changes overanges

models/users.js

@@ -12,33 +12,40 @@ const userSchema = mongoose.Schema({
   },
   firstname: {
     type: String,
-    required: true,
     maxlength: 24,
   },
   lastname: {
     type: String,
-    required: true,
     maxlength: 24,
   },
+  login: {
+    type: String,
+    maxlength: 64
+  },
   billing: {
     NIP: {
       type: String,
-      required: true,
       maxlength: 20,
     },
     adress: {
       type: String,
-      required: true,
       maxlength: 128,
     },
     companyName: {
       type: String,
-      required: true,
       maxlength: 64,
     },
   },
+  isRestaurant: Boolean,
   restaurants: [mongoose.Types.ObjectId],
   trialUsed: Boolean,
+  preferences: {
+    excludeAllergens: [String],
+    vegetarian: Boolean,
+    vegan: Boolean,
+  },
+  favoriteRestaurants: [mongoose.Types.ObjectId],
+  photos: [mongoose.Types.ObjectId]
 });
 
 module.exports = mongoose.model("User", userSchema);

routes/routeSearch.js

@@ -2,6 +2,7 @@ const express = require("express");
 const Restaurant = require("../models/restaurant.js");
 const sanitizer = require("string-sanitizer");
 const { handleError } = require("../services/services.js");
+const { validateSearch } = require("../services/validations.js");
 
 var router = express.Router();
 
@@ -11,6 +12,7 @@ router.get("/", async (req, res) => {
   try {
     if (req.query.string.length > 0) {
       const query = sanitizer.sanitize.keepUnicode(decodeURI(req.query.string));
+      validateSearch(query);
       const regex = new RegExp(query, "i");
 
       Restaurant.find(
@@ -43,12 +45,6 @@ router.get("/", async (req, res) => {
   }
 });
 
-// TEST
-
-router.get("/test/", (req, res) => {
-  res.send(req.query.string);
-});
-
 // SEARCH RESTAURANTS BY LOCATION
 
 router.get("/location", async (req, res) => {
@@ -72,12 +68,17 @@ router.get("/location", async (req, res) => {
 router.get("/autocomplete/", (req, res) => {
   if (req.query.string.length > 0) {
     var query = sanitizer.sanitize.keepUnicode(decodeURI(req.query.string));
+    validateSearch(query);
     const regex = new RegExp(query, "i");
     let cities = new Set();
     let restaurants = new Set();
 
     Restaurant.find(
+      { $and: [
         { $or: [{ city: { $regex: regex } }, { name: { $regex: regex } }] },
+        { $or: [{ hidden: false }, { hidden: { $exists: false } }] },
+        { subscriptionActive: true },
+      ], },
       "name city",
       (err, doc) => {
         if (err) {

routes/routeUser.js

@@ -20,6 +20,7 @@ const {
 } = require("../services/services.js");
 const { resetPassword } = require("../services/mailServices.js");
 const cookie = require("cookie");
+const { validateLogin, validateRegister, validatePassword } = require("../services/validations.js");
 
 var router = express.Router();
 
@@ -29,6 +30,7 @@ router.post("/login", async (req, res) => {
     if (!req.body.password || !req.body.email) {
       throw newError("Niepełne dane.", 204);
     }
+    validateLogin(req.body);
     const user = await fetchUser(req.body.email);
     await checkPassword(req.body.password, user.password);
     const safeUser = await prepareSafeUser(user);
@@ -73,6 +75,7 @@ router.post("/refresh", async (req, res) => {
 // REGISTER
 router.post("/register", async (req, res) => {
   try {
+    validateRegister(req.body);
     await checkEmailTaken(req.body.email);
     const user = await createUser(req);
     await user.save().catch((e) => {
@@ -90,6 +93,7 @@ router.post("/changepass", async (req, res) => {
     if (!req.body.password || !req.body.email || !req.body.newPass) {
       throw newError("Niepełne dane.", 204);
     }
+    validateLogin(req.body);
     const token = req.headers["x-auth-token"];
     validateUserToken(token);
     const user = await fetchUser(req.body.email);
@@ -117,8 +121,9 @@ router.post("/forgotpassword", async (req, res) => {
 // RESET PASS
 router.post("/resetpass", async (req, res) => {
   try {
-    validateUserToken(req.body.token);
+    decodedToken = validateUserToken(req.body.token);
-    const user = await fetchUser(req.body.email);
+    validatePassword(req.body.newPass)
+    const user = await fetchUser(decodedToken.email);
     const newPassword = await hashPass(req.body.newPass);
     await changeUserPass(user._id, newPassword);
     res.send("Hasło zostało zmienione.");

services/services.js

@@ -160,7 +160,7 @@ function yearFromNowDate() {
 
 async function hashPass(pass) {
   if (pass.length < 6) {
-    throw newError("Hasło za krótkie.", 500);
+    throw newError("Hasło za krótkie.", 400);
   }
   try {
     const salt = await bcrypt.genSalt(10);

services/validations.js

@@ -0,0 +1,50 @@
+const validator = require('validator');
+const { newError } = require("./services.js");
+
+const validateLogin = function(requestBody){
+    const email = validator.isEmail(requestBody.email) && validator.isLength(requestBody.email, { max: 64 })
+    const password = validator.isLength(requestBody.password, { max: 64 });
+    if(!email || !password){
+        throw newError("Dane logowania nieprawidłowe :/", 400);
+    }
+}
+
+const validatePassword = function(pass){
+    const password = validator.isLength(pass, { min: 2, max: 64 });
+}
+
+const validateRegister = function(requestBody){
+    if(requestBody.isRestaurant){
+        const email = validator.isEmail(requestBody.email) && validator.isLength(requestBody.email, { max: 64 })
+        const password = validator.isLength(requestBody.password, { min:6, max:64 });
+        const firstname = validator.isLength(requestBody.firstname, { min:1, max:24 });
+        const lastname = validator.isLength(requestBody.lastname, { min:1, max:24 });
+        const NIP = validator.isLength(requestBody.NIP, { min:10, max:20 });
+        const adress = validator.isLength(requestBody.adress, { min:2, max:64 });
+        const companyName = validator.isLength(requestBody.companyName, { min:2, max:64 });
+        if(!email || !password || !firstname || !lastname || !NIP || !adress || !companyName) {
+            throw newError("Dane nieprawidłowe", 400)
+        }
+    } else {
+        const email = validator.isEmail(requestBody.email) && validator.isLength(requestBody.email, { max: 64 })
+        const password = validator.isLength(requestBody.password, { min:6, max:64 });
+        const login = validator.isLength(requestBody.login, { min:2, max:64 });
+        if(!email || !password || !login) {
+            throw newError("Dane nieprawidłowe", 400)
+        }
+    }
+}
+
+const validateSearch = function(string){
+    const valid = validator.isLength(string, { max: 64 }) && validator.isAlphanumeric(string)
+    if(!valid){
+        throw newError("Niepoprawne zapytanie", 400)
+    }
+}
+
+// EXPORTS
+
+exports.validateLogin = validateLogin;
+exports.validateRegister = validateRegister;
+exports.validatePassword = validatePassword;
+exports.validateSearch = validateSearch;