@openneuro/server 4.16.1 → 4.17.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openneuro/server",
-  "version": "4.16.1",
+  "version": "4.17.1",
   "description": "Core service for the OpenNeuro platform.",
   "license": "MIT",
   "main": "src/server.js",
@@ -17,7 +17,7 @@
   "dependencies": {
     "@apollo/client": "3.7.2",
     "@elastic/elasticsearch": "7.15.0",
-    "@openneuro/search": "^4.16.1",
+    "@openneuro/search": "^4.17.1",
     "@passport-next/passport-google-oauth2": "^1.0.0",
     "@sentry/node": "^4.5.3",
     "apollo-server": "2.25.4",
@@ -29,7 +29,7 @@
     "date-fns": "^2.16.1",
     "draft-js": "^0.11.7",
     "draft-js-export-html": "^1.4.1",
-    "elastic-apm-node": "^3.31.0",
+    "elastic-apm-node": "3.43.0",
     "express": "^4.17.1",
     "graphql": "14.7.0",
     "graphql-bigint": "^1.0.0",
@@ -44,7 +44,7 @@
     "jsonwebtoken": "^9.0.0",
     "mime-types": "^2.1.19",
     "moment": "^2.14.1",
-    "mongoose": "^6.2.3",
+    "mongoose": "^7.0.2",
     "morgan": "^1.6.1",
     "node-mailjet": "^3.3.5",
     "object-hash": "2.1.1",
@@ -92,5 +92,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "0739211264d035ff4531bf7961232c1abd0165d5"
+  "gitHead": "c93f1fd308cddfbaef9990be47e77497a277b35e"
 }

package/src/datalad/__tests__/pagination.spec.js

@@ -20,7 +20,7 @@ describe('pagination model operations', () => {
   })
   describe('apiCursor()', () => {
     it('returns base64 string', () => {
-      expect(pagination.apiCursor(ObjectID(5))).toMatch(base64)
+      expect(pagination.apiCursor(new ObjectID(5))).toMatch(base64)
     })
   })
   describe('applyCursorToEdges()', () => {
@@ -40,7 +40,7 @@ describe('pagination model operations', () => {
     beforeAll(async () => {
       await connect(globalThis.__MONGO_URI__)
       const ds = new Dataset({
-        _id: ObjectID('5bef51a1ed211400c08e5524'),
+        _id: new ObjectID('5bef51a1ed211400c08e5524'),
         id: 'ds001001',
         created: new Date('2018-11-16T23:24:17.203Z'),
         modified: new Date('2018-11-16T23:24:25.050Z'),

package/src/graphql/resolvers/follow.js

@@ -11,7 +11,7 @@ export const followDataset = async (obj, { datasetId }, { user }) => {
   }
   if (following) {
     // unfollow
-    return following.remove().then(() => ({
+    return following.deleteOne().then(() => ({
       following: false,
       newFollower,
     }))

package/src/graphql/resolvers/stars.js

@@ -4,19 +4,19 @@ export const starDataset = async (obj, { datasetId }, { user }) => {
   const star = await Star.findOne({ datasetId, userId: user }).exec()
   const newStar = {
     datasetId,
-    userId: user
+    userId: user,
   }
   if (star) {
     // unstar
-    return star.remove().then(() => ({
+    return star.deleteOne().then(() => ({
       starred: false,
-      newStar
+      newStar,
     }))
   } else {
     const star = new Star({ datasetId, userId: user })
     return star.save().then(() => ({
       starred: true,
-      newStar
+      newStar,
     }))
   }
 }

package/src/handlers/{stars.js → stars.ts}

@@ -18,19 +18,16 @@ export default {
     const datasetId = data.datasetId
     const userId = data.userId
 
-    Star.create(
-      {
-        datasetId: datasetId,
-        userId: userId,
-      },
-      (err, response) => {
-        if (err) {
-          return next(err)
-        } else {
-          return res.send(response.$op)
-        }
-      },
-    )
+    Star.create({
+      datasetId: datasetId,
+      userId: userId,
+    })
+      .then(response => {
+        return res.send(response.$op)
+      })
+      .catch(err => {
+        next(err)
+      })
   },
 
   /**
@@ -72,19 +69,23 @@ export default {
     if (datasetId) {
       Star.find({
         datasetId: datasetId,
-      }).exec((err, stars) => {
-        if (err) {
-          return next(err)
-        }
-        res.send(stars)
       })
+        .exec()
+        .then(stars => {
+          res.send(stars)
+        })
+        .catch(err => {
+          return next(err)
+        })
     } else {
-      Star.find().exec((err, stars) => {
-        if (err) {
+      Star.find()
+        .exec()
+        .then(stars => {
+          res.send(stars)
+        })
+        .catch(err => {
           return next(err)
-        }
-        res.send(stars)
-      })
+        })
     }
   },
 }

package/src/handlers/subscriptions.js

@@ -59,17 +59,21 @@ export const deleteAll = (req, res, next) => {
   notifications.datasetDeleted(datasetId)
   Subscription.find({
     datasetId: datasetId,
-  }).exec((err, subscriptions) => {
-    if (err) {
-      return next(err)
-    }
-    subscriptions.forEach(subscription => {
-      Subscription.deleteOne({
-        _id: new ObjectID(subscription._id),
+  })
+    .exec()
+    .then(subscriptions => {
+      subscriptions.forEach(subscription => {
+        Subscription.deleteOne({
+          _id: new ObjectID(subscription._id),
+        })
       })
+      return res.send()
+    })
+    .catch(err => {
+      if (err) {
+        return next(err)
+      }
     })
-    return res.send()
-  })
 }
 
 // read
@@ -85,19 +89,23 @@ export const getSubscriptions = (req, res, next) => {
   if (datasetId) {
     Subscription.find({
       datasetId: datasetId,
-    }).exec((err, subscriptions) => {
-      if (err) {
-        return next(err)
-      }
-      res.send(subscriptions)
     })
+      .exec()
+      .then(subscriptions => {
+        res.send(subscriptions)
+      })
+      .catch(err => {
+        return next(err)
+      })
   } else {
-    Subscription.find().exec((err, subscriptions) => {
-      if (err) {
+    Subscription.find()
+      .exec()
+      .then(subscriptions => {
+        res.send(subscriptions)
+      })
+      .catch(err => {
         return next(err)
-      }
-      res.send(subscriptions)
-    })
+      })
   }
 }
 

package/src/libs/authentication/jwt.js

@@ -115,7 +115,7 @@ export const decodeJWT = token => {
   return jwt.decode(token)
 }
 
-const parsedJwtFromRequest = req => {
+export const parsedJwtFromRequest = req => {
   const jwt = jwtFromRequest(req)
   if (jwt) return decodeJWT(jwt)
   else return null

package/src/libs/authentication/orcid.js

@@ -1,4 +1,6 @@
 import passport from 'passport'
+import User from '../../models/user'
+import { parsedJwtFromRequest } from './jwt.js'
 
 export const requestAuth = passport.authenticate('orcid', {
   session: false,
@@ -16,7 +18,23 @@ export const authCallback = (req, res, next) =>
     if (!user) {
       return res.redirect('/')
     }
-    req.logIn(user, { session: false }, err => {
-      return next(err)
-    })
+    const existingAuth = parsedJwtFromRequest(req)
+    if (existingAuth) {
+      // Save ORCID to primary account
+      User.findOne({ id: existingAuth.sub }, (err, userModel) => {
+        if (err) {
+          return next(err)
+        } else {
+          userModel.orcid = user.providerId
+          return userModel.save().then(() => {
+            res.redirect('/')
+          })
+        }
+      })
+    } else {
+      // Complete login with ORCID as primary account
+      req.logIn(user, { session: false }, err => {
+        return next(err)
+      })
+    }
   })(req, res, next)

package/src/libs/authentication/passport.js

@@ -55,7 +55,7 @@ export const verifyGoogleUser = (accessToken, refreshToken, profile, done) => {
       profileUpdate,
       { upsert: true, new: true, setDefaultsOnInsert: true },
     )
-      .then(user => done(null, addJWT(config)(user)))
+      .then(user => done(null, addJWT(config)(user.toObject())))
       .catch(err => done(err, null))
   } else {
     done(profileUpdate, null)
@@ -80,7 +80,7 @@ export const verifyORCIDUser = (
         { providerId: profile.orcid, provider: profile.provider },
         profileUpdate,
         { upsert: true, new: true, setDefaultsOnInsert: true },
-      ).then(user => done(null, addJWT(config)(user)))
+      ).then(user => done(null, addJWT(config)(user.toObject())))
     })
     .catch(err => done(err, null))
 }
@@ -110,7 +110,7 @@ export const setupPassportAuth = () => {
           // A user must already exist to use a JWT to auth a request
           User.findOne({ id: jwt.sub, provider: jwt.provider })
             .then(user => {
-              if (user) done(null, user)
+              if (user) done(null, user.toObject())
               else done(null, false)
             })
             .catch(done)

package/src/libs/notifications.js

@@ -116,54 +116,56 @@ const notifications = {
     const htmlContent = stateToHTML(contentState)
 
     // get all users that are subscribed to the dataset
-    Subscription.find({ datasetId: datasetId }).exec((err, subscriptions) => {
-      // create the email object for each user, using subscription userid and scitran
-      subscriptions.forEach(subscription => {
-        User.findOne({ id: subscription.userId })
-          .exec()
-          .then(user => {
-            if (user && user.email !== userId) {
-              const emailContent = {
-                _id:
-                  datasetId +
-                  '_' +
-                  subscription._id +
-                  '_' +
-                  comment._id +
-                  '_' +
-                  'comment_created',
-                type: 'email',
-                email: {
-                  to: user.email,
-                  name: user.name,
-                  from:
-                    'reply-' +
-                    encodeURIComponent(comment._id) +
-                    '-' +
-                    encodeURIComponent(user._id),
-                  subject: 'Comment Created',
-                  html: commentCreated({
+    Subscription.find({ datasetId: datasetId })
+      .exec()
+      .then(subscriptions => {
+        // create the email object for each user, using subscription userid and scitran
+        subscriptions.forEach(subscription => {
+          User.findOne({ id: subscription.userId })
+            .exec()
+            .then(user => {
+              if (user && user.email !== userId) {
+                const emailContent = {
+                  _id:
+                    datasetId +
+                    '_' +
+                    subscription._id +
+                    '_' +
+                    comment._id +
+                    '_' +
+                    'comment_created',
+                  type: 'email',
+                  email: {
+                    to: user.email,
                     name: user.name,
-                    datasetName: bidsId.decodeId(datasetId),
-                    datasetLabel: datasetLabel,
-                    commentUserId: userId,
-                    commentId: commentId,
-                    dateCreated: moment(comment.createDate).format('MMMM Do'),
-                    commentContent: htmlContent,
-                    commentStatus: commentStatus,
-                    siteUrl:
-                      url.parse(config.url).protocol +
-                      '//' +
-                      url.parse(config.url).hostname,
-                  }),
-                },
+                    from:
+                      'reply-' +
+                      encodeURIComponent(comment._id) +
+                      '-' +
+                      encodeURIComponent(user._id),
+                    subject: 'Comment Created',
+                    html: commentCreated({
+                      name: user.name,
+                      datasetName: bidsId.decodeId(datasetId),
+                      datasetLabel: datasetLabel,
+                      commentUserId: userId,
+                      commentId: commentId,
+                      dateCreated: moment(comment.createDate).format('MMMM Do'),
+                      commentContent: htmlContent,
+                      commentStatus: commentStatus,
+                      siteUrl:
+                        url.parse(config.url).protocol +
+                        '//' +
+                        url.parse(config.url).hostname,
+                    }),
+                  },
+                }
+                // send each email to the notification database for distribution
+                notifications.send(emailContent)
               }
-              // send each email to the notification database for distribution
-              notifications.send(emailContent)
-            }
-          })
+            })
+        })
       })
-    })
   },
 
   /**
@@ -180,36 +182,42 @@ const notifications = {
     )
 
     // get all users that are subscribed to the dataset
-    Subscription.find({ datasetId: datasetId }).exec((err, subscriptions) => {
-      // create the email object for each user, using subscription userid and scitran
-      subscriptions.forEach(subscription => {
-        User.findOne({ id: subscription.userId })
-          .exec()
-          .then(user => {
-            if (user) {
-              const emailContent = {
-                _id:
-                  datasetId + '_' + subscription._id + '_' + 'dataset_deleted',
-                type: 'email',
-                email: {
-                  to: user.email,
-                  name: user.name,
-                  subject: 'Dataset Deleted',
-                  html: datasetDeleted({
+    Subscription.find({ datasetId: datasetId })
+      .exec()
+      .then(subscriptions => {
+        // create the email object for each user, using subscription userid and scitran
+        subscriptions.forEach(subscription => {
+          User.findOne({ id: subscription.userId })
+            .exec()
+            .then(user => {
+              if (user) {
+                const emailContent = {
+                  _id:
+                    datasetId +
+                    '_' +
+                    subscription._id +
+                    '_' +
+                    'dataset_deleted',
+                  type: 'email',
+                  email: {
+                    to: user.email,
                     name: user.name,
-                    datasetName: bidsId.decodeId(datasetId),
-                    siteUrl:
-                      url.parse(config.url).protocol +
-                      '//' +
-                      url.parse(config.url).hostname,
-                  }),
-                },
+                    subject: 'Dataset Deleted',
+                    html: datasetDeleted({
+                      name: user.name,
+                      datasetName: bidsId.decodeId(datasetId),
+                      siteUrl:
+                        url.parse(config.url).protocol +
+                        '//' +
+                        url.parse(config.url).hostname,
+                    }),
+                  },
+                }
+                notifications.send(emailContent)
               }
-              notifications.send(emailContent)
-            }
-          })
+            })
+        })
       })
-    })
   },
 
   /**
@@ -226,40 +234,42 @@ const notifications = {
     )
 
     // get all users that are subscribed to the dataset
-    Subscription.find({ datasetId: datasetId }).exec((err, subscriptions) => {
-      // create the email object for each user, using subscription userid and scitran
-      subscriptions.forEach(subscription => {
-        User.findOne({ id: subscription.userId })
-          .exec()
-          .then(user => {
-            if (user) {
-              const emailContent = {
-                _id:
-                  datasetId +
-                  '_' +
-                  subscription._id +
-                  '_' +
-                  'owner_unsubscribed',
-                type: 'email',
-                email: {
-                  to: user.email,
-                  name: user.name,
-                  subject: 'Owner Unsubscribed',
-                  html: ownerUnsubscribed({
+    Subscription.find({ datasetId: datasetId })
+      .exec()
+      .then(subscriptions => {
+        // create the email object for each user, using subscription userid and scitran
+        subscriptions.forEach(subscription => {
+          User.findOne({ id: subscription.userId })
+            .exec()
+            .then(user => {
+              if (user) {
+                const emailContent = {
+                  _id:
+                    datasetId +
+                    '_' +
+                    subscription._id +
+                    '_' +
+                    'owner_unsubscribed',
+                  type: 'email',
+                  email: {
+                    to: user.email,
                     name: user.name,
-                    datasetName: bidsId.decodeId(datasetId),
-                    siteUrl:
-                      url.parse(config.url).protocol +
-                      '//' +
-                      url.parse(config.url).hostname,
-                  }),
-                },
+                    subject: 'Owner Unsubscribed',
+                    html: ownerUnsubscribed({
+                      name: user.name,
+                      datasetName: bidsId.decodeId(datasetId),
+                      siteUrl:
+                        url.parse(config.url).protocol +
+                        '//' +
+                        url.parse(config.url).hostname,
+                    }),
+                  },
+                }
+                notifications.send(emailContent)
               }
-              notifications.send(emailContent)
-            }
-          })
+            })
+        })
       })
-    })
   },
 
   /**
@@ -276,8 +286,9 @@ const notifications = {
     )
 
     // get all users that are subscribed to the dataset
-    await Subscription.find({ datasetId: datasetId }).exec(
-      (err, subscriptions) => {
+    await Subscription.find({ datasetId: datasetId })
+      .exec()
+      .then(subscriptions => {
         // create the email object for each user, using subscription userid and scitran
         subscriptions.forEach(subscription => {
           User.findOne({ id: subscription.userId })
@@ -312,8 +323,7 @@ const notifications = {
               }
             })
         })
-      },
-    )
+      })
   },
 
   /**

package/src/libs/orcid.js

@@ -20,12 +20,22 @@ export default {
         },
         (err, res) => {
           if (err) {
-            reject({
+            return reject({
               message:
                 'An unexpected ORCID login failure occurred, please try again later.',
             })
           }
-          const doc = new xmldoc.XmlDocument(res.body)
+          let doc
+          // Catch issues with parsing this response
+          try {
+            doc = new xmldoc.XmlDocument(res.body)
+          } catch (err) {
+            return reject({
+              type: 'config',
+              message:
+                'ORCID auth response invalid, most likely this is a misconfigured ORCID_API_ENDPOINT value',
+            })
+          }
           let name = doc.valueWithPath(
             'person:person.person:name.personal-details:credit-name',
           )
@@ -41,13 +51,13 @@ export default {
 
           if (!name) {
             if (!firstname) {
-              reject({
+              return reject({
                 type: 'given',
                 message:
                   'Your ORCID account does not have a given name, or it is not public. Please fix your account before continuing.',
               })
             } else if (!lastname) {
-              reject({
+              return reject({
                 type: 'family',
                 message:
                   'Your ORCID account does not have a family name, or it is not public. Please fix your account before continuing.',
@@ -58,7 +68,7 @@ export default {
           }
 
           if (!email) {
-            reject({
+            return reject({
               type: 'email',
               message:
                 'Your ORCID account does not have an e-mail, or your e-mail is not public. Please fix your account before continuing.',

package/src/models/__tests__/ingestDataset.spec.ts

@@ -6,9 +6,8 @@ vi.mock('ioredis')
 describe('IngestDataset model', () => {
   it('IngestDataset model fails if required fields are missing', () => {
     const model = new IngestDataset()
-    model.validate(result => {
-      expect(result.name).toEqual('ValidationError')
-    })
+    const result = model.validateSync()
+    expect(result.name).toEqual('ValidationError')
   })
   it('IngestDataset model URL validation fails with a bad URL', async () => {
     const badUrlModel = new IngestDataset({
@@ -18,9 +17,8 @@ describe('IngestDataset model', () => {
       imported: false,
       notified: false,
     })
-    await badUrlModel.validate(result => {
-      expect(result.name).toEqual('ValidationError')
-    })
+    const result = badUrlModel.validateSync()
+    expect(result.name).toEqual('ValidationError')
   })
   it('IngestDataset model URL validation succeeds with a good URL', async () => {
     const goodUrlModel = new IngestDataset({
@@ -30,8 +28,7 @@ describe('IngestDataset model', () => {
       imported: false,
       notified: false,
     })
-    await goodUrlModel.validate(result => {
-      expect(result).toBe(undefined)
-    })
+    const result = goodUrlModel.validateSync()
+    expect(result).toBe(undefined)
   })
 })

package/src/models/dataset.ts

@@ -74,24 +74,17 @@ datasetSchema.virtual('subscriptions', {
   justOne: true,
 })
 
-datasetSchema.post('save', dataset => {
-  new DatasetChange({
-    datasetId: dataset.id,
-    created: true,
-  }).save()
-})
-
 datasetSchema.post('updateOne', function () {
-  const datasetId = this._conditions ? this._conditions.id : null
-  new DatasetChange({
+  const datasetId = this.getQuery()?.['id']
+  return new DatasetChange({
     datasetId,
     modified: true,
   }).save()
 })
 
 datasetSchema.post('deleteOne', function () {
-  const datasetId = this._conditions ? this._conditions.id : null
-  new DatasetChange({
+  const datasetId = this.getQuery()?.['id']
+  return new DatasetChange({
     datasetId,
     deleted: true,
   }).save()