Strongloop Email Validation - Return Verification Token

Question

I am currently developing an API. I am using Strongloop (Loopback).

I am trying to do an email check when a user logs in. I have a custom model that extends the built-in User model.

Right now, when a user logs in (POST / users), an email is sent with a link to / users / confirm with three corresponding parameters, i.e. uid, redirect and token. When the user clicks on the link, the last email address is checked correctly (the email field becomes true).

However, I noticed that when executing a POST request on / users, the response contains a validation token. This is normal? Is the verification token available only through the sent letter?

Since by making a POST request to / users and receiving a verification token in the response, you can easily send another request to users / confirm using the appropriate parameters (which includes the verification token) and check the email address, even if the address does not exist.

I'm new to Strongloop, and maybe I'm missing something. Can you guys help?

Answer 1

I just finished this example. Cm:

https://github.com/strongloop/loopback-faq-user-management

Answer 2

, , , . . : email.the .... user = , modelN =

modelN.sendVerificationEmail = function (data, callback) {
  var user = loopback.models.modelN;

  if (!data.email) {
    return callback(commonUtils.buildError(
      'Recipient email is required.', 400, 'EMAIL_REQUIRED'
    ));
  }

  if (!emailValidator.validate(data.email)) {
    return callback(commonUtils.buildError(
      'Must provide a valid email.', 400, 'INVALID_EMAIL'
    ));
  }

  var findOneuserPromise
    = modelN.findOne({ 'where': { 'email': data.email }});

  findOneBusinessEmployeePromise.then(function (user) {
    if (!user) {
      return callback();
    }

    var sendVerificationEmailPromise
      = anothermodelname.sendVerificationEmail(user.id);

    sendVerificationEmailPromise.then(function () {
      callback();
    });

    sendVerificationEmailPromise.then(null, function (error) {
      callback(error);
    });
  });

  findOneuserPromise.then(null, function (error) {
    callback(error);
  });
};

, ,....

anothermodelname.sendVerificationEmail = function (userid) {
  var modelN = loopback.models.modelN;
  var Email = loopback.models.Email;
  var deferred = Q.defer();
  var findByIduserPromise = modelN.findById(userId);

  findByIduserPromise.then(function (user) {
    if (!user) {
      return deferred.reject(commonUtils.buildError(
        'Unknown "modelN" id "' + userId + '".',
        404, 'MODEL_NOT_FOUND'
      ));
    }
    if (!user.verificationToken) {
      return deferred.resolve(true);
    }


    modelN.generateVerificationToken(user,
      function (verificationTokenError, verificationToken) {
        if (verificationTokenError) {
          return deferred.reject(verificationTokenError);
        }

        user.verificationToken = verificationToken;

        var saveuserPromise = user.save();

        saveuserPromise.then(function (updateduser) {
          var link = emailConf.clientBaseUrl +
            emailConf.verifyEmailRedirect + '?uid=' +
            updateduser.id + '&token=' +
            updateduser.verificationToken;
               console.log("check+link:",link);
          /*eslint camelcase: [0, {properties: "never"}]*/
          emailOptions.to = updateduser.email;
          emailOptions.template = { 'name': 'verify' };
          emailOptions.global_merge_vars = [];

          emailOptions.global_merge_vars.push({
            'name': 'USER_NAME',
            'content': updateduser.name
            || updateduser.username || updateduser.email
          });

          emailOptions.global_merge_vars.push({
            'name': 'LINK',
            'content': link
          });
          Email.send(emailOptions, function () {});

          deferred.resolve(true);
        });

        saveuserPromise.then(null, function (error) {
          deferred.reject(error);
        });
      });
  });

  findByIduserPromise.then(null, function (error) {
    deferred.reject(error);
  });

  return deferred.promise;
};

Answer 3

@user2483431, , . , . .

afterRemote

user.verify(options, function(err, response, next2) {
  if (err) {
    // error handling code
  }
  // stripping off verificationToken from response for security
  var replacementText = "check email"
  context.result.verificationToken = replacementText;
  next();
});

, !