nodebb-plugin-session-sharing 4.8.0 → 5.1.2

package/lib/controllers.js

@@ -1,38 +1,40 @@
 'use strict';
 
-var groups = require.main.require('./src/groups');
+const groups = require.main.require('./src/groups');
 
-var Controllers = {};
+const Controllers = {};
 
 Controllers.renderAdminPage = async (req, res) => {
 	const groupData = await groups.getGroupsFromSet('groups:visible:createtime', 0, -1);
 	res.render('admin/plugins/session-sharing', { groups: groupData });
 };
 
-Controllers.retrieveUser = function (req, res) {
+Controllers.retrieveUser = async (req, res) => {
 	const main = module.parent.exports;
 	const remoteId = req.query.id;
-
-	if (remoteId) {
-		main.getUser(remoteId, function (err, userObj) {
-			if (err) {
-				res.status(500).json({
-					error: err.message,
-				});
-			} else if (userObj) {
-				res.status(200).json(userObj);
-			} else {
-				res.sendStatus(404);
-			}
-		});
-	} else {
-		res.status(400).json({
+	
+	if (!remoteId) {
+		return res.status(400).json({
 			error: 'no-id-supplied',
 		});
 	}
+	
+	try {
+		const userObj = await main.getUser(remoteId);
+
+		if (!userObj) {
+			return res.sendStatus(404);
+		}
+
+		return res.status(200).json(userObj);
+	} catch (error) {
+		return res.status(500).json({
+			error: error.message,
+		});
+	}
 };
 
-Controllers.process = function (req, res) {
+Controllers.process = async (req, res) => {
 	const main = module.parent.exports;
 
 	if (!req.body || !req.body.token) {
@@ -40,18 +42,18 @@ Controllers.process = function (req, res) {
 			error: 'no-token-provided',
 		});
 	}
+	
+	try {
+		const uid = await main.process(req.body.token);
 
-	main.process(req.body.token, (err, uid) => {
-		if (err) {
-			return res.status(500).json({
-				error: err.message,
-			});
-		}
-
-		res.status(200).json({
+		return res.status(200).json({
 			uid,
 		});
-	});
+	} catch (error) {
+		return res.status(500).json({
+			error: error.message,
+		});
+	}
 };
 
 module.exports = Controllers;

package/library.js

@@ -1,26 +1,24 @@
 'use strict';
 
-var meta = require.main.require('./src/meta');
-var user = require.main.require('./src/user');
-var groups = require.main.require('./src/groups');
-var SocketPlugins = require.main.require('./src/socket.io/plugins');
+const winston = module.parent.require('winston');
+const nconf = module.parent.require('nconf');
 
-var winston = module.parent.require('winston');
-var nconf = module.parent.require('nconf');
+const _ = require('lodash');
 
-var _ = require('lodash');
-var async = require('async');
+const meta = require.main.require('./src/meta');
+const user = require.main.require('./src/user');
+const groups = require.main.require('./src/groups');
+const SocketPlugins = require.main.require('./src/socket.io/plugins');
+const db = require.main.require('./src/database');
+const plugins = require.main.require('./src/plugins');
 
-var db = require.main.require('./src/database');
-var plugins = require.main.require('./src/plugins');
+const jwt = require('jsonwebtoken');
 
-var jwt = require('jsonwebtoken');
-
-var controllers = require('./lib/controllers');
-var nbbAuthController = require.main.require('./src/controllers/authentication');
+const controllers = require('./lib/controllers');
+const nbbAuthController = require.main.require('./src/controllers/authentication');
 
 /* all the user profile fields that can be passed to user.updateProfile */
-var profileFields = [
+const profileFields = [
 	'username',
 	'email',
 	'fullname',
@@ -31,7 +29,7 @@ var profileFields = [
 	'signature',
 	'aboutme',
 ];
-var payloadKeys = profileFields.concat([
+const payloadKeys = profileFields.concat([
 	'id', // the uniq identifier of that account
 	'firstName', // for backwards compatibillity
 	'lastName', // dto.
@@ -39,7 +37,7 @@ var payloadKeys = profileFields.concat([
 	'groups',
 ]);
 
-var plugin = {
+const plugin = {
 	ready: false,
 	settings: {
 		name: 'appId',
@@ -50,6 +48,7 @@ var plugin = {
 		adminRevalidate: 'off',
 		noRegistration: 'off',
 		payloadParent: undefined,
+		allowBannedUsers: false,
 	},
 };
 
@@ -74,7 +73,7 @@ plugin.init = async (params) => {
 	await plugin.reloadSettings();
 };
 
-plugin.appendConfig = function (config, callback) {
+plugin.appendConfig = async (config) => {
 	config.sessionSharing = {
 		logoutRedirect: plugin.settings.logoutRedirect,
 		loginOverride: plugin.settings.loginOverride,
@@ -83,45 +82,30 @@ plugin.appendConfig = function (config, callback) {
 		hostWhitelist: plugin.settings.hostWhitelist,
 	};
 
-	callback(null, config);
+	return config;
 };
 
 /* Websocket Listeners */
 
 SocketPlugins.sessionSharing = {};
 
-SocketPlugins.sessionSharing.showUserIds = function (socket, data, callback) {
+SocketPlugins.sessionSharing.showUserIds = async (socket, data) => {
 	// Retrieve the hash and find matches
-	var uids = data.uids;
-	var payload = [];
-
-	payload.length = uids.length;
-
-	if (uids.length) {
-		async.map(uids, function (uid, next) {
-			db.getSortedSetRangeByScore(plugin.settings.name + ':uid', 0, -1, uid, uid, next);
-		}, function (err, remoteIds) {
-			if (err) {
-				return callback(err);
-			}
+	const { uids } = data;
 
-			remoteIds.forEach(function (remoteId, idx) {
-				payload[idx] = remoteId;
-			});
-
-			callback(null, payload);
-		});
-	} else {
-		callback(new Error('no-uids-supplied'));
+	if (!uids.length) {
+		throw new Error('no-uids-supplied');
 	}
+
+	return Promise.all(uids.map(async uid => db.getSortedSetRangeByScore(plugin.settings.name + ':uid', 0, -1, uid, uid)));
 };
 
-SocketPlugins.sessionSharing.findUserByRemoteId = function (socket, data, callback) {
-	if (data.remoteId) {
-		plugin.getUser(data.remoteId, callback);
-	} else {
-		callback(new Error('no-remote-id-supplied'));
+SocketPlugins.sessionSharing.findUserByRemoteId = async (socket, data) => {
+	if (!data.remoteId) {
+		throw new Error('no-remote-id-supplied');
 	}
+
+	return plugin.getUser(data.remoteId);
 };
 
 /* End Websocket Listeners */
@@ -129,32 +113,28 @@ SocketPlugins.sessionSharing.findUserByRemoteId = function (socket, data, callba
 /*
  *	Given a remoteId, show user data
  */
-plugin.getUser = function (remoteId, callback) {
-	async.waterfall([
-		async.apply(db.sortedSetScore, plugin.settings.name + ':uid', remoteId),
-		function (uid, next) {
-			if (uid) {
-				user.getUserFields(uid, ['username', 'userslug', 'picture'], next);
-			} else {
-				setImmediate(next);
-			}
-		},
-	], callback);
+plugin.getUser = async (remoteId) => {
+	const uid = await db.sortedSetScore(plugin.settings.name + ':uid', remoteId);
+
+	if (!uid) {
+		return;
+	}
+
+	return user.getUserFields(uid, ['username', 'userslug', 'picture']);
 };
 
-plugin.process = function (token, callback) {
-	async.waterfall([
-		async.apply(jwt.verify, token, plugin.settings.secret),
-		async.apply(plugin.normalizePayload),
-		async.apply(plugin.findOrCreateUser),
-		async.apply(plugin.updateUserProfile),
-		async.apply(plugin.updateUserGroups),
-		async.apply(plugin.verifyUser, token),
-	], callback);
+plugin.process = async (token) => {
+	const payload = await jwt.verify(token, plugin.settings.secret);
+	const userData = await plugin.normalizePayload(payload);
+	const [uid, isNewUser] = await plugin.findOrCreateUser(userData);
+	await plugin.updateUserProfile(uid, userData, isNewUser);
+	await plugin.updateUserGroups(uid, userData);
+	await plugin.verifyUser(token, uid, isNewUser);
+	return uid;
 };
 
-plugin.normalizePayload = function (payload, callback) {
-	var userData = {};
+plugin.normalizePayload = async (payload) => {
+	const userData = {};
 
 	if (plugin.settings.payloadParent) {
 		payload = payload[plugin.settings.payloadParent];
@@ -162,11 +142,11 @@ plugin.normalizePayload = function (payload, callback) {
 
 	if (typeof payload !== 'object') {
 		winston.warn('[session-sharing] the payload is not an object', payload);
-		return callback(new Error('payload-invalid'));
+		throw new Error('payload-invalid');
 	}
 
 	payloadKeys.forEach(function (key) {
-		var propName = plugin.settings['payload:' + key];
+		const propName = plugin.settings['payload:' + key];
 		if (payload[propName]) {
 			userData[key] = payload[propName];
 		}
@@ -174,7 +154,7 @@ plugin.normalizePayload = function (payload, callback) {
 
 	if (!userData.id) {
 		winston.warn('[session-sharing] No user id was given in payload');
-		return callback(new Error('payload-invalid'));
+		throw new Error('payload-invalid');
 	}
 
 	userData.fullname = (userData.fullname || [userData.firstName, userData.lastName].join(' ')).trim();
@@ -188,7 +168,7 @@ plugin.normalizePayload = function (payload, callback) {
 
 	if (!userData.username) {
 		winston.warn('[session-sharing] No valid username could be determined');
-		return callback(new Error('payload-invalid'));
+		throw new Error('payload-invalid');
 	}
 
 	if (userData.hasOwnProperty('groups') && !Array.isArray(userData.groups)) {
@@ -197,218 +177,185 @@ plugin.normalizePayload = function (payload, callback) {
 	}
 
 	winston.verbose('[session-sharing] Payload verified');
-	plugins.hooks.fire('filter:sessionSharing.normalizePayload', {
+	const data = await plugins.hooks.fire('filter:sessionSharing.normalizePayload', {
 		payload: payload,
 		userData: userData,
-	}, function (err, data) {
-		callback(err, data.userData);
 	});
+
+	return data.userData;
 };
 
-plugin.verifyUser = function (token, uid, isNewUser, callback) {
-	plugins.hooks.fire('static:sessionSharing.verifyUser', {
+plugin.verifyUser = async (token, uid, isNewUser) => {
+	await plugins.hooks.fire('static:sessionSharing.verifyUser', {
 		uid: uid,
 		isNewUser: isNewUser,
 		token: token,
-	}, function (err) {
-		if (err) {
-			return callback(err);
-		}
-		// Check ban state of user, reject if banned
-		user.bans.isBanned(uid, function (err, banned) {
-			callback(err || banned ? new Error('banned') : null, uid);
-		});
 	});
+
+	// Check ban state of user
+	const isBanned = await user.bans.isBanned(uid);
+
+	// Reject if banned and settings dont allow banned users to login
+	if (isBanned && !plugin.settings.allowBannedUsers) {
+		throw new Error('banned');
+	}
 };
 
-plugin.findOrCreateUser = function (userData, callback) {
-	var queries = {};
+plugin.findOrCreateUser = async (userData) => {
+	const { id } = userData;
+	let isNewUser = false;
+	let userId = null;
+	let queries = [db.sortedSetScore(plugin.settings.name + ':uid', userData.id)];
+
 	if (userData.email && userData.email.length) {
-		queries.mergeUid = async.apply(db.sortedSetScore, 'email:uid', userData.email);
-	}
-	queries.uid = async.apply(db.sortedSetScore, plugin.settings.name + ':uid', userData.id);
-
-	async.parallel(queries, function (err, checks) {
-		if (err) { return callback(err); }
-
-		async.waterfall([
-			/* check if found something to work with */
-			function (next) {
-				if (checks.uid && !isNaN(parseInt(checks.uid, 10))) {
-					var uid = parseInt(checks.uid, 10);
-					/* check if the user with the given id actually exists */
-					return user.exists(uid, function (err, exists) {
-						/* ignore errors, but assume the user doesn't exist  */
-						if (err) {
-							winston.warn('[session-sharing] Error while testing user existance', err);
-							return next(null, null);
-						}
-						if (exists) {
-							return next(null, uid);
-						}
-						/* reference is outdated, user got deleted */
-						db.sortedSetRemove(plugin.settings.name + ':uid', userData.id, function (err) {
-							next(err, null);
-						});
-					});
-				}
-				if (checks.mergeUid && !isNaN(parseInt(checks.mergeUid, 10))) {
-					winston.info('[session-sharing] Found user via their email, associating this id (' + userData.id + ') with their NodeBB account');
-					return db.sortedSetAdd(plugin.settings.name + ':uid', checks.mergeUid, userData.id, function (err) {
-						next(err, parseInt(checks.mergeUid, 10));
-					});
-				}
-				setImmediate(next, null, null);
-			},
-			/* create the user from payload if necessary */
-			function (uid, next) {
-				winston.debug('createUser?', !uid);
-				if (!uid) {
-					if (plugin.settings.noRegistration === 'on') {
-						return next(new Error('no-match'));
-					}
-					return plugin.createUser(userData, function (err, uid) {
-						next(err, uid, userData, true);
-					});
-				}
-				setImmediate(next, null, uid, userData, false);
-			},
-		], callback);
-	});
+		queries = [...queries, db.sortedSetScore('email:uid', userData.email)];
+	}
+
+	let [uid, mergeUid] = await Promise.all(queries);
+	uid = parseInt(uid, 10);
+	mergeUid = parseInt(mergeUid, 10);
+
+	/* check if found something to work with */
+	if (uid && !isNaN(uid)) {
+		try {
+			/* check if the user with the given id actually exists */
+			const exists = await user.exists(uid);
+
+			if (exists) {
+				userId = uid;
+			} else {
+				/* reference is outdated, user got deleted */
+				await db.sortedSetRemove(plugin.settings.name + ':uid', id);
+			}
+		} catch (error) {
+			/* ignore errors, but assume the user doesn't exist  */
+			winston.warn('[session-sharing] Error while testing user existance', error);
+		}
+	}
+
+	if (!userId && mergeUid && !isNaN(mergeUid)) {
+		winston.info('[session-sharing] Found user via their email, associating this id (' + id + ') with their NodeBB account');
+		await db.sortedSetAdd(plugin.settings.name + ':uid', mergeUid, id);
+		userId = mergeUid;
+	}
+
+	/* create the user from payload if necessary */
+	winston.debug('createUser?', !userId);
+	if (!userId) {
+		if (plugin.settings.noRegistration === 'on') {
+			throw new Error('no-match');
+		}
+
+		userId = await plugin.createUser(userData);
+		isNewUser = true;
+	}
+
+	return [userId, isNewUser];
 };
 
-plugin.updateUserProfile = function (uid, userData, isNewUser, callback) {
+plugin.updateUserProfile = async (uid, userData, isNewUser) => {
 	winston.debug('consider updateProfile?', isNewUser || plugin.settings.updateProfile === 'on');
+	let userObj = {};
 
 	/* even update the profile on a new account, since some fields are not initialized by NodeBB */
 	if (!isNewUser && plugin.settings.updateProfile !== 'on') {
-		return setImmediate(callback, null, uid, userData, isNewUser);
+		return;
 	}
 
-	async.waterfall([
-		function (next) {
-			user.getUserFields(uid, profileFields, next);
-		},
-		function (existingFields, next) {
-			var obj = {};
+	const existingFields = await user.getUserFields(uid, profileFields);
+	const obj = profileFields.reduce((result, field) => {
+		if (typeof userData[field] !== 'undefined' && existingFields[field] !== userData[field]) {
+			result[field] = userData[field];
+		}
 
-			profileFields.forEach(function (field) {
-				if (typeof userData[field] !== 'undefined' && existingFields[field] !== userData[field]) {
-					obj[field] = userData[field];
-				}
-			});
+		return result;
+	}, {});
 
-			if (Object.keys(obj).length) {
-				winston.debug('[session-sharing] Updating profile fields:', obj);
-				obj.uid = uid;
-				return user.updateProfile(uid, obj, function (err, userObj) {
-					if (err) {
-						winston.warn('[session-sharing] Unable to update profile information for uid: ' + uid + '(' + err.message + ')');
-					}
-
-					// If it errors out, not that big of a deal, continue anyway.
-					next(null, userObj || existingFields);
-				});
-			}
-			setImmediate(next, null, {});
-		},
-		function (userObj, next) {
-			if (userData.picture) {
-				return db.setObjectField('user:' + uid, 'picture', userData.picture, next);
+	if (Object.keys(obj).length) {
+		winston.debug('[session-sharing] Updating profile fields:', obj);
+		obj.uid = uid;
+		try {
+			userObj = await user.updateProfile(uid, obj);
+
+			// If it errors out, not that big of a deal, continue anyway.
+			if (!userObj) {
+				userObj = existingFields;
 			}
+		} catch (error) {
+			winston.warn('[session-sharing] Unable to update profile information for uid: ' + uid + '(' + error.message + ')');
+		}
+	}
 
-			setImmediate(next, null);
-		},
-	], function (err) {
-		return callback(err, uid, userData, isNewUser);
-	});
+	if (userData.picture) {
+		await db.setObjectField('user:' + uid, 'picture', userData.picture);
+	}
 };
 
-plugin.updateUserGroups = function (uid, userData, isNewUser, callback) {
+plugin.updateUserGroups = async (uid, userData) => {
 	if (!userData.groups || !Array.isArray(userData.groups)) {
-		return setImmediate(callback, null, uid, isNewUser);
+		return;
 	}
 
-	async.waterfall([
-		// Retrieve user groups
-		async.apply(groups.getUserGroupsFromSet, 'groups:createtime', [uid]),
-		function (groups, next) {
-			// Normalize user group data to just group names
-			groups = groups[0].map(function (groupObj) {
-				return groupObj.name;
-			});
-
-			// Build join and leave arrays
-			var join = userData.groups.filter(function (name) {
-				return !groups.includes(name);
-			});
+	// Retrieve user groups
+	let [userGroups] = await groups.getUserGroupsFromSet('groups:createtime', [uid]);
+	// Normalize user group data to just group names
+	userGroups = userGroups.map(groupObj => groupObj.name);
 
-			if (plugin.settings.syncGroupList === 'on') {
-				join = join.filter(group => plugin.settings.syncGroups.includes(group));
-			}
-
-			var leave = groups.filter(function (name) {
-				// `registered-users` is always a joined group
-				if (name === 'registered-users') {
-					return false;
-				}
-
-				return !userData.groups.includes(name);
-			});
+	// Build join and leave arrays
+	let join = userData.groups.filter(name => !userGroups.includes(name));
+	if (plugin.settings.syncGroupList === 'on') {
+		join = join.filter(group => plugin.settings.syncGroups.includes(group));
+	}
 
-			if (plugin.settings.syncGroupList === 'on') {
-				leave = leave.filter(group => plugin.settings.syncGroups.includes(group));
-			}
+	let leave = userGroups.filter((name) => {
+		// `registered-users` is always a joined group
+		if (name === 'registered-users') {
+			return false;
+		}
 
-			executeJoinLeave(uid, join, leave, next);
-		},
-	], function (err) {
-		return callback(err, uid, isNewUser);
+		return !userData.groups.includes(name);
 	});
+	if (plugin.settings.syncGroupList === 'on') {
+		leave = leave.filter(group => plugin.settings.syncGroups.includes(group));
+	}
+
+	await executeJoinLeave(uid, join, leave);
 };
 
-function executeJoinLeave(uid, join, leave, callback) {
-	async.parallel([
-		function (next) {
+async function executeJoinLeave(uid, join, leave) {
+	await Promise.all([
+		(async () => {
 			if (plugin.settings.syncGroupJoin !== 'on') {
-				return setImmediate(next);
+				return;
 			}
 
-			async.each(join, function (name, next) {
-				groups.join(name, uid, next);
-			}, next);
-		},
-		function (next) {
+			await Promise.all(join.map(name => groups.join(name, uid)));
+		})(),
+		(async () => {
 			if (plugin.settings.syncGroupLeave !== 'on') {
-				return setImmediate(next);
+				return;
 			}
 
-			async.each(leave, function (name, next) {
-				groups.leave(name, uid, next);
-			}, next);
-		},
-	], callback);
+			await Promise.all(leave.map(name => groups.leave(name, uid)));
+		})(),
+	]);
 }
 
-plugin.createUser = function (userData, callback) {
+plugin.createUser = async (userData) => {
 	winston.verbose('[session-sharing] No user found, creating a new user for this login');
 
-	user.create(_.pick(userData, profileFields), function (err, uid) {
-		if (err) { return callback(err); }
-
-		db.sortedSetAdd(plugin.settings.name + ':uid', uid, userData.id, function (err) {
-			callback(err, uid);
-		});
-	});
+	const uid = await user.create(_.pick(userData, profileFields));
+	await db.sortedSetAdd(plugin.settings.name + ':uid', uid, userData.id);
+	return uid;
 };
 
-plugin.addMiddleware = async function (req, res, next) {
+plugin.addMiddleware = async function ({ req, res }) {
 	const { hostWhitelist, guestRedirect, editOverride, loginOverride, registerOverride } = await meta.settings.get('session-sharing');
 
 	if (hostWhitelist) {
-		var hosts = hostWhitelist.split(',') || [hostWhitelist];
-		var whitelisted = false;
-		for (var host of hosts) {
+		const hosts = hostWhitelist.split(',') || [hostWhitelist];
+		let whitelisted = false;
+		for (const host of hosts) {
 			if (req.headers.host.includes(host)) {
 				whitelisted = true;
 				break;
@@ -416,24 +363,22 @@ plugin.addMiddleware = async function (req, res, next) {
 		}
 
 		if (!whitelisted) {
-			return next();
+			return;
 		}
 	}
 
-	function handleGuest(req, res, next) {
+	function handleGuest(req, res) {
 		if (guestRedirect && !req.originalUrl.startsWith(nconf.get('relative_path') + '/login?local=1')) {
 			// If a guest redirect is specified, follow it
 			res.redirect(guestRedirect.replace('%1', encodeURIComponent(req.protocol + '://' + req.get('host') + req.originalUrl)));
 		} else if (res.locals.fullRefresh === true) {
 			res.redirect(nconf.get('relative_path') + req.url);
-		} else {
-			next();
 		}
 	}
 
 	// Only respond to page loads by guests, not api or asset calls
-	var hasSession = req.hasOwnProperty('user') && req.user.hasOwnProperty('uid') && parseInt(req.user.uid, 10) > 0;
-	var hasLoginLock = req.session.hasOwnProperty('loginLock');
+	const hasSession = req.hasOwnProperty('user') && req.user.hasOwnProperty('uid') && parseInt(req.user.uid, 10) > 0;
+	const hasLoginLock = req.session.hasOwnProperty('loginLock');
 
 	if (
 		!plugin.ready ||	// plugin not ready
@@ -444,7 +389,7 @@ plugin.addMiddleware = async function (req, res, next) {
 		// Let requests through under "update" or "revalidate" behaviour only if they're logging in for the first time
 		delete req.session.loginLock;	// remove login lock for "update" or "revalidate" logins
 
-		return next();
+		return;
 	}
 
 	if (editOverride && hasSession && req.originalUrl.match(/\/user\/.*\/edit$/)) {
@@ -458,89 +403,78 @@ plugin.addMiddleware = async function (req, res, next) {
 	}
 
 	// Hook into ip blacklist functionality in core
-	meta.blacklist.test(req.ip, function (err) {
-		if (err) {
-			if (hasSession) {
-				req.logout();
-				res.locals.fullRefresh = true;
+	try {
+		await meta.blacklist.test(req.ip);
+	} catch (error) {
+		if (hasSession) {
+			req.logout();
+			res.locals.fullRefresh = true;
+		}
+
+		await plugin.cleanup({ res: res });
+		return handleGuest.call(null, req, res);
+	}
+
+	if (Object.keys(req.cookies).length && req.cookies.hasOwnProperty(plugin.settings.cookieName) && req.cookies[plugin.settings.cookieName].length) {
+		try {
+			const uid = await plugin.process(req.cookies[plugin.settings.cookieName]);
+			winston.verbose('[session-sharing] Processing login for uid ' + uid + ', path ' + req.originalUrl);
+			req.uid = uid;
+
+			if (plugin.settings.behaviour === 'revalidate') {
+				res.locals.reroll = false;	// disable session rerolling in core
 			}
 
-			plugin.cleanup({ res: res });
-			return handleGuest.call(null, req, res, next);
-		}
-		if (Object.keys(req.cookies).length && req.cookies.hasOwnProperty(plugin.settings.cookieName) && req.cookies[plugin.settings.cookieName].length) {
-			return plugin.process(req.cookies[plugin.settings.cookieName], function (err, uid) {
-				if (err) {
-					var handleAsGuest = false;
-
-					switch (err.message) {
-					case 'banned':
-						winston.info('[session-sharing] uid ' + uid + ' is banned, not logging them in');
-						req.session.sessionSharing = {
-							banned: true,
-							uid: uid,
-						};
-						break;
-					case 'payload-invalid':
-						winston.warn('[session-sharing] The passed-in payload was invalid and could not be processed');
-						break;
-					case 'no-match':
-						winston.info('[session-sharing] Payload valid, but local account not found.  Assuming guest.');
-						handleAsGuest = true;
-						break;
-					default:
-						winston.warn('[session-sharing] Error encountered while parsing token: ' + err.message);
-						break;
-					}
-
-					return plugins.hooks.fire('filter:sessionSharing.error', {
-						error: err,
-						uid: uid,
-						res: res,
-						settings: plugin.settings,
-						handleAsGuest: handleAsGuest,
-					}, function (err, data) {
-						if (data.handleAsGuest) {
-							return handleGuest.call(err, req, res, next);
-						}
-
-						next(err);
-					});
-				}
-
-				winston.verbose('[session-sharing] Processing login for uid ' + uid + ', path ' + req.originalUrl);
-				req.uid = uid;
-
-				if (plugin.settings.behaviour === 'revalidate') {
-					res.locals.reroll = false;	// disable session rerolling in core
-				}
-
-				nbbAuthController.doLogin(req, uid, function () {
-					req.session.loginLock = true;
-					const url = req.session.returnTo || req.originalUrl.replace(nconf.get('relative_path'), '');
-					delete req.session.returnTo;
-					res.redirect(nconf.get('relative_path') + url);
-				});
-			});
-		} else if (hasSession) {
-			// Has login session but no cookie, can assume "revalidate" behaviour
-			user.isAdministrator(req.user.uid, function (err, isAdmin) {
-				if (plugin.settings.behaviour !== 'update' && (plugin.settings.adminRevalidate === 'on' || !isAdmin)) {
-					req.logout();
-					res.locals.fullRefresh = true;
-					handleGuest(req, res, next);
-				} else {
-					// Admins can bypass
-					return next(err);
-				}
+			await nbbAuthController.doLogin(req, uid);
+
+			req.session.loginLock = true;
+			const url = req.session.returnTo || req.originalUrl.replace(nconf.get('relative_path'), '');
+			delete req.session.returnTo;
+			res.redirect(nconf.get('relative_path') + url);
+		} catch (error) {
+			let handleAsGuest = false;
+
+			switch (error.message) {
+			case 'payload-invalid':
+				winston.warn('[session-sharing] The passed-in payload was invalid and could not be processed');
+				break;
+			case 'no-match':
+				winston.info('[session-sharing] Payload valid, but local account not found.  Assuming guest.');
+				handleAsGuest = true;
+				break;
+			default:
+				winston.warn('[session-sharing] Error encountered while parsing token: ' + error.message);
+				break;
+			}
+
+			const data = await plugins.hooks.fire('filter:sessionSharing.error', {
+				error,
+				res: res,
+				settings: plugin.settings,
+				handleAsGuest: handleAsGuest,
 			});
-		} else {
-			handleGuest.call(null, req, res, next);
+
+			if (data.handleAsGuest) {
+				return handleGuest.call(error, req, res);
+			}
+
+			throw error;
 		}
-	});
+	} else if (hasSession) {
+		// Has login session but no cookie, can assume "revalidate" behaviour
+		const isAdmin = await user.isAdministrator(req.user.uid);
+
+		if (plugin.settings.behaviour !== 'update' && (plugin.settings.adminRevalidate === 'on' || !isAdmin)) {
+			req.logout();
+			res.locals.fullRefresh = true;
+			return handleGuest(req, res);
+		}
+	} else {
+		return handleGuest.call(null, req, res);
+	}
 };
 
-plugin.cleanup = function (data, callback) {
+plugin.cleanup = async (data) => {
 	if (plugin.settings.cookieDomain) {
 		winston.verbose('[session-sharing] Clearing cookie');
 		data.res.clearCookie(plugin.settings.cookieName, {
@@ -550,15 +484,21 @@ plugin.cleanup = function (data, callback) {
 		});
 	}
 
-	if (typeof callback === 'function') {
-		callback();
-	} else {
-		return true;
-	}
+	data.res.clearCookie('nbb_token', {
+		domain: plugin.settings.cookieDomain,
+		expires: new Date(),
+		path: '/',
+	});
+
+	return true;
 };
 
 plugin.generate = function (req, res) {
-	var payload = {};
+	if (!plugin.ready) {
+		return res.sendStatus(404);
+	}
+
+	let payload = {};
 	payload[plugin.settings['payload:id']] = 1;
 	payload[plugin.settings['payload:username']] = 'testUser';
 	payload[plugin.settings['payload:email']] = 'testUser@example.org';
@@ -573,13 +513,13 @@ plugin.generate = function (req, res) {
 	payload[plugin.settings['payload:groups']] = ['test-group'];
 
 	if (plugin.settings.payloadParent || plugin.settings['payload:parent']) {
-		var parentKey = plugin.settings.payloadParent || plugin.settings['payload:parent'];
-		var newPayload = {};
+		const parentKey = plugin.settings.payloadParent || plugin.settings['payload:parent'];
+		const newPayload = {};
 		newPayload[parentKey] = payload;
 		payload = newPayload;
 	}
 
-	var token = jwt.sign(payload, plugin.settings.secret);
+	const token = jwt.sign(payload, plugin.settings.secret);
 	res.cookie(plugin.settings.cookieName, token, {
 		maxAge: 1000 * 60 * 60 * 24 * 21,
 		httpOnly: true,
@@ -589,14 +529,14 @@ plugin.generate = function (req, res) {
 	res.sendStatus(200);
 };
 
-plugin.addAdminNavigation = function (header, callback) {
+plugin.addAdminNavigation = async (header) => {
 	header.plugins.push({
 		route: '/plugins/session-sharing',
 		icon: 'fa-user-secret',
 		name: 'Session Sharing',
 	});
 
-	callback(null, header);
+	return header;
 };
 
 plugin.reloadSettings = async (data) => {
@@ -628,26 +568,39 @@ plugin.reloadSettings = async (data) => {
 	plugin.ready = true;
 };
 
-plugin.appendTemplate = (data, callback) => {
-	if (data.req.session.sessionSharing && data.req.session.sessionSharing.banned) {
-		user.getLatestBanInfo(data.req.session.sessionSharing.uid, (err, info) => {
-			if (err) {
-				return callback(err);
-			}
+plugin.appendTemplate = async (data) => {
+	if (!data.req.session.sessionSharing || !data.req.session.sessionSharing.banned) {
+		return data;
+	}
 
-			data.templateData.sessionSharingBan = {
-				ban: info,
-				banned: true,
-			};
+	const info = await user.getLatestBanInfo(data.req.session.sessionSharing.uid);
 
-			delete data.req.session.sessionSharing;
-			callback(null, data);
-		});
+	data.templateData.sessionSharingBan = {
+		ban: info,
+		banned: true,
+	};
 
-		return;
+	delete data.req.session.sessionSharing;
+	return data;
+};
+
+plugin.saveReverseToken = async ({ req, userData: data }) => {
+	if (!plugin.ready || plugin.settings.reverseToken !== 'on') {
+		return;	// no reverse token if secret not set
 	}
 
-	setImmediate(callback, null, data);
+	const res = req.res;
+	const userData = await user.getUserFields(data.uid, ['uid', 'username', 'picture', 'reputation', 'postcount', 'banned']);
+	userData.groups = (await groups.getUserGroups([data.uid])).pop();
+	const token = jwt.sign(userData, plugin.settings.secret);
+
+	res.cookie('nbb_token', token, {
+		maxAge: meta.getSessionTTLSeconds() * 1000,
+		httpOnly: !req.secure,
+		domain: plugin.settings.cookieDomain,
+	});
+
+	winston.info(`[plugins/session-sharing] Saving reverse cookie for uid ${userData.uid}, session: ${req.session.id}`);
 };
 
 module.exports = plugin;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nodebb-plugin-session-sharing",
-  "version": "4.8.0",
+  "version": "5.1.2",
   "description": "Allows login sessions from your app to persist in NodeBB",
   "main": "library.js",
   "repository": {
@@ -39,7 +39,7 @@
     "@commitlint/cli": "^9.1.2",
     "async": "^2",
     "eslint": "^7.7.0",
-    "jsonwebtoken": "5.5.4",
+    "jsonwebtoken": "^8.5.1",
     "lint-staged": "^10.0.9",
     "lodash": "^4.17.14"
   },
@@ -50,6 +50,8 @@
     "eslint-config-airbnb-base": "^12.1.0",
     "eslint-plugin-import": "^2.8.0",
     "husky": "^2.4.0",
-    "lint-staged": "^10.0.9"
+    "lint-staged": "^10.0.9",
+    "request": "^2.88.2",
+    "request-promise-native": "^1.0.9"
   }
 }

package/plugin.json

@@ -3,13 +3,14 @@
 	"url": "https://github.com/NodeBB/nodebb-plugin-session-sharing",
 	"library": "./library.js",
 	"hooks": [
-		{ "hook": "filter:router.page", "method": "addMiddleware" },
+		{ "hook": "response:router.page", "method": "addMiddleware" },
 		{ "hook": "static:app.load", "method": "init" },
 		{ "hook": "filter:admin.header.build", "method": "addAdminNavigation" },
 		{ "hook": "static:user.loggedOut", "method": "cleanup" },
 		{ "hook": "filter:config.get", "method": "appendConfig" },
 		{ "hook": "filter:middleware.render", "method": "appendTemplate" },
-		{ "hook": "action:settings.set", "method": "reloadSettings" }
+		{ "hook": "action:settings.set", "method": "reloadSettings" },
+		{ "hook": "action:login.continue", "method": "saveReverseToken" }
 	],
 	"less": [
 		"static/style.less"

package/static/lib/admin.js

@@ -34,35 +34,37 @@ define('admin/plugins/session-sharing', ['settings'], function (Settings) {
 
 		ACP._searchDelay = setTimeout(function () {
 			delete ACP._searchDelay;
-
-			socket.emit('admin.user.search', {
+			
+			var qs = decodeURIComponent($.param({
 				query: element.val(),
-			}, function (err, results) {
-				var resultEl = $('#result');
-
-				if (err) {
-					return resultEl.text('We encountered an error while servicing this request:' + err.message);
-				}
-
-				if (results.users.length) {
-					socket.emit('plugins.sessionSharing.showUserIds', {
-						uids: results.users.map(function (user) {
-							return user.uid;
-						}),
-					}, function (err, remoteIds) {
-						if (err) {
-							resultEl.text('We encountered an error while servicing this request:' + err.message);
-						} else {
-							resultEl.empty();
-							results.users.forEach(function (userObj, idx) {
-								resultEl.append('<p>Username: ' + userObj.username + '<br />NodeBB uid: ' + userObj.uid + '<br />Remote id: ' + (remoteIds[idx] || '<em>Not Found</em>'));
-							});
-						}
-					});
-				} else {
-					resultEl.text('No users matched your query');
-				}
-			});
+			}));
+			
+			$.get(config.relative_path + '/api/admin/manage/users?' + qs)
+				.then(function (results) {
+					var resultEl = $('#result');
+
+					if (results.users.length) {
+						socket.emit('plugins.sessionSharing.showUserIds', {
+							uids: results.users.map(function (user) {
+								return user.uid;
+							}),
+						}, function (err, remoteIds) {
+							if (err) {
+								resultEl.text('We encountered an error while servicing this request:' + err.message);
+							} else {
+								resultEl.empty();
+								results.users.forEach(function (userObj, idx) {
+									resultEl.append('<p>Username: ' + userObj.username + '<br />NodeBB uid: ' + userObj.uid + '<br />Remote id: ' + (remoteIds[idx] || '<em>Not Found</em>'));
+								});
+							}
+						});
+					} else {
+						resultEl.text('No users matched your query');
+					}
+				})
+				.fail(function (err) {
+					$('#result').text('We encountered an error while servicing this request:' + err.message);
+				});
 		}, 500);
 	};
 

package/static/templates/admin/plugins/session-sharing.tpl

@@ -55,7 +55,7 @@
 								<span class="mdl-switch__label"><strong>Apply revalidation rules to administrators as well</strong></span>
 							</label>
 							<p class="help-block">
-								Administrators are exempt from the <code>revalidate</code> behaviour because a 
+								Administrators are exempt from the <code>revalidate</code> behaviour because a
 								misconfiguration could lock them out of the admin panel. Enable this option to force
 								administrators to also undergo cookie revalidation, and thereby increasing security.
 							</p>
@@ -83,6 +83,15 @@
 							NodeBB to automatically sync up the local profile with the information provided.
 						</div>
 					</div>
+					<div class="checkbox">
+						<label class="mdl-switch mdl-js-switch mdl-js-ripple-effect">
+							<input class="mdl-switch__input" type="checkbox" id="allowBannedUsers" name="allowBannedUsers" />
+							<span class="mdl-switch__label"><strong>Allow banned users to be logged in and placed into banned user group</strong></span>
+						</label>
+						<p class="help-block">
+							By default banned users arent logged in and an error is thrown. If enabled, banned users are logged in and placed in the banned group.
+						</p>
+					</div>
 					<div class="checkbox">
 						<label class="mdl-switch mdl-js-switch mdl-js-ripple-effect">
 							<input class="mdl-switch__input" type="checkbox" id="syncGroupJoin" name="syncGroupJoin" />
@@ -233,6 +242,25 @@
 					</div>
 				</div>
 			</div>
+			<div class="row">
+				<div class="col-sm-2 col-xs-12 settings-header">Reverse Token</div>
+				<div class="col-sm-10 col-xs-12">
+					<div class="form-group">
+						<div class="checkbox">
+							<label for="reverseToken" class="mdl-switch mdl-js-switch mdl-js-ripple-effect">
+								<input type="checkbox" class="mdl-switch__input" id="reverseToken" name="reverseToken">
+								<span class="mdl-switch__label"><strong>Enabled</strong></span>
+							</label>
+						</div>
+						<p class="help-block">
+							If enabled, NodeBB will save a cookie called <code>nbb_token</code> that can be read by other sites on the same domain. It will allow other sites to authenticate a user session based on NodeBB login state.
+						</p>
+						<p class="help-block">
+							Similar to what is accepted by the session-sharing plugin, the reverse token is a signed <a href="//jwt.io">JWT</a> containing the logged in user's username and uid. Guests will not have an `nbb_token`.
+						</p>
+					</div>
+				</div>
+			</div>
 		</div>
 		<div class="col-md-3">
 			<div class="panel panel-default">

package/test/index.js

@@ -0,0 +1,183 @@
+'use strict';
+
+/* globals describe, it */
+
+// MUST BE RUN WITH ENV VAR "TEST_ENV=development"
+// Don't forget to add this plugin to `test_plugins` array in `config.json`
+
+const assert = require('assert');
+const url = require('url');
+const util = require('util');
+const request = require('request-promise-native');
+
+// eslint-disable-next-line no-unused-vars
+const db = require.main.require('./test/mocks/databasemock');
+
+const nconf = require.main.require('nconf');
+const meta = require.main.require('./src/meta');
+
+describe('nodebb-plugin-session-sharing', () => {
+	const userJar = request.jar();
+	const anonJar = request.jar();
+	const { protocol, hostname } = url.parse(nconf.get('url'));
+
+	describe('debug route', () => {
+		it('should 404 when no secret is set', async () => {
+			const response = await request(`${nconf.get('url')}/debug/session`, {
+				jar: userJar,
+				resolveWithFullResponse: true,
+				simple: false,
+			});
+
+			assert.strictEqual(response.statusCode, 404);
+
+			await meta.settings.setOne('session-sharing', 'secret', 's3cr37c47');
+		});
+
+		it('should generate a valid session when called', async () => {
+			const body = await request(`${nconf.get('url')}/debug/session`, {
+				jar: userJar,
+			});
+			assert.strictEqual(body, 'OK');
+
+			const cookies = userJar.getCookies(`${protocol}//${hostname}/`);
+			assert(cookies);
+			assert(cookies.some(cookie => cookie.key === 'token'));
+		});
+	});
+
+	describe('token processing middleware', () => {
+		it('should automatically log in a user with a valid token', async () => {
+			const getSession = util.promisify(db.sessionStore.get.bind(db.sessionStore));
+			const response = await request(`${nconf.get('url')}`, {
+				resolveWithFullResponse: true,
+				jar: userJar,
+			});
+			assert.strictEqual(response.statusCode, 200);
+
+			const cookies = userJar.getCookies(`${protocol}//${hostname}/`);
+			assert(cookies);
+
+			const sidCookie = cookies.find(cookie => cookie.key === 'express.sid');
+			assert(sidCookie);
+
+			let sid = sidCookie.value.match(/s%3A([^.]+)/);
+			assert(sid && sid[1]);
+			sid = sid[1];
+			const sessionObj = await getSession(sid);
+
+			assert(sessionObj && sessionObj.passport && sessionObj.passport.user);
+			assert(parseInt(sessionObj.passport.user, 10) > 0);
+		});
+
+		it('should transparently pass-through as guest without a token', async () => {
+			const response = await request(`${nconf.get('url')}`, {
+				resolveWithFullResponse: true,
+				jar: anonJar,
+			});
+			assert.strictEqual(response.statusCode, 200);
+
+			const cookies = anonJar.getCookies(`${protocol}//${hostname}/`);
+			assert(cookies.every(cookie => cookie.key !== 'express.sid'));
+		});
+
+		it('should redirect a guest to a specified redirection target if configured', async () => {
+			await meta.settings.setOne('session-sharing', 'guestRedirect', 'https://example.org');
+			const response = await request(`${nconf.get('url')}`, {
+				resolveWithFullResponse: true,
+				jar: anonJar,
+				followRedirect: false,
+				simple: false,
+			});
+
+			assert(response.statusCode, 302);
+			assert.strictEqual(response.headers.location, 'https://example.org');
+			await meta.settings.setOne('session-sharing', 'guestRedirect', '');
+		});
+
+		it('should maintain the login if behaviour is "revalidate"', async () => {
+			const getSession = util.promisify(db.sessionStore.get.bind(db.sessionStore));
+			await meta.settings.setOne('session-sharing', 'behaviour', 'revalidate');
+
+			await request(`${nconf.get('url')}`, {
+				resolveWithFullResponse: true,
+				jar: userJar,	// now with no token
+				followRedirect: false,
+				simple: false,
+			});
+
+			const cookies = userJar.getCookies(`${protocol}//${hostname}/`);
+			assert(cookies);
+
+			const sidCookie = cookies.find(cookie => cookie.key === 'express.sid');
+			assert(sidCookie);
+
+			let sid = sidCookie.value.match(/s%3A([^.]+)/);
+			assert(sid && sid[1]);
+			sid = sid[1];
+			const sessionObj = await getSession(sid);
+			assert(sessionObj && sessionObj.passport && sessionObj.passport.user);
+			assert(parseInt(sessionObj.passport.user, 10) > 0);
+		});
+
+		it('should log the user out if behaviour is "revalidate" and the token is gone', async () => {
+			const getSession = util.promisify(db.sessionStore.get.bind(db.sessionStore));
+
+			userJar.setCookie('token=', `${protocol}//${hostname}/`);	// remove the token
+			await request(`${nconf.get('url')}`, {
+				resolveWithFullResponse: true,
+				jar: userJar,	// now with no token
+				followRedirect: false,
+				simple: false,
+			});
+
+			const cookies = userJar.getCookies(`${protocol}//${hostname}/`);
+			assert(cookies);
+
+			const sidCookie = cookies.find(cookie => cookie.key === 'express.sid');
+			assert(sidCookie);
+
+			let sid = sidCookie.value.match(/s%3A([^.]+)/);
+			assert(sid && sid[1]);
+			sid = sid[1];
+			const sessionObj = await getSession(sid);
+
+			assert(sessionObj && (!sessionObj.passport || !sessionObj.passport.uid));
+
+			// Restore userJar's session again
+			await request(`${nconf.get('url')}/debug/session`, {
+				jar: userJar,
+			});
+		});
+	});
+
+	describe('login override', () => {
+		it('should redirect a guest to a specified login override if configured', async () => {
+			await meta.settings.setOne('session-sharing', 'loginOverride', 'https://example.org/login');
+			const response = await request(`${nconf.get('url')}/login`, {
+				resolveWithFullResponse: true,
+				jar: anonJar,
+				followRedirect: false,
+				simple: false,
+			});
+
+			assert(response.statusCode, 302);
+			assert.strictEqual(response.headers.location, 'https://example.org/login');
+		});
+	});
+
+	describe('register override', () => {
+		it('should redirect a guest to a specified register override if configured', async () => {
+			await meta.settings.setOne('session-sharing', 'registerOverride', 'https://example.org/register');
+			const response = await request(`${nconf.get('url')}/register`, {
+				resolveWithFullResponse: true,
+				jar: anonJar,
+				followRedirect: false,
+				simple: false,
+			});
+
+			assert(response.statusCode, 302);
+			assert.strictEqual(response.headers.location, 'https://example.org/register');
+		});
+	});
+});