feathersjs-ecosystem / feathers-authentication-management

Adds sign up verification, forgotten password reset, and other capabilities to local feathers-authentication
https://feathers-a-m.netlify.app/
MIT License
246 stars 98 forks source link

verifySignupLong results in email not verified error #150

Closed iSplasher closed 4 years ago

iSplasher commented 4 years ago

Hello, I just set up the auth management following the docs. The user service is being served at /s/users. The authentication at /s/auth. The authManagement at /s/auth/management. I also tried /s/authMgmt with no luck. I have created a user, and all fields are being added successfully. But whenever I try to verify the user, for example, with a POST request:

{
    "action": "verifySignupLong",
    "value": "d22a4d59e3be573bad16e06c1622e8"
}

I get this back:

{
    "name": "BadRequest",
    "message": "User's email is not yet verified.",
    "code": 400,
    "className": "bad-request",
    "errors": {}
}

I have checked and I really can't understand why. Here's how I initialize the service:

app.configure(authentication);
app.configure(authManagement({
    service: app.get("authentication").service,
    path: app.get("authentication").management,
    sanitizeUserForClient: () => ({}),
    identifyUserProps: ['username', 'email']
}))
// Set up our services (see `services/index.js`)
app.configure(services);

Here's my hooks for the users service:

import * as feathersAuthentication from '@feathersjs/authentication';
import * as local from '@feathersjs/authentication-local';
import { Application } from '../../declarations';

import { hooks as authHooks } from 'feathers-authentication-management'
import { iff, isProvider, discard, preventChanges } from 'feathers-hooks-common'
// Don't remove this comment. It's needed to format import lines nicely.

const { authenticate } = feathersAuthentication.hooks;
const { hashPassword, protect } = local.hooks;

export default (app: Application) => ({
  before: {
    all: [],
    find: [ authenticate('jwt'), authHooks.isVerified() ],
    get: [ authenticate('jwt'), authHooks.isVerified() ],
    create: [ hashPassword('password'), authHooks.addVerification(app.get("authentication").management) ],
    update: [
      hashPassword('password'),
      authenticate('jwt'),
      iff(isProvider('external'), preventChanges(
         true,
        'isVerified',
        'verifyToken',
        'verifyShortToken',
        'verifyExpires',
        'verifyChanges',
        'resetToken',
        'resetShortToken',
        'resetExpires'
      )),
    ],
    patch: [
      iff(isProvider('external'),
      hashPassword('password')),
      authenticate('jwt'),
      iff(isProvider('external'), preventChanges(
        true,
       'isVerified',
       'verifyToken',
       'verifyShortToken',
       'verifyExpires',
       'verifyChanges',
       'resetToken',
       'resetShortToken',
       'resetExpires'
     )),
    ],
    remove: [ authenticate('jwt') ]
  },

  after: {
    all: [ 
      // Make sure the password field is never sent to the client
      // Always must be the last hook
      protect('password')
    ],
    find: [],
    get: [],
    create: [discard("password"), authHooks.removeVerification()],
    update: [],
    patch: [],
    remove: []
  },

  error: {
    all: [],
    find: [],
    get: [],
    create: [],
    update: [],
    patch: [],
    remove: []
  }
});

Any help is appreciated!

claustres commented 4 years ago

I guess the problem is related to the isVerified you added on find/get operations. This hook should only be used to check if the user is verified before performing some specific operation in your app like changing security settings when you need to be sure the user can be contacted by email or SMS for instance because you will send him a verification code or an alert.

Adding it to get/find operations will cause any service call made on behalf of the user fail until he his not verified. As a consequence when the module performs a find with the verification token it will fail and the verify operation will stop without updating the user. This should work if you remove the hook.

iSplasher commented 4 years ago

Yes, that was it! Can't believe i missed that. Thanks