Module Assembly - TopCoder NodeJS Reset Password API

Author: Ghost141

actions/resetPassword.js

@@ -1,42 +1,97 @@
 /*
  * Copyright (C) 2014 TopCoder Inc., All Rights Reserved.
  *
- * @version 1.0
- * @author LazyChild
+ * @version 1.1
+ * @author LazyChild, Ghost_141
+ *
+ * Changes in 1.1:
+ * - Implement the Reset Password API instead of mock it.
  */
 "use strict";
 
 var async = require('async');
+var _ = require('underscore');
 var BadRequestError = require('../errors/BadRequestError');
 var UnauthorizedError = require('../errors/UnauthorizedError');
 var ForbiddenError = require('../errors/ForbiddenError');
+var NotFoundError = require('../errors/NotFoundError');
+var IllegalArgumentError = require('../errors/IllegalArgumentError');
 
 /**
- * This is the function that stub reset password
+ * Reset Password.
  *
  * @param {Object} api - The api object that is used to access the global infrastructure
  * @param {Object} connection - The connection object for the current request
  * @param {Function<connection, render>} next - The callback to be called after this function is done
  */
 function resetPassword(api, connection, next) {
-    var result, helper = api.helper;
+    var result, helper = api.helper, sqlParams, userId, ldapEntryParams, oldPassword,
+        dbConnectionMap = connection.dbConnectionMap,
+        token = connection.params.token,
+        handle = decodeURI(connection.params.handle).toLowerCase(),
+        newPassword = connection.params.password,
+        tokenKey = handle + '-' + api.config.general.resetTokenSuffix;
+
     async.waterfall([
-        function(cb) {
-            if (connection.params.handle == "nonValid") {
-                cb(new BadRequestError("The handle you entered is not valid"));
+        function (cb) {
+            var error = helper.checkStringPopulated(token, 'token') ||
+                helper.checkStringPopulated(handle, 'handle') ||
+                helper.validatePassword(newPassword);
+            if (error) {
+                cb(error);
                 return;
-            } else if (connection.params.handle == "badLuck") {
-                cb(new Error("Unknown server error. Please contact support."));
+            }
+            sqlParams = {
+                handle: handle
+            };
+            api.dataAccess.executeQuery('get_user_information', sqlParams, dbConnectionMap, cb);
+        },
+        function (result, cb) {
+            if (result.length === 0) {
+                cb(new NotFoundError('The user is not exist.'));
                 return;
-            } else if (connection.params.token == "unauthorized_token") {
-                cb(new UnauthorizedError("Authentication credentials were missing or incorrect."));
+            }
+            userId = result[0].user_id;
+            oldPassword = helper.decodePassword(result[0].old_password, helper.PASSWORD_HASH_KEY);
+            sqlParams.handle = result[0].handle;
+            helper.getCachedValue(tokenKey, cb);
+        },
+        function (cache, cb) {
+            if (!_.isDefined(cache)) {
+                // The token is either not assigned or is expired.
+                cb(new BadRequestError('The token is expired, not existed or incorrect. Please apply a new one.'));
                 return;
-            } else if (connection.params.token == "forbidden_token") {
-                cb(new ForbiddenError("The request is understood, but it has been refused or access is not allowed."));
+            }
+            if (cache !== token) {
+                // The token don't match
+                cb(new IllegalArgumentError('The token is incorrect.'));
+                return;
+            }
+            sqlParams.password = helper.encodePassword(newPassword, helper.PASSWORD_HASH_KEY);
+            api.dataAccess.executeQuery('update_password', sqlParams, dbConnectionMap, cb);
+        },
+        function (count, cb) {
+            if (count !== 1) {
+                cb(new Error('password is not updated successfully'));
                 return;
             }
+            ldapEntryParams = {
+                userId: userId,
+                handle: sqlParams.handle,
+                oldPassword: oldPassword,
+                newPassword: newPassword
+            };
+            api.ldapHelper.updateMemberPasswordLDAPEntry(ldapEntryParams, cb);
+        },
+        function (cb) {
+            // Delete the token from cache system.
+            api.cache.destroy(tokenKey, function (err) {
+                cb(err);
+            });
+        },
+        function (cb) {
             result = {
-                "description": "Your password has been reset!"
+                description: 'Your password has been reset!'
             };
             cb();
         }
@@ -60,16 +115,17 @@ function resetPassword(api, connection, next) {
 function generateResetToken(api, connection, next) {
     var result, helper = api.helper;
     async.waterfall([
-        function(cb) {
-            if (connection.params.handle == "nonValid" || connection.params.email == "nonValid@test.com") {
+        function (cb) {
+            if (connection.params.handle === "nonValid" || connection.params.email === "nonValid@test.com") {
                 cb(new BadRequestError("The handle you entered is not valid"));
                 return;
-            } else if (connection.params.handle == "badLuck" || connection.params.email == "badLuck@test.com") {
+            }
+            if (connection.params.handle === "badLuck" || connection.params.email === "badLuck@test.com") {
                 cb(new Error("Unknown server error. Please contact support."));
                 return;
             }
 
-            if (connection.params.handle == "googleSocial" || connection.params.email == "googleSocial@test.com") {
+            if (connection.params.handle === "googleSocial" || connection.params.email === "googleSocial@test.com") {
                 result = {
                     "socialLogin": "Google"
                 };
@@ -103,9 +159,16 @@ exports.resetPassword = {
     blockedConnectionTypes: [],
     outputExample: {},
     version: 'v2',
+    transaction: 'write',
+    cacheEnabled: false,
+    databases: ["common_oltp"],
     run: function (api, connection, next) {
-        api.log("Execute resetPassword#run", 'debug');
-        resetPassword(api, connection, next);
+        if (connection.dbConnectionMap) {
+            api.log("Execute resetPassword#run", 'debug');
+            resetPassword(api, connection, next);
+        } else {
+            api.helper.handleNoConnection(api, connection, next);
+        }
     }
 };
 

apiary.apib

@@ -1049,23 +1049,55 @@ Register a new user.
         {
             "name":"Bad Request",
             "value":"400",
-            "description":"This message will explain why the request is invalid or cannot be served."
+            "description":"password should be non-null and non-empty string."
         }
 
-+ Response 401 (application/json)
++ Response 400 (application/json)
 
         {
-            "name":"Unauthorized",
-            "value":"401",
-            "description":"Authentication credentials were missing or incorrect."
+            "name":"Bad Request",
+            "value":"400",
+            "description":"password must be at least 7 characters in length."
         }
 
-+ Response 403 (application/json)
++ Response 400 (application/json)
 
         {
-            "name":"Forbidden",
-            "value":"403",
-            "description":"The request is understood, but it has been refused or access is not allowed."
+            "name":"Bad Request",
+            "value":"400",
+            "description":"password may contain at most 15 characters."
+        }
+
++ Response 400 (application/json)
+
+        {
+            "name":"Bad Request",
+            "value":"400",
+            "description":"Your password may contain only letters, numbers and -_.{}[]()"
+        }
+
++ Response 400 (application/json)
+
+        {
+            "name":"Bad Request",
+            "value":"400",
+            "description":"The token is expired or not existed. Please apply a new one."
+        }
+
++ Response 400 (application/json)
+
+        {
+            "name":"Bad Request",
+            "value":"400",
+            "description":"The token is incorrect."
+        }
+
++ Response 404 (application/json)
+
+        {
+            "name":"Not Found",
+            "value":"404",
+            "description":"The user is not exist."
         }
 
 + Response 500 (application/json)

common/stringUtils.js

@@ -1,8 +1,10 @@
 /*
- * Copyright (C) 2013 TopCoder Inc., All Rights Reserved.
+ * Copyright (C) 2013 - 2014 TopCoder Inc., All Rights Reserved.
  *
- * Version: 1.0
- * Author: TCSASSEMBLER
+ * Version: 1.1
+ * Author: TCSASSEMBLER, Ghost_141
+ * Changes in 1.1:
+ * - add PUNCTUATION and PASSWORD_ALPHABET.
  */
 
 "use strict";
@@ -18,6 +20,18 @@ var ALPHABET_ALPHA_EN = ALPHABET_ALPHA_LOWER_EN + ALPHABET_ALPHA_UPPER_EN;
 
 var ALPHABET_DIGITS_EN = "0123456789";
 
+/**
+ * The valid characters for punctuation.
+ * @since 1.1
+ */
+var PUNCTUATION = "-_.{}[]()";
+
+/**
+ * The valid characters for password.
+ * @since 1.1
+ */
+var PASSWORD_ALPHABET = ALPHABET_ALPHA_EN + ALPHABET_DIGITS_EN + PUNCTUATION;
+
 /**
  * Checks if string has all its characters in alphabet given.
  *
@@ -42,4 +56,6 @@ exports.containsOnly = function (string, alphabet) {
 exports.ALPHABET_ALPHA_UPPER_EN = ALPHABET_ALPHA_UPPER_EN;
 exports.ALPHABET_ALPHA_LOWER_EN = ALPHABET_ALPHA_LOWER_EN;
 exports.ALPHABET_ALPHA_EN = ALPHABET_ALPHA_EN;
-exports.ALPHABET_DIGITS_EN = ALPHABET_DIGITS_EN;
+exports.ALPHABET_DIGITS_EN = ALPHABET_DIGITS_EN;
+exports.PUNCTUATION = PUNCTUATION;
+exports.PASSWORD_ALPHABET = PASSWORD_ALPHABET;

config.js

@@ -2,7 +2,7 @@
  * Copyright (C) 2013 - 2014 TopCoder Inc., All Rights Reserved.
  *
  * @author vangavroche, Ghost_141, kurtrips, Sky_, isv
- * @version 1.12
+ * @version 1.13
  * changes in 1.1:
  * - add defaultCacheLifetime parameter
  * changes in 1.2:
@@ -30,6 +30,9 @@
  * - added designSubmissionsBasePath for design submissions 
  * changes in 1.12:
  * - add defaultUserCacheLifetime property.
+ * Changes in 1.13:
+ * - add minPasswordLength and maxPasswordLength
+ * - add resetTokenSuffix
  */
 "use strict";
 
@@ -71,6 +74,9 @@ config.general = {
     defaultCacheLifetime : process.env.CACHE_EXPIRY || 1000 * 60 * 10, //10 min default
     defaultAuthMiddlewareCacheLifetime : process.env.AUTH_MIDDLEWARE_CACHE_EXPIRY || 1000 * 60 * 10, //10 min default
     defaultUserCacheLifetime: process.env.USER_CACHE_EXPIRY || 1000 * 60 * 60 * 24, //24 hours default
+    resetTokenSuffix: 'reset-token',
+    minPasswordLength: 8,
+    maxPasswordLength: 30,
     cachePrefix: '',
     oauthClientId: process.env.OAUTH_CLIENT_ID || "CMaBuwSnY0Vu68PLrWatvvu3iIiGPh7t",
     //auth0 secret is encoded in base64!

deploy/ci.sh

@@ -1,10 +1,12 @@
 #!/bin/bash
 
 #
-# Copyright (C) 2013 TopCoder Inc., All Rights Reserved.
+# Copyright (C) 2013 - 2014 TopCoder Inc., All Rights Reserved.
 #
-# Version: 1.0
-# Author: vangavroche, delemach
+# Version: 1.1
+# Author: vangavroche, delemach, Ghost_141
+# Changes in 1.1
+# - add REDIS_HOST and REDIS_PORT.
 #
 export CACHE_EXPIRY=-1
 
@@ -67,3 +69,7 @@ export JIRA_USERNAME=api_test
 export JIRA_PASSWORD=8CDDp6BHLtUeUdD
 
 export ACTIONHERO_CONFIG=./config.js
+
+# Used in api cache.
+export REDIS_HOST=localhost
+export REDIS_PORT=6379

deploy/development.bat

@@ -2,9 +2,11 @@
 REM
 REM Copyright (C) 2014 TopCoder Inc., All Rights Reserved.
 REM
-REM Version: 1.0
-REM Author: TrePe
+REM Version: 1.1
+REM Author: TrePe, Ghost_141
 REM
+REM Changes in 1.1
+REM - Add REDIS_PORT and REDIS_HOST.
 
 REM tests rely on caching being off. But set this to a real value (or remove) while coding.
 
@@ -66,3 +68,6 @@ set JIRA_PASSWORD=8CDDp6BHLtUeUdD
 
 set ACTIONHERO_CONFIG=./config.js
 
+REM Used in API cache
+set REDIS_HOST=localhost
+set REDIS_PORT=6379

deploy/development.sh

@@ -1,12 +1,14 @@
 #!/bin/bash
 
 #
-# Copyright (C) 2013 TopCoder Inc., All Rights Reserved.
+# Copyright (C) 2013 - 2014 TopCoder Inc., All Rights Reserved.
 #
-# Version: 1.1
-# Author: vangavroche, TCSASSEMBLER
+# Version: 1.2
+# Author: vangavroche, Ghost_141
 # changes in 1.1:
 # - add JIRA_USERNAME and JIRA_PASSWORD
+# changes in 1.2:
+# - add REDIS_HOST and REDIS_PORT.
 #
 
 # tests rely on caching being off. But set this to a real value (or remove) while coding.
@@ -67,4 +69,8 @@ export TIMEOUT=3000
 export JIRA_USERNAME=api_test
 export JIRA_PASSWORD=8CDDp6BHLtUeUdD
 
+# Used in api cache.
+export REDIS_HOST=localhost
+export REDIS_PORT=6379
+
 export ACTIONHERO_CONFIG=./config.js