changes overanges

routes/routeSearch.js

@@ -2,6 +2,7 @@ const express = require("express");
 const Restaurant = require("../models/restaurant.js");
 const sanitizer = require("string-sanitizer");
 const { handleError } = require("../services/services.js");
+const { validateSearch } = require("../services/validations.js");
 
 var router = express.Router();
 
@@ -11,6 +12,7 @@ router.get("/", async (req, res) => {
   try {
     if (req.query.string.length > 0) {
       const query = sanitizer.sanitize.keepUnicode(decodeURI(req.query.string));
+      validateSearch(query);
       const regex = new RegExp(query, "i");
 
       Restaurant.find(
@@ -43,12 +45,6 @@ router.get("/", async (req, res) => {
   }
 });
 
-// TEST
-
-router.get("/test/", (req, res) => {
-  res.send(req.query.string);
-});
-
 // SEARCH RESTAURANTS BY LOCATION
 
 router.get("/location", async (req, res) => {
@@ -72,12 +68,17 @@ router.get("/location", async (req, res) => {
 router.get("/autocomplete/", (req, res) => {
   if (req.query.string.length > 0) {
     var query = sanitizer.sanitize.keepUnicode(decodeURI(req.query.string));
+    validateSearch(query);
     const regex = new RegExp(query, "i");
     let cities = new Set();
     let restaurants = new Set();
 
     Restaurant.find(
-      { $or: [{ city: { $regex: regex } }, { name: { $regex: regex } }] },
+      { $and: [
+        { $or: [{ city: { $regex: regex } }, { name: { $regex: regex } }] },
+        { $or: [{ hidden: false }, { hidden: { $exists: false } }] },
+        { subscriptionActive: true },
+      ], },
       "name city",
       (err, doc) => {
         if (err) {

routes/routeUser.js

@@ -20,6 +20,7 @@ const {
 } = require("../services/services.js");
 const { resetPassword } = require("../services/mailServices.js");
 const cookie = require("cookie");
+const { validateLogin, validateRegister, validatePassword } = require("../services/validations.js");
 
 var router = express.Router();
 
@@ -29,6 +30,7 @@ router.post("/login", async (req, res) => {
     if (!req.body.password || !req.body.email) {
       throw newError("Niepełne dane.", 204);
     }
+    validateLogin(req.body);
     const user = await fetchUser(req.body.email);
     await checkPassword(req.body.password, user.password);
     const safeUser = await prepareSafeUser(user);
@@ -73,6 +75,7 @@ router.post("/refresh", async (req, res) => {
 // REGISTER
 router.post("/register", async (req, res) => {
   try {
+    validateRegister(req.body);
     await checkEmailTaken(req.body.email);
     const user = await createUser(req);
     await user.save().catch((e) => {
@@ -90,6 +93,7 @@ router.post("/changepass", async (req, res) => {
     if (!req.body.password || !req.body.email || !req.body.newPass) {
       throw newError("Niepełne dane.", 204);
     }
+    validateLogin(req.body);
     const token = req.headers["x-auth-token"];
     validateUserToken(token);
     const user = await fetchUser(req.body.email);
@@ -117,8 +121,9 @@ router.post("/forgotpassword", async (req, res) => {
 // RESET PASS
 router.post("/resetpass", async (req, res) => {
   try {
-    validateUserToken(req.body.token);
-    const user = await fetchUser(req.body.email);
+    decodedToken = validateUserToken(req.body.token);
+    validatePassword(req.body.newPass)
+    const user = await fetchUser(decodedToken.email);
     const newPassword = await hashPass(req.body.newPass);
     await changeUserPass(user._id, newPassword);
     res.send("Hasło zostało zmienione.");