diff --git a/Server/controllers/authController.js b/Server/controllers/authController.js index fa59b4d05..b718f3c8e 100644 --- a/Server/controllers/authController.js +++ b/Server/controllers/authController.js @@ -279,10 +279,10 @@ const editUser = async (req, res, next) => { const user = await req.db.getUserByEmail(email); // Compare passwords const match = await user.comparePassword(req.body.password); - // If not a match, throw a 403 + // If not a match, throw a 401 if (!match) { const error = new Error(errorMessages.AUTH_INCORRECT_PASSWORD); - error.status = 403; + error.status = 401; next(error); return; } @@ -346,32 +346,26 @@ const requestRecovery = async (req, res, next) => { try { const { email } = req.body; const user = await req.db.getUserByEmail(email); - if (user) { - const recoveryToken = await req.db.requestRecoveryToken(req, res); - const name = user.firstName; - const email = req.body.email; - const { clientHost } = req.settingsService.getSettings(); - const url = `${clientHost}/set-new-password/${recoveryToken.token}`; - - const msgId = await req.emailService.buildAndSendEmail( - "passwordResetTemplate", - { - name, - email, - url, - }, + const recoveryToken = await req.db.requestRecoveryToken(req, res); + const name = user.firstName; + const { clientHost } = req.settingsService.getSettings(); + const url = `${clientHost}/set-new-password/${recoveryToken.token}`; + const msgId = await req.emailService.buildAndSendEmail( + "passwordResetTemplate", + { + name, email, - "Bluewave Uptime Password Reset" - ); + url, + }, + email, + "Bluewave Uptime Password Reset" + ); - return res.status(200).json({ - success: true, - msg: successMessages.AUTH_CREATE_RECOVERY_TOKEN, - data: msgId, - }); - } else { - throw new Error(errorMessages.FRIENDLY_ERROR); - } + return res.status(200).json({ + success: true, + msg: successMessages.AUTH_CREATE_RECOVERY_TOKEN, + data: msgId, + }); } catch (error) { next(handleError(error, SERVICE_NAME, "recoveryRequestController")); } @@ -430,7 +424,6 @@ const resetPassword = async (req, res, next) => { } try { const user = await req.db.resetPassword(req, res); - const appSettings = await req.settingsService.getSettings(); const token = issueToken(user._doc, tokenType.ACCESS_TOKEN, appSettings); res.status(200).json({ @@ -460,11 +453,6 @@ const deleteUser = async (req, res, next) => { // Check if the user exists const user = await req.db.getUserByEmail(email); - if (!user) { - next(new Error(errorMessages.DB_USER_NOT_FOUND)); - return; - } - // 1. Find all the monitors associated with the team ID if superadmin const result = await req.db.getMonitorsByTeamId({ diff --git a/Server/db/mongo/modules/userModule.js b/Server/db/mongo/modules/userModule.js index 7afe04763..f90e2e354 100644 --- a/Server/db/mongo/modules/userModule.js +++ b/Server/db/mongo/modules/userModule.js @@ -68,7 +68,7 @@ const insertUser = async (userData, imageFile) => { const getUserByEmail = async (email) => { try { // Need the password to be able to compare, removed .select() - // We can strip the hash before returing the user + // We can strip the hash before returning the user const user = await UserModel.findOne({ email: email }).select("-profileImage"); if (user) { return user; diff --git a/Server/tests/controllers/authController.test.js b/Server/tests/controllers/authController.test.js index d9329e54e..cff7554cd 100644 --- a/Server/tests/controllers/authController.test.js +++ b/Server/tests/controllers/authController.test.js @@ -467,7 +467,7 @@ describe("Auth Controller - editUser", async () => { }); await editUser(req, res, next); expect(next.firstCall.args[0]).to.be.an("error"); - expect(next.firstCall.args[0].status).to.equal(403); + expect(next.firstCall.args[0].status).to.equal(401); expect(next.firstCall.args[0].message).to.equal( errorMessages.AUTH_INCORRECT_PASSWORD ); @@ -812,9 +812,9 @@ describe("Auth Controller - deleteUser", () => { afterEach(() => { sinon.restore(); }); - it("should return 404 if user is not found", async () => { + it("should throw an error if user is not found", async () => { jwt.decode.returns({ email: "test@example.com" }); - req.db.getUserByEmail.resolves(null); + req.db.getUserByEmail.throws(new Error(errorMessages.DB_USER_NOT_FOUND)); await deleteUser(req, res, next);