[fix #8218] cleaning up reset tokens also cleans up enroll tokens #8474

mutdmour · 2017-03-10T22:57:53Z

The issue was with _.extend overriding two documents (a token filter by reason and a time filter) with the same key ($or). Put the two filters in an ($add) to solve the issue, and added two tests to ensure no interference between those two.

Fixes #8218

abernix

Thanks very much for working on this! Looks good functionality wise, but just a few formatting changes if you don't mind?

abernix · 2017-03-11T12:47:05Z

packages/accounts-password/password_tests.js

@@ -1697,6 +1697,34 @@ if (Meteor.isServer) (function () {
    }
  )

+  Tinytest.add(
+    'passwords - enroll tokens don\'t get cleaned up when reset tokens are cleaned up',


Please just use double quotes around this to avoid the need to escape the '.

will fix it. There was another test that I based this on.
Tinytest.add( 'passwords - reset password doesn\t work if email changed after email sent',
Now I look closely and realize that was a typo. I can fix this as well.

abernix · 2017-03-11T12:49:46Z

packages/accounts-password/password_tests.js

+      Accounts._expirePasswordResetTokens(new Date(), userId);
+
+      test.isTrue(Meteor.users.findOne(userId).services.password.reset);
+    }


No real preference about how you format your commands and the assertions that follow them, but please try to make them consistent – maybe like this?

var userId = ... Accounts.sendEnrollmentEmail(userId, email); test.isTrue(!!Meteor.users.findOne(userId).services.password.reset); Accounts._expirePasswordResetTokens(new Date(), userId); test.isTrue(Meteor.users.findOne(userId).services.password.reset);

Cool, I can change that, though this was consistent with the other tests in the same file.

abernix · 2017-03-11T12:50:23Z

packages/accounts-password/password_tests.js

+      test.isTrue(!!Meteor.users.findOne(userId).services.password.reset);
+
+      Accounts._expirePasswordEnrollTokens(new Date(), userId);
+


Same questions as above.

abernix · 2017-03-11T12:54:07Z

packages/accounts-password/password_tests.js

+      var email = test.id + '-intercept@example.com';
+      var userId = Accounts.createUser({email: email, password: 'password'});
+      Accounts.sendEnrollmentEmail(userId, email);
+      test.isTrue(!!Meteor.users.findOne(userId).services.password.reset);


Can you explain why you're using !! on this test? If you're trying to coerce something, perhaps it would be better to use a different test? Either way, it's not clear if you're trying to explicitly test for something different than the test.isTrue below.

I did it mostly to stay consistent with the rest of the tests on token cleanup. I have looked into it and I don't see why use !!. Meteor.users.findOne(userId).services.password.reset returns an object or undefined. At first I thought it was to handle empty object case {}. Though both cases test.isTrue({}) and test.isTrue(!!{}) are true. Both cases test.isTrue(undefined) and test.isTrue(!!undefined) are false. I can remove the !!. What do you think?

I think we could do without the the coercion notation (!!) however I believe this test is trying to test that it is entirely unchanged (right?) so it should probably test for exactly the same thing (i.e. with !!).

It's not to test if it's exactly the same thing. It's test for existence of the reset or enroll token object, which is added in the line before.

I mean that when line 1710 runs Meteor.users.findOne(userId).services.password.reset, it's meant to make sure that it's the same as when it ran on line 1706, right?

Yes exactly. Maybe it's better to test for equality then directly.
var resetToken = Meteor.users.findOne(userId).services.password.reset;
test.isTrue(resetToken);
Accounts._expirePasswordResetTokens(new Date(), userId);
test.isEqual(resetToken, Meteor.users.findOne(userId).services.password.reset);

Yeah, that sounds best to me. Mind making the fix? Then I think we're good to go.

abernix · 2017-03-11T13:29:43Z

packages/accounts-base/accounts_server.js

+        { "services.password.reset.when": { $lt: oldestValidDate } },
+        { "services.password.reset.when": { $lt: +oldestValidDate } }
+      ]
+    }]


I realize the formatting here wasn't great to begin with, but this could still use some cleaning up - we should take this opportunity to fix it.

At the very least, with this complexity, the $or should become a variable:

const resetRangeOr = { $or: [ "services.password.reset.when": { $lt: oldestValidDate } }, "services.password.reset.when": { $lt: +oldestValidDate } }, ], };

Then, we should fix the indentation and stop extend-ing into a variable name which doesn't make sense after it's changed (Since _.extend mutates the first parameter, and then it's no longer the userFilter once the tokenFilter and resetRange are in there):

accounts.users.update( _.extend( {}, userFilter, { $and: [ tokenFilter, resetRangeOr ] } ) );

Or instead of the last suggestion (though I realize this doesn't match the existing code, it's much more clear):

// resetRangeOr and userFilter are already defined above. const expireFilter = { $and: [tokenFilter, resetRangeOf] }; accounts.users.update({ ...userFilter, ...expireFilter });

question, what's this ... notation? I have not seen it before and a hard one to get an answer for from google. why does it solve my "unknown operator" issue?

Great question, and hard to search for dots on Google. 😄

This is Object spread notation, taking advantage of the Spread operator but using a Stage-3 ECMAScript proposal seen here. Stage-3 proposals are very likely to become a part of the official specification and we have enabled in Meteor via babel-preset-meteor.

abernix · 2017-03-24T12:37:26Z

I think your 00a2cb8 failed because of a problematic commit on the devel branch. If you rebase off devel and try again it should work. (And I think you can revert your attempt to fix it with b6d687e 😄)

Sorry for the troubles!

mutdmour · 2017-03-26T18:35:39Z

@abernix I think this is ready. Let me know if there's anything else needed. I have a fix for another issue ready but cannot create branches. Can you add me as a collaborator so I can create branches?

hwillson · 2017-03-26T18:45:30Z

@mutdmour Since you're working off of your own fork, you can create as many branches as you want there. When you're ready to submit your PR, you can then do so from your branch. Creating branches within the Meteor project itself is very tightly controlled (to try to keep things nice and clean), and not necessary for submitting bug fix / feature request PR's.

mutdmour · 2017-03-26T19:16:38Z

@hwillson Thanks ya, that makes sense. I thought I could not create branches on my fork either, but I just tried doing it locally first and that worked.

) * solved issue 8218 with expireresettoken removing enroll tokens * style fix * tests fix * solved issue 8218 with expireresettoken removing enroll tokens * style fix

solved issue 8218 with expireresettoken removing enroll tokens

e0c23fc

mutdmour mentioned this pull request Mar 10, 2017

accounts-base: enroll tokens deleted too soon #8218

Closed

abernix changed the title ~~fix for bug #8218: cleaning up reset tokens also cleans up enroll tokens~~ [fix #8218] cleaning up reset tokens also cleans up enroll tokens Mar 11, 2017

abernix suggested changes Mar 11, 2017

View reviewed changes

mutdmour added 2 commits March 11, 2017 18:00

style fix

d611c91

tests fix

00a2cb8

mutdmour added 2 commits March 24, 2017 16:02

solved issue 8218 with expireresettoken removing enroll tokens

1a2770e

style fix

d27b1b8

abernix approved these changes Mar 29, 2017

View reviewed changes

abernix merged commit 1f83143 into meteor:devel Mar 29, 2017

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[fix #8218] cleaning up reset tokens also cleans up enroll tokens #8474

[fix #8218] cleaning up reset tokens also cleans up enroll tokens #8474

mutdmour commented Mar 10, 2017 •

edited by abernix

Loading

abernix left a comment

abernix Mar 11, 2017 •

edited

Loading

mutdmour Mar 11, 2017

abernix Mar 11, 2017 •

edited

Loading

mutdmour Mar 11, 2017 •

edited

Loading

abernix Mar 11, 2017

abernix Mar 11, 2017

mutdmour Mar 11, 2017

abernix Mar 13, 2017

mutdmour Mar 18, 2017

abernix Mar 22, 2017

mutdmour Mar 22, 2017

abernix Mar 22, 2017

mutdmour Mar 22, 2017

abernix Mar 11, 2017

mutdmour Mar 11, 2017

abernix Mar 13, 2017

abernix commented Mar 24, 2017

mutdmour commented Mar 26, 2017

hwillson commented Mar 26, 2017

mutdmour commented Mar 26, 2017

		test.isTrue(!!Meteor.users.findOne(userId).services.password.reset);

		Accounts._expirePasswordEnrollTokens(new Date(), userId);

[fix #8218] cleaning up reset tokens also cleans up enroll tokens #8474

[fix #8218] cleaning up reset tokens also cleans up enroll tokens #8474

Conversation

mutdmour commented Mar 10, 2017 • edited by abernix Loading

abernix left a comment

Choose a reason for hiding this comment

abernix Mar 11, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

abernix Mar 11, 2017 • edited Loading

Choose a reason for hiding this comment

mutdmour Mar 11, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

abernix commented Mar 24, 2017

mutdmour commented Mar 26, 2017

hwillson commented Mar 26, 2017

mutdmour commented Mar 26, 2017

mutdmour commented Mar 10, 2017 •

edited by abernix

Loading

abernix Mar 11, 2017 •

edited

Loading

abernix Mar 11, 2017 •

edited

Loading

mutdmour Mar 11, 2017 •

edited

Loading