strip spaces from usernames

3 files changed, 22 insertions, 15 deletions

diff --git a/lib/passport.js b/lib/passport.js
index 9b88f27c..eafc8179 100644
--- a/lib/passport.js
+++ b/lib/passport.js
@@ -1,5 +1,6 @@
 const Passport = require("passport");
 const jwt = require("passport-jwt");
+const { Op } = require("sequelize");
 
 function cookieExtractor(req) {
   if (req && req.cookies) {
@@ -13,20 +14,23 @@ passport = Passport.use(
     {
       jwtFromRequest: jwt.ExtractJwt.fromExtractors([
         jwt.ExtractJwt.fromAuthHeaderAsBearerToken(),
-        cookieExtractor
+        cookieExtractor,
       ]),
-      secretOrKey: config.jwt
+      secretOrKey: config.jwt,
     },
     async (payload, next) => {
-      const { username } = payload;
       try {
+        let { username } = payload;
         let user = await db.User.findOne({
-          where: { username },
-          include: { model: db.Account, as: "account" }
+          where: {
+            username: { [Op.or]: [username, username.replace(/ /g, "")] },
+          },
+          include: { model: db.Account, as: "account" },
         });
         if (user.locked) throw new Error("account is locked");
         next(null, user);
       } catch (e) {
+        console.log(e);
         l.error("problem logging in", e);
         next(null, { username: "guest" });
       }
@@ -36,15 +40,15 @@ passport = Passport.use(
 
 auth = passport.authenticate("jwt", { session: false });
 
-optionalAuth = function(req, res, next) {
-  passport.authenticate("jwt", { session: false }, function(err, user, info) {
+optionalAuth = function (req, res, next) {
+  passport.authenticate("jwt", { session: false }, function (err, user, info) {
     req.user = user;
     next();
   })(req, res, next);
 };
 
 adminAuth = (req, res, next) => {
-  passport.authenticate("jwt", { session: false }, function(err, user, info) {
+  passport.authenticate("jwt", { session: false }, function (err, user, info) {
     if (!(user && user.admin)) throw new Error("restricted");
     req.user = user;
     next();
diff --git a/lib/register.js b/lib/register.js
index eef2b7b4..dc57cd95 100644
--- a/lib/register.js
+++ b/lib/register.js
@@ -4,6 +4,7 @@ const bcrypt = require("bcrypt");
 
 register = ah(async (user, ip, requireChallenge) => {
   if (!(user && user.username)) throw new Error("Username required");
+  user.username = user.username.replace(/ /g, "");
 
   let exists = await db.User.count({ where: { username: user.username } });
   if (exists) throw new Error(`Username ${user.username} taken`);
@@ -12,7 +13,7 @@ register = ah(async (user, ip, requireChallenge) => {
     user.password = await bcrypt.hash(user.password, 1);
   }
 
-  user.sms = user.formattedPhone || user.sms
+  user.sms = user.formattedPhone || user.sms;
 
   // Separate logic for presetting user preferences below into separate manageable file ... (& remove redundant user / account reference)
   let countries = {
diff --git a/lib/utils.js b/lib/utils.js
index 23c811c1..8e857659 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -6,10 +6,12 @@ getUser = async (username, transaction) => {
     include: [
       {
         model: db.Account,
-        as: "account"
-      }
+        as: "account",
+      },
     ],
-    where: { username }
+    where: {
+      username: { [Op.or]: [username, username.replace(/ /g, "")] },
+    },
   };
 
   if (transaction) {
@@ -28,10 +30,10 @@ getUserById = async (id, transaction) => {
     include: [
       {
         model: db.Account,
-        as: "account"
-      }
+        as: "account",
+      },
     ],
-    where: { id }
+    where: { id },
   };
 
   if (transaction) {