1 files changed, 99 insertions, 1 deletions
diff --git a/routes/user.js b/routes/user.js
index 5c69e4a..e76b052 100644
--- a/routes/user.js
+++ b/routes/user.js
@@ -2,10 +2,14 @@ var express = require('express');
 var router = express.Router();
 var csrf = require('csurf'); // Cross-Site Request Forgery prevention
 var passport = require('passport');
+var nodemailer =  require('nodemailer');
+var bcrypt = require('bcrypt-nodejs');
 
 var dbFile  = require("../node_simple.js");
 var Promise = require('promise');
-
+var crypto = require('crypto');
+var resetLink = "http://localhost:3000/user/password/reset/";
+var pass = require('../config/passport');
 var csrfProtection = csrf();
 router.use(csrfProtection); // router is protected
 
@@ -135,6 +139,97 @@ router.get('/resetPassword', loggedOut, function(req, res, next) {
     req.session.errors = null;
 });
 
+router.post('/sendReset', loggedOut, function(req, res, next){
+
+    dbFile.find_user(req.body.email, function(found){
+        if (!found) {
+            res.render('reset_password', {errors: "This email does not exist in our database."});
+        } else {
+            var token = crypto.randomBytes(32).toString('hex');
+            var userToken = crypto.randomBytes(8).toString('hex');
+
+            dbFile.addToken(req.body.email, userToken, token, function(error, message){
+                if (error) {
+                    res.render('reset_password', {errors: "An error has occurred. Please try again."});
+                } else {
+                    var transporter = nodemailer.createTransport({
+                        service: "Gmail",
+                        auth: {
+                            user: 'solutionsrepo0@gmail.com',
+                            pass: 'lamptable'
+                        }
+                    });
+
+                    var mailOptions = {
+                        from: "Solutions.Repo < solutionsrepo0@gmail.com >",
+                        to: req.body.email,
+                        subject: 'Password reset on Solutions.Repo',
+                        text: "Hello!\n" +
+                        "You are receiving this email because you requested a password reset for your account at Solutions.Repo.\n" +
+                        "In order to reset your password, please visit the following link:\n" +
+                        resetLink + userToken + '/' + token + '\n' +
+                        'Thanks for using Solutions.Repo! The Solutions.Repo Team.',
+                        html: "<p>Hello!</p>" +
+                        "<p>You are receiving this email because you requested a password reset for your account at Solutions.Repo.</p>" +
+                        "<p>In order to reset your password, please visit the following link:</p>" +
+                        "<a href='"+ resetLink + userToken + '/' + token + "'>Click here!</a>" +
+                        "<p>Thanks for using Solutions.Repo! The Solutions.Repo Team.</p>"
+                    };
+
+                    transporter.sendMail(mailOptions, function(error, info) {
+                        if (error) {
+                            console.log(error);
+                            res.render('reset_password', {errors: "An error has occurred. Please try again."});
+                        } else {
+                            console.log("Message Sent");
+                            res.render('reset_password', {success: "We've e-mailed you instructions for resetting your password." +
+                            " You should be receiving the email shortly. Please check your inbox."});
+                        }
+                    });
+                }
+            });
+        }
+    });
+
+});
+
+router.get('/password/reset/:emailHash/:token', loggedOut, function(req, res, next) {
+    var emailHash = req.params.emailHash;
+    var token = req.params.token;
+
+    dbFile.getToken(token, function(err, data) {
+        if (err || !data.length) {
+            res.redirect('/');
+        } else {
+            if (data[0].userToken === emailHash) {
+                dbFile.removeToken(token, function(err, message) {
+                    if (err)
+                        console.log('could not remove token from db');
+                    else {
+                        console.log('token removed');
+                    }
+                });
+                res.render('password_edit', {email: data[0].email, csrfToken: req.csrfToken()});
+
+            } else {
+                res.redirect('/');
+            }
+        }
+    });
+});
+
+router.post('/password/change', loggedOut, function(req, res, next) {
+    var email = req.body._email.valueOf();
+    var password = req.body.password;
+    var hashed = pass.encryptPassword(password);
+    dbFile.updatePassword(email, hashed, function(err, message) {
+        if (err) {
+            res.render('password_edit', {errors: "Could not change password!"});
+        } else {
+            res.render('password_edit', {success: "Password changed."});
+        }
+    });
+});
 
 /** Render/GET signin page. */
 router.get('/signup', loggedOut, function(req, res, next) {
@@ -442,3 +537,6 @@ function isUser(req, res, next) {
     res.redirect('/admin');
 }
 
+crypto.randomBytes(32, function(ex, buf) {
+    var token = buf.toString('hex');
+});