nodebb-plugin-session-sharing 4.7.1 → 5.1.0

package/library.js

@@ -1,26 +1,24 @@
 'use strict';
 
-var meta = require.main.require('./src/meta');
-var user = require.main.require('./src/user');
-var groups = require.main.require('./src/groups');
-var SocketPlugins = require.main.require('./src/socket.io/plugins');
+const winston = module.parent.require('winston');
+const nconf = module.parent.require('nconf');
 
-var winston = module.parent.require('winston');
-var nconf = module.parent.require('nconf');
+const _ = require('lodash');
 
-var _ = require('lodash');
-var async = require('async');
+const meta = require.main.require('./src/meta');
+const user = require.main.require('./src/user');
+const groups = require.main.require('./src/groups');
+const SocketPlugins = require.main.require('./src/socket.io/plugins');
+const db = require.main.require('./src/database');
+const plugins = require.main.require('./src/plugins');
 
-var db = require.main.require('./src/database');
-var plugins = require.main.require('./src/plugins');
+const jwt = require('jsonwebtoken');
 
-var jwt = require('jsonwebtoken');
-
-var controllers = require('./lib/controllers');
-var nbbAuthController = require.main.require('./src/controllers/authentication');
+const controllers = require('./lib/controllers');
+const nbbAuthController = require.main.require('./src/controllers/authentication');
 
 /* all the user profile fields that can be passed to user.updateProfile */
-var profileFields = [
+const profileFields = [
 	'username',
 	'email',
 	'fullname',
@@ -31,7 +29,7 @@ var profileFields = [
 	'signature',
 	'aboutme',
 ];
-var payloadKeys = profileFields.concat([
+const payloadKeys = profileFields.concat([
 	'id', // the uniq identifier of that account
 	'firstName', // for backwards compatibillity
 	'lastName', // dto.
@@ -39,7 +37,7 @@ var payloadKeys = profileFields.concat([
 	'groups',
 ]);
 
-var plugin = {
+const plugin = {
 	ready: false,
 	settings: {
 		name: 'appId',
@@ -50,6 +48,7 @@ var plugin = {
 		adminRevalidate: 'off',
 		noRegistration: 'off',
 		payloadParent: undefined,
+		allowBannedUsers: false,
 	},
 };
 
@@ -57,7 +56,7 @@ payloadKeys.forEach(function (key) {
 	plugin.settings['payload:' + key] = key;
 });
 
-plugin.init = function (params, callback) {
+plugin.init = async (params) => {
 	var router = params.router;
 	var hostMiddleware = params.middleware;
 
@@ -71,10 +70,10 @@ plugin.init = function (params, callback) {
 		router.get('/debug/session', plugin.generate);
 	}
 
-	plugin.reloadSettings(callback);
+	await plugin.reloadSettings();
 };
 
-plugin.appendConfig = function (config, callback) {
+plugin.appendConfig = async (config) => {
 	config.sessionSharing = {
 		logoutRedirect: plugin.settings.logoutRedirect,
 		loginOverride: plugin.settings.loginOverride,
@@ -83,45 +82,30 @@ plugin.appendConfig = function (config, callback) {
 		hostWhitelist: plugin.settings.hostWhitelist,
 	};
 
-	callback(null, config);
+	return config;
 };
 
 /* Websocket Listeners */
 
 SocketPlugins.sessionSharing = {};
 
-SocketPlugins.sessionSharing.showUserIds = function (socket, data, callback) {
+SocketPlugins.sessionSharing.showUserIds = async (socket, data) => {
 	// Retrieve the hash and find matches
-	var uids = data.uids;
-	var payload = [];
-
-	payload.length = uids.length;
-
-	if (uids.length) {
-		async.map(uids, function (uid, next) {
-			db.getSortedSetRangeByScore(plugin.settings.name + ':uid', 0, -1, uid, uid, next);
-		}, function (err, remoteIds) {
-			if (err) {
-				return callback(err);
-			}
+	const { uids } = data;
 
-			remoteIds.forEach(function (remoteId, idx) {
-				payload[idx] = remoteId;
-			});
-
-			callback(null, payload);
-		});
-	} else {
-		callback(new Error('no-uids-supplied'));
+	if (!uids.length) {
+		throw new Error('no-uids-supplied');
 	}
+
+	return Promise.all(uids.map(async uid => db.getSortedSetRangeByScore(plugin.settings.name + ':uid', 0, -1, uid, uid)));
 };
 
-SocketPlugins.sessionSharing.findUserByRemoteId = function (socket, data, callback) {
-	if (data.remoteId) {
-		plugin.getUser(data.remoteId, callback);
-	} else {
-		callback(new Error('no-remote-id-supplied'));
+SocketPlugins.sessionSharing.findUserByRemoteId = async (socket, data) => {
+	if (!data.remoteId) {
+		throw new Error('no-remote-id-supplied');
 	}
+
+	return plugin.getUser(data.remoteId);
 };
 
 /* End Websocket Listeners */
@@ -129,32 +113,28 @@ SocketPlugins.sessionSharing.findUserByRemoteId = function (socket, data, callba
 /*
  *	Given a remoteId, show user data
  */
-plugin.getUser = function (remoteId, callback) {
-	async.waterfall([
-		async.apply(db.sortedSetScore, plugin.settings.name + ':uid', remoteId),
-		function (uid, next) {
-			if (uid) {
-				user.getUserFields(uid, ['username', 'userslug', 'picture'], next);
-			} else {
-				setImmediate(next);
-			}
-		},
-	], callback);
+plugin.getUser = async (remoteId) => {
+	const uid = await db.sortedSetScore(plugin.settings.name + ':uid', remoteId);
+
+	if (!uid) {
+		return;
+	}
+
+	return user.getUserFields(uid, ['username', 'userslug', 'picture']);
 };
 
-plugin.process = function (token, callback) {
-	async.waterfall([
-		async.apply(jwt.verify, token, plugin.settings.secret),
-		async.apply(plugin.normalizePayload),
-		async.apply(plugin.findOrCreateUser),
-		async.apply(plugin.updateUserProfile),
-		async.apply(plugin.updateUserGroups),
-		async.apply(plugin.verifyUser, token),
-	], callback);
+plugin.process = async (token) => {
+	const payload = await jwt.verify(token, plugin.settings.secret);
+	const userData = await plugin.normalizePayload(payload);
+	const [uid, isNewUser] = await plugin.findOrCreateUser(userData);
+	await plugin.updateUserProfile(uid, userData, isNewUser);
+	await plugin.updateUserGroups(uid, userData);
+	await plugin.verifyUser(token, uid, isNewUser);
+	return uid;
 };
 
-plugin.normalizePayload = function (payload, callback) {
-	var userData = {};
+plugin.normalizePayload = async (payload) => {
+	const userData = {};
 
 	if (plugin.settings.payloadParent) {
 		payload = payload[plugin.settings.payloadParent];
@@ -162,11 +142,11 @@ plugin.normalizePayload = function (payload, callback) {
 
 	if (typeof payload !== 'object') {
 		winston.warn('[session-sharing] the payload is not an object', payload);
-		return callback(new Error('payload-invalid'));
+		throw new Error('payload-invalid');
 	}
 
 	payloadKeys.forEach(function (key) {
-		var propName = plugin.settings['payload:' + key];
+		const propName = plugin.settings['payload:' + key];
 		if (payload[propName]) {
 			userData[key] = payload[propName];
 		}
@@ -174,7 +154,7 @@ plugin.normalizePayload = function (payload, callback) {
 
 	if (!userData.id) {
 		winston.warn('[session-sharing] No user id was given in payload');
-		return callback(new Error('payload-invalid'));
+		throw new Error('payload-invalid');
 	}
 
 	userData.fullname = (userData.fullname || [userData.firstName, userData.lastName].join(' ')).trim();
@@ -188,7 +168,7 @@ plugin.normalizePayload = function (payload, callback) {
 
 	if (!userData.username) {
 		winston.warn('[session-sharing] No valid username could be determined');
-		return callback(new Error('payload-invalid'));
+		throw new Error('payload-invalid');
 	}
 
 	if (userData.hasOwnProperty('groups') && !Array.isArray(userData.groups)) {
@@ -197,218 +177,185 @@ plugin.normalizePayload = function (payload, callback) {
 	}
 
 	winston.verbose('[session-sharing] Payload verified');
-	plugins.fireHook('filter:sessionSharing.normalizePayload', {
+	const data = await plugins.hooks.fire('filter:sessionSharing.normalizePayload', {
 		payload: payload,
 		userData: userData,
-	}, function (err, data) {
-		callback(err, data.userData);
 	});
+
+	return data.userData;
 };
 
-plugin.verifyUser = function (token, uid, isNewUser, callback) {
-	plugins.fireHook('static:sessionSharing.verifyUser', {
+plugin.verifyUser = async (token, uid, isNewUser) => {
+	await plugins.hooks.fire('static:sessionSharing.verifyUser', {
 		uid: uid,
 		isNewUser: isNewUser,
 		token: token,
-	}, function (err) {
-		if (err) {
-			return callback(err);
-		}
-		// Check ban state of user, reject if banned
-		user.bans.isBanned(uid, function (err, banned) {
-			callback(err || banned ? new Error('banned') : null, uid);
-		});
 	});
+
+	// Check ban state of user
+	const isBanned = await user.bans.isBanned(uid);
+
+	// Reject if banned and settings dont allow banned users to login
+	if (isBanned && !plugin.settings.allowBannedUsers) {
+		throw new Error('banned');
+	}
 };
 
-plugin.findOrCreateUser = function (userData, callback) {
-	var queries = {};
+plugin.findOrCreateUser = async (userData) => {
+	const { id } = userData;
+	let isNewUser = false;
+	let userId = null;
+	let queries = [db.sortedSetScore(plugin.settings.name + ':uid', userData.id)];
+
 	if (userData.email && userData.email.length) {
-		queries.mergeUid = async.apply(db.sortedSetScore, 'email:uid', userData.email);
-	}
-	queries.uid = async.apply(db.sortedSetScore, plugin.settings.name + ':uid', userData.id);
-
-	async.parallel(queries, function (err, checks) {
-		if (err) { return callback(err); }
-
-		async.waterfall([
-			/* check if found something to work with */
-			function (next) {
-				if (checks.uid && !isNaN(parseInt(checks.uid, 10))) {
-					var uid = parseInt(checks.uid, 10);
-					/* check if the user with the given id actually exists */
-					return user.exists(uid, function (err, exists) {
-						/* ignore errors, but assume the user doesn't exist  */
-						if (err) {
-							winston.warn('[session-sharing] Error while testing user existance', err);
-							return next(null, null);
-						}
-						if (exists) {
-							return next(null, uid);
-						}
-						/* reference is outdated, user got deleted */
-						db.sortedSetRemove(plugin.settings.name + ':uid', userData.id, function (err) {
-							next(err, null);
-						});
-					});
-				}
-				if (checks.mergeUid && !isNaN(parseInt(checks.mergeUid, 10))) {
-					winston.info('[session-sharing] Found user via their email, associating this id (' + userData.id + ') with their NodeBB account');
-					return db.sortedSetAdd(plugin.settings.name + ':uid', checks.mergeUid, userData.id, function (err) {
-						next(err, parseInt(checks.mergeUid, 10));
-					});
-				}
-				setImmediate(next, null, null);
-			},
-			/* create the user from payload if necessary */
-			function (uid, next) {
-				winston.debug('createUser?', !uid);
-				if (!uid) {
-					if (plugin.settings.noRegistration === 'on') {
-						return next(new Error('no-match'));
-					}
-					return plugin.createUser(userData, function (err, uid) {
-						next(err, uid, userData, true);
-					});
-				}
-				setImmediate(next, null, uid, userData, false);
-			},
-		], callback);
-	});
+		queries = [...queries, db.sortedSetScore('email:uid', userData.email)];
+	}
+
+	let [uid, mergeUid] = await Promise.all(queries);
+	uid = parseInt(uid, 10);
+	mergeUid = parseInt(mergeUid, 10);
+
+	/* check if found something to work with */
+	if (uid && !isNaN(uid)) {
+		try {
+			/* check if the user with the given id actually exists */
+			const exists = await user.exists(uid);
+
+			if (exists) {
+				userId = uid;
+			} else {
+				/* reference is outdated, user got deleted */
+				await db.sortedSetRemove(plugin.settings.name + ':uid', id);
+			}
+		} catch (error) {
+			/* ignore errors, but assume the user doesn't exist  */
+			winston.warn('[session-sharing] Error while testing user existance', error);
+		}
+	}
+
+	if (!userId && mergeUid && !isNaN(mergeUid)) {
+		winston.info('[session-sharing] Found user via their email, associating this id (' + id + ') with their NodeBB account');
+		await db.sortedSetAdd(plugin.settings.name + ':uid', mergeUid, id);
+		userId = mergeUid;
+	}
+
+	/* create the user from payload if necessary */
+	winston.debug('createUser?', !userId);
+	if (!userId) {
+		if (plugin.settings.noRegistration === 'on') {
+			throw new Error('no-match');
+		}
+
+		userId = await plugin.createUser(userData);
+		isNewUser = true;
+	}
+
+	return [userId, isNewUser];
 };
 
-plugin.updateUserProfile = function (uid, userData, isNewUser, callback) {
+plugin.updateUserProfile = async (uid, userData, isNewUser) => {
 	winston.debug('consider updateProfile?', isNewUser || plugin.settings.updateProfile === 'on');
+	let userObj = {};
 
 	/* even update the profile on a new account, since some fields are not initialized by NodeBB */
 	if (!isNewUser && plugin.settings.updateProfile !== 'on') {
-		return setImmediate(callback, null, uid, userData, isNewUser);
+		return;
 	}
 
-	async.waterfall([
-		function (next) {
-			user.getUserFields(uid, profileFields, next);
-		},
-		function (existingFields, next) {
-			var obj = {};
+	const existingFields = await user.getUserFields(uid, profileFields);
+	const obj = profileFields.reduce((result, field) => {
+		if (typeof userData[field] !== 'undefined' && existingFields[field] !== userData[field]) {
+			result[field] = userData[field];
+		}
 
-			profileFields.forEach(function (field) {
-				if (typeof userData[field] !== 'undefined' && existingFields[field] !== userData[field]) {
-					obj[field] = userData[field];
-				}
-			});
+		return result;
+	}, {});
 
-			if (Object.keys(obj).length) {
-				winston.debug('[session-sharing] Updating profile fields:', obj);
-				obj.uid = uid;
-				return user.updateProfile(uid, obj, function (err, userObj) {
-					if (err) {
-						winston.warn('[session-sharing] Unable to update profile information for uid: ' + uid + '(' + err.message + ')');
-					}
-
-					// If it errors out, not that big of a deal, continue anyway.
-					next(null, userObj || existingFields);
-				});
-			}
-			setImmediate(next, null, {});
-		},
-		function (userObj, next) {
-			if (userData.picture) {
-				return db.setObjectField('user:' + uid, 'picture', userData.picture, next);
+	if (Object.keys(obj).length) {
+		winston.debug('[session-sharing] Updating profile fields:', obj);
+		obj.uid = uid;
+		try {
+			userObj = await user.updateProfile(uid, obj);
+
+			// If it errors out, not that big of a deal, continue anyway.
+			if (!userObj) {
+				userObj = existingFields;
 			}
+		} catch (error) {
+			winston.warn('[session-sharing] Unable to update profile information for uid: ' + uid + '(' + error.message + ')');
+		}
+	}
 
-			setImmediate(next, null);
-		},
-	], function (err) {
-		return callback(err, uid, userData, isNewUser);
-	});
+	if (userData.picture) {
+		await db.setObjectField('user:' + uid, 'picture', userData.picture);
+	}
 };
 
-plugin.updateUserGroups = function (uid, userData, isNewUser, callback) {
+plugin.updateUserGroups = async (uid, userData) => {
 	if (!userData.groups || !Array.isArray(userData.groups)) {
-		return setImmediate(callback, null, uid, isNewUser);
+		return;
 	}
 
-	async.waterfall([
-		// Retrieve user groups
-		async.apply(groups.getUserGroupsFromSet, 'groups:createtime', [uid]),
-		function (groups, next) {
-			// Normalize user group data to just group names
-			groups = groups[0].map(function (groupObj) {
-				return groupObj.name;
-			});
-
-			// Build join and leave arrays
-			var join = userData.groups.filter(function (name) {
-				return !groups.includes(name);
-			});
-
-			if (plugin.settings.syncGroupList === 'on') {
-				join = join.filter(group => plugin.settings.syncGroups.includes(group));
-			}
-
-			var leave = groups.filter(function (name) {
-				// `registered-users` is always a joined group
-				if (name === 'registered-users') {
-					return false;
-				}
+	// Retrieve user groups
+	let [userGroups] = await groups.getUserGroupsFromSet('groups:createtime', [uid]);
+	// Normalize user group data to just group names
+	userGroups = userGroups.map(groupObj => groupObj.name);
 
-				return !userData.groups.includes(name);
-			});
+	// Build join and leave arrays
+	let join = userData.groups.filter(name => !userGroups.includes(name));
+	if (plugin.settings.syncGroupList === 'on') {
+		join = join.filter(group => plugin.settings.syncGroups.includes(group));
+	}
 
-			if (plugin.settings.syncGroupList === 'on') {
-				leave = leave.filter(group => plugin.settings.syncGroups.includes(group));
-			}
+	let leave = userGroups.filter((name) => {
+		// `registered-users` is always a joined group
+		if (name === 'registered-users') {
+			return false;
+		}
 
-			executeJoinLeave(uid, join, leave, next);
-		},
-	], function (err) {
-		return callback(err, uid, isNewUser);
+		return !userData.groups.includes(name);
 	});
+	if (plugin.settings.syncGroupList === 'on') {
+		leave = leave.filter(group => plugin.settings.syncGroups.includes(group));
+	}
+
+	await executeJoinLeave(uid, join, leave);
 };
 
-function executeJoinLeave(uid, join, leave, callback) {
-	async.parallel([
-		function (next) {
+async function executeJoinLeave(uid, join, leave) {
+	await Promise.all([
+		(async () => {
 			if (plugin.settings.syncGroupJoin !== 'on') {
-				return setImmediate(next);
+				return;
 			}
 
-			async.each(join, function (name, next) {
-				groups.join(name, uid, next);
-			}, next);
-		},
-		function (next) {
+			await Promise.all(join.map(name => groups.join(name, uid)));
+		})(),
+		(async () => {
 			if (plugin.settings.syncGroupLeave !== 'on') {
-				return setImmediate(next);
+				return;
 			}
 
-			async.each(leave, function (name, next) {
-				groups.leave(name, uid, next);
-			}, next);
-		},
-	], callback);
+			await Promise.all(leave.map(name => groups.leave(name, uid)));
+		})(),
+	]);
 }
 
-plugin.createUser = function (userData, callback) {
+plugin.createUser = async (userData) => {
 	winston.verbose('[session-sharing] No user found, creating a new user for this login');
 
-	user.create(_.pick(userData, profileFields), function (err, uid) {
-		if (err) { return callback(err); }
-
-		db.sortedSetAdd(plugin.settings.name + ':uid', uid, userData.id, function (err) {
-			callback(err, uid);
-		});
-	});
+	const uid = await user.create(_.pick(userData, profileFields));
+	await db.sortedSetAdd(plugin.settings.name + ':uid', uid, userData.id);
+	return uid;
 };
 
-plugin.addMiddleware = async function (req, res, next) {
+plugin.addMiddleware = async function ({ req, res }) {
 	const { hostWhitelist, guestRedirect, editOverride, loginOverride, registerOverride } = await meta.settings.get('session-sharing');
 
 	if (hostWhitelist) {
-		var hosts = hostWhitelist.split(',') || [hostWhitelist];
-		var whitelisted = false;
-		for (var host of hosts) {
+		const hosts = hostWhitelist.split(',') || [hostWhitelist];
+		let whitelisted = false;
+		for (const host of hosts) {
 			if (req.headers.host.includes(host)) {
 				whitelisted = true;
 				break;
@@ -416,35 +363,33 @@ plugin.addMiddleware = async function (req, res, next) {
 		}
 
 		if (!whitelisted) {
-			return next();
+			return;
 		}
 	}
 
-	function handleGuest(req, res, next) {
+	function handleGuest(req, res) {
 		if (guestRedirect && !req.originalUrl.startsWith(nconf.get('relative_path') + '/login?local=1')) {
 			// If a guest redirect is specified, follow it
 			res.redirect(guestRedirect.replace('%1', encodeURIComponent(req.protocol + '://' + req.get('host') + req.originalUrl)));
 		} else if (res.locals.fullRefresh === true) {
 			res.redirect(nconf.get('relative_path') + req.url);
-		} else {
-			next();
 		}
 	}
 
 	// Only respond to page loads by guests, not api or asset calls
-	var hasSession = req.hasOwnProperty('user') && req.user.hasOwnProperty('uid') && parseInt(req.user.uid, 10) > 0;
-	var hasLoginLock = req.session.hasOwnProperty('loginLock');
+	const hasSession = req.hasOwnProperty('user') && req.user.hasOwnProperty('uid') && parseInt(req.user.uid, 10) > 0;
+	const hasLoginLock = req.session.hasOwnProperty('loginLock');
 
 	if (
 		!plugin.ready ||	// plugin not ready
 		(plugin.settings.behaviour === 'trust' && hasSession) ||	// user logged in + "trust" behaviour
-		(plugin.settings.behaviour === 'revalidate' && hasLoginLock) ||
+		((plugin.settings.behaviour === 'revalidate' || plugin.settings.behaviour === 'update') && hasLoginLock) ||
 		req.originalUrl.startsWith(nconf.get('relative_path') + '/api')	// api routes
 	) {
-		// Let requests through under "revalidate" behaviour only if they're logging in for the first time
-		delete req.session.loginLock;	// remove login lock for "revalidate" logins
+		// Let requests through under "update" or "revalidate" behaviour only if they're logging in for the first time
+		delete req.session.loginLock;	// remove login lock for "update" or "revalidate" logins
 
-		return next();
+		return;
 	}
 
 	if (editOverride && hasSession && req.originalUrl.match(/\/user\/.*\/edit$/)) {
@@ -458,89 +403,78 @@ plugin.addMiddleware = async function (req, res, next) {
 	}
 
 	// Hook into ip blacklist functionality in core
-	meta.blacklist.test(req.ip, function (err) {
-		if (err) {
-			if (hasSession) {
-				req.logout();
-				res.locals.fullRefresh = true;
+	try {
+		await meta.blacklist.test(req.ip);
+	} catch (error) {
+		if (hasSession) {
+			req.logout();
+			res.locals.fullRefresh = true;
+		}
+
+		await plugin.cleanup({ res: res });
+		return handleGuest.call(null, req, res);
+	}
+
+	if (Object.keys(req.cookies).length && req.cookies.hasOwnProperty(plugin.settings.cookieName) && req.cookies[plugin.settings.cookieName].length) {
+		try {
+			const uid = await plugin.process(req.cookies[plugin.settings.cookieName]);
+			winston.verbose('[session-sharing] Processing login for uid ' + uid + ', path ' + req.originalUrl);
+			req.uid = uid;
+
+			if (plugin.settings.behaviour === 'revalidate') {
+				res.locals.reroll = false;	// disable session rerolling in core
 			}
 
-			plugin.cleanup({ res: res });
-			return handleGuest.call(null, req, res, next);
-		}
-		if (Object.keys(req.cookies).length && req.cookies.hasOwnProperty(plugin.settings.cookieName) && req.cookies[plugin.settings.cookieName].length) {
-			return plugin.process(req.cookies[plugin.settings.cookieName], function (err, uid) {
-				if (err) {
-					var handleAsGuest = false;
-
-					switch (err.message) {
-					case 'banned':
-						winston.info('[session-sharing] uid ' + uid + ' is banned, not logging them in');
-						req.session.sessionSharing = {
-							banned: true,
-							uid: uid,
-						};
-						break;
-					case 'payload-invalid':
-						winston.warn('[session-sharing] The passed-in payload was invalid and could not be processed');
-						break;
-					case 'no-match':
-						winston.info('[session-sharing] Payload valid, but local account not found.  Assuming guest.');
-						handleAsGuest = true;
-						break;
-					default:
-						winston.warn('[session-sharing] Error encountered while parsing token: ' + err.message);
-						break;
-					}
-
-					return plugins.fireHook('filter:sessionSharing.error', {
-						error: err,
-						uid: uid,
-						res: res,
-						settings: plugin.settings,
-						handleAsGuest: handleAsGuest,
-					}, function (err, data) {
-						if (data.handleAsGuest) {
-							return handleGuest.call(err, req, res, next);
-						}
-
-						next(err);
-					});
-				}
-
-				winston.verbose('[session-sharing] Processing login for uid ' + uid + ', path ' + req.originalUrl);
-				req.uid = uid;
-
-				if (plugin.settings.behaviour === 'revalidate') {
-					res.locals.reroll = false;	// disable session rerolling in core
-				}
-
-				nbbAuthController.doLogin(req, uid, function () {
-					req.session.loginLock = true;
-					const url = req.session.returnTo || req.originalUrl.replace(nconf.get('relative_path'), '');
-					delete req.session.returnTo;
-					res.redirect(nconf.get('relative_path') + url);
-				});
-			});
-		} else if (hasSession) {
-			// Has login session but no cookie, can assume "revalidate" behaviour
-			user.isAdministrator(req.user.uid, function (err, isAdmin) {
-				if (plugin.settings.adminRevalidate === 'on' || !isAdmin) {
-					req.logout();
-					res.locals.fullRefresh = true;
-					handleGuest(req, res, next);
-				} else {
-					// Admins can bypass
-					return next(err);
-				}
+			await nbbAuthController.doLogin(req, uid);
+
+			req.session.loginLock = true;
+			const url = req.session.returnTo || req.originalUrl.replace(nconf.get('relative_path'), '');
+			delete req.session.returnTo;
+			res.redirect(nconf.get('relative_path') + url);
+		} catch (error) {
+			let handleAsGuest = false;
+
+			switch (error.message) {
+			case 'payload-invalid':
+				winston.warn('[session-sharing] The passed-in payload was invalid and could not be processed');
+				break;
+			case 'no-match':
+				winston.info('[session-sharing] Payload valid, but local account not found.  Assuming guest.');
+				handleAsGuest = true;
+				break;
+			default:
+				winston.warn('[session-sharing] Error encountered while parsing token: ' + error.message);
+				break;
+			}
+
+			const data = await plugins.hooks.fire('filter:sessionSharing.error', {
+				error,
+				res: res,
+				settings: plugin.settings,
+				handleAsGuest: handleAsGuest,
 			});
-		} else {
-			handleGuest.call(null, req, res, next);
+
+			if (data.handleAsGuest) {
+				return handleGuest.call(error, req, res);
+			}
+
+			throw error;
 		}
-	});
+	} else if (hasSession) {
+		// Has login session but no cookie, can assume "revalidate" behaviour
+		const isAdmin = await user.isAdministrator(req.user.uid);
+
+		if (plugin.settings.behaviour !== 'update' && (plugin.settings.adminRevalidate === 'on' || !isAdmin)) {
+			req.logout();
+			res.locals.fullRefresh = true;
+			return handleGuest(req, res);
+		}
+	} else {
+		return handleGuest.call(null, req, res);
+	}
 };
 
-plugin.cleanup = function (data, callback) {
+plugin.cleanup = async (data) => {
 	if (plugin.settings.cookieDomain) {
 		winston.verbose('[session-sharing] Clearing cookie');
 		data.res.clearCookie(plugin.settings.cookieName, {
@@ -550,15 +484,21 @@ plugin.cleanup = function (data, callback) {
 		});
 	}
 
-	if (typeof callback === 'function') {
-		callback();
-	} else {
-		return true;
-	}
+	data.res.clearCookie('nbb_token', {
+		domain: plugin.settings.cookieDomain,
+		expires: new Date(),
+		path: '/',
+	});
+
+	return true;
 };
 
 plugin.generate = function (req, res) {
-	var payload = {};
+	if (!plugin.ready) {
+		return res.sendStatus(404);
+	}
+
+	let payload = {};
 	payload[plugin.settings['payload:id']] = 1;
 	payload[plugin.settings['payload:username']] = 'testUser';
 	payload[plugin.settings['payload:email']] = 'testUser@example.org';
@@ -573,13 +513,13 @@ plugin.generate = function (req, res) {
 	payload[plugin.settings['payload:groups']] = ['test-group'];
 
 	if (plugin.settings.payloadParent || plugin.settings['payload:parent']) {
-		var parentKey = plugin.settings.payloadParent || plugin.settings['payload:parent'];
-		var newPayload = {};
+		const parentKey = plugin.settings.payloadParent || plugin.settings['payload:parent'];
+		const newPayload = {};
 		newPayload[parentKey] = payload;
 		payload = newPayload;
 	}
 
-	var token = jwt.sign(payload, plugin.settings.secret);
+	const token = jwt.sign(payload, plugin.settings.secret);
 	res.cookie(plugin.settings.cookieName, token, {
 		maxAge: 1000 * 60 * 60 * 24 * 21,
 		httpOnly: true,
@@ -589,74 +529,77 @@ plugin.generate = function (req, res) {
 	res.sendStatus(200);
 };
 
-plugin.addAdminNavigation = function (header, callback) {
+plugin.addAdminNavigation = async (header) => {
 	header.plugins.push({
 		route: '/plugins/session-sharing',
 		icon: 'fa-user-secret',
 		name: 'Session Sharing',
 	});
 
-	callback(null, header);
+	return header;
 };
 
-plugin.reloadSettings = function (callback) {
-	// If callback is not a function then it is the action hook from core
-	if (typeof callback !== 'function' && callback.plugin !== 'session-sharing') {
+plugin.reloadSettings = async (data) => {
+	// If data argument is truthy, then it is the action hook from core
+	if (data && data.plugin !== 'session-sharing') {
 		return;
 	}
 
-	meta.settings.get('session-sharing', function (err, settings) {
-		if (err) {
-			return callback(err);
-		}
-
-		if (!settings.hasOwnProperty('secret') || !settings.secret.length) {
-			winston.error('[session-sharing] JWT Secret not found, session sharing disabled.');
-			return callback();
-		}
-
-		// If "payload:parent" is found, but payloadParent is not, update the latter and delete the former
-		if (!settings.payloadParent && settings['payload:parent']) {
-			winston.verbose('[session-sharing] Migrating payload:parent to payloadParent');
-			settings.payloadParent = settings['payload:parent'];
-			db.setObjectField('settings:session-sharing', 'payloadParent', settings.payloadParent);
-			db.deleteObjectField('settings:session-sharing', 'payload:parent');
-		}
+	const settings = await meta.settings.get('session-sharing');
+	if (!settings.hasOwnProperty('secret') || !settings.secret.length) {
+		winston.error('[session-sharing] JWT Secret not found, session sharing disabled.');
+		return;
+	}
 
-		if (!settings['payload:username'] && !settings['payload:firstName'] && !settings['payload:lastName'] && !settings['payload:fullname']) {
-			settings['payload:username'] = 'username';
-		}
+	// If "payload:parent" is found, but payloadParent is not, update the latter and delete the former
+	if (!settings.payloadParent && settings['payload:parent']) {
+		winston.verbose('[session-sharing] Migrating payload:parent to payloadParent');
+		settings.payloadParent = settings['payload:parent'];
+		await db.setObjectField('settings:session-sharing', 'payloadParent', settings.payloadParent);
+		await db.deleteObjectField('settings:session-sharing', 'payload:parent');
+	}
 
-		winston.info('[session-sharing] Settings OK');
-		plugin.settings = _.defaults(_.pickBy(settings, Boolean), plugin.settings);
-		plugin.ready = true;
+	if (!settings['payload:username'] && !settings['payload:firstName'] && !settings['payload:lastName'] && !settings['payload:fullname']) {
+		settings['payload:username'] = 'username';
+	}
 
-		if (typeof callback === 'function') {
-			callback();
-		}
-	});
+	winston.info('[session-sharing] Settings OK');
+	plugin.settings = _.defaults(_.pickBy(settings, Boolean), plugin.settings);
+	plugin.ready = true;
 };
 
-plugin.appendTemplate = (data, callback) => {
-	if (data.req.session.sessionSharing && data.req.session.sessionSharing.banned) {
-		user.getLatestBanInfo(data.req.session.sessionSharing.uid, (err, info) => {
-			if (err) {
-				return callback(err);
-			}
+plugin.appendTemplate = async (data) => {
+	if (!data.req.session.sessionSharing || !data.req.session.sessionSharing.banned) {
+		return data;
+	}
 
-			data.templateData.sessionSharingBan = {
-				ban: info,
-				banned: true,
-			};
+	const info = await user.getLatestBanInfo(data.req.session.sessionSharing.uid);
 
-			delete data.req.session.sessionSharing;
-			callback(null, data);
-		});
+	data.templateData.sessionSharingBan = {
+		ban: info,
+		banned: true,
+	};
 
-		return;
+	delete data.req.session.sessionSharing;
+	return data;
+};
+
+plugin.saveReverseToken = async ({ req, userData: data }) => {
+	if (!plugin.ready || plugin.settings.reverseToken !== 'on') {
+		return;	// no reverse token if secret not set
 	}
 
-	setImmediate(callback, null, data);
+	const res = req.res;
+	const userData = await user.getUserFields(data.uid, ['uid', 'username', 'picture', 'reputation', 'postcount', 'banned']);
+	const token = jwt.sign(userData, plugin.settings.secret);
+
+	res.cookie('nbb_token', token, {
+		maxAge: meta.getSessionTTLSeconds() * 1000,
+		httpOnly: !req.secure,
+		domain: plugin.settings.cookieDomain,
+	});
+
+	winston.info(`[plugins/session-sharing] Saving reverse cookie for uid ${userData.uid}, session: ${req.session.id}`);
 };
 
 module.exports = plugin;