module.exports = async function created(data) {
 
     data = sails.helpers.keepModelsSafe(data);
     data = sails.helpers.setCookies(data, res);
+    data = await sails.helpers.updateCsrf(data, req);
 
     const out = _.merge({success: true}, data);
 

api/responses/ok.js

@@ -12,6 +12,7 @@ module.exports = async function sendOK(data) {
 
     data = sails.helpers.keepModelsSafe(data);
     data = sails.helpers.setCookies(data, res);
+    data = await sails.helpers.updateCsrf(data, req);
 
     const out = _.merge({success: true}, data);
 

config/policies.js

@@ -14,6 +14,7 @@ module.exports.policies = {
     AdminController: {
         '*': 'isLoggedIn',
         'login': true,
-        'create-user': ['isLoggedIn', 'isAdmin']
+        'create-user': ['isLoggedIn', 'isAdmin'],
+        'delete-user': ['isLoggedIn', 'isAdmin']
     }
 };