Add expiry on sign up draft (to prevent leakage of personal information)
[ndcode_site.git] / api / account / sign_up / set_draft.json.jst
1 let XDate = require('xdate')
2
3 return async env => {
4   let post_request = await _require('/_lib/post_request.jst')
5   let session_cookie = await _require('/_lib/session_cookie.jst')
6   let Problem = await _require('/_lib/Problem.jst')
7
8   await post_request(
9     // env
10     env,
11     // handler
12     async details => {
13       // coerce and/or validate
14       if (details !== null)
15         details = {
16           email: details.email.slice(0, 256).toLowerCase(),
17           given_names: details.given_names.slice(0, 256),
18           family_name: details.family_name.slice(0, 256),
19           contact_me: details.contact_me ? true : false
20         }
21
22       let transaction = await env.site.database.Transaction()
23       try {
24         // initialize env.session_key, set cookie in env.response
25         let session = await session_cookie(env, transaction)
26
27         if (details) {
28           let expires = new XDate()
29           expires.addDays(1)
30           session.set(
31             'sign_up_draft',
32             transaction.json_to_logjson(
33               {
34                 email: details.email,
35                 given_names: details.given_names,
36                 family_name: details.family_name,
37                 contact_me: details.contact_me,
38                 expires: expires.getTime()
39               }
40             )
41           )
42         }
43         else
44           session.delete('sign_up_draft')
45
46         await transaction.commit()
47       }
48       catch (error) {
49         transaction.rollback()
50         throw error
51       }
52     }
53   )
54 }