introduce local authentication

.gitignore

@@ -1,3 +1,4 @@
 docs/test.html
 npm-debug.log
 node_modules/
+*.swp

files/seed_users.js

@@ -0,0 +1,22 @@
+var mongoose = require('mongoose'),
+    config = require('config'),
+    User = require('../lib/models/user'); 
+
+mongoose.connect(process.env.DATABASE || config.app.database);
+var db = mongoose.connection;
+db.on('error', function(){
+  app.log.error('Could not connect to Mongo :/')
+});
+db.once('open', function(){
+  console.log('Mongo connected!');
+
+  var user = new User({ username: 'bob', email: 'bob@example.com', password: 'secret' });
+  user.save(function(err) {
+    if(err) {
+      console.log(err);
+    } else {
+      console.log('user: ' + user.username + " saved.");
+    }
+    mongoose.disconnect();
+  });
+});

lib/app.js

@@ -1,6 +1,9 @@
 // module dependencies
 var express = require('express')
-  , config = require('config');
+  , path = require('path')
+  , config = require('config')
+  , passport = require('passport')
+  , flash = require('connect-flash');
 
 var app = express();
 
@@ -12,10 +15,16 @@ app.use(express.favicon(__dirname + '/../public/favicon.ico'));
 app.use(express.compress());
 app.use(express.bodyParser());
 app.use(express.methodOverride());
+app.use(express.cookieParser());
+app.use(express.session({ secret: 'keyboard cat' }));
+app.use(flash());
+app.use(passport.initialize());
+app.use(passport.session());
 app.use(app.router);
 app.use(express.static(__dirname + '/../public'));
 app.log = require('./utils/logger')();
 
+
 // development only
 var dev = 'production' != app.get('env');// good enough
 if (dev) {
@@ -26,6 +35,8 @@ if (dev) {
 require('./routes/index')(app);
 require('./routes/search')(app);
 require('./routes/info')(app);
+require('./routes/login')(app);
+require('./routes/signup')(app);
 
 var mongoose = require('mongoose');
 mongoose.connect(process.env.DATABASE || config.app.database);

lib/authn/index.js

@@ -0,0 +1,34 @@
+var User = require('../models/user'),
+    passport = require('passport'),
+    LocalStrategy = require('passport-local').Strategy,
+    flash = require('connect-flash');
+
+passport.use(new LocalStrategy(function(username, password, done) {
+  User.findOne({ username: username }, function(err, user) {
+    if (err) {
+      console.log('there was an error: ', err);
+      return done(err);
+    }
+    if (!user) {
+      return done(null, false, { message: 'Unknown user ' + username });
+    }
+    user.comparePassword(password, function(err, isMatch) {
+      if (err) return done(err);
+      if(isMatch) {
+        return done(null, user);
+      } else {
+        return done(null, false, { message: 'Invalid password' });
+      }
+    });
+  });
+}));
+
+passport.serializeUser(function(user, done) {
+  done(null, user.id);
+});
+
+passport.deserializeUser(function(id, done) {
+  User.findById(id, function (err, user) {
+    done(err, user);
+  });
+});

lib/models/user.js

@@ -0,0 +1,37 @@
+var mongoose = require('mongoose'),
+  bcrypt = require('bcrypt'),
+  SALT_WORK_FACTOR = 10;
+
+// User Schema
+var userSchema = mongoose.Schema({
+  username: { type: String, required: true, unique: true },
+  email: { type: String, required: true, unique: true },
+  password: { type: String, required: true},
+});
+
+// Bcrypt middleware
+userSchema.pre('save', function(next) {
+  var user = this;
+
+  if(!user.isModified('password')) return next();
+
+  bcrypt.genSalt(SALT_WORK_FACTOR, function(err, salt) {
+    if(err) return next(err);
+
+    bcrypt.hash(user.password, salt, function(err, hash) {
+      if(err) return next(err);
+      user.password = hash;
+      next();
+    });
+  });
+});
+
+// Password verification
+userSchema.methods.comparePassword = function(candidatePassword, cb) {
+  bcrypt.compare(candidatePassword, this.password, function(err, isMatch) {
+    if(err) return cb(err);
+    cb(null, isMatch);
+  });
+};
+
+module.exports = mongoose.model('User', userSchema);

lib/routes/login.js

@@ -0,0 +1,29 @@
+var passport = require('passport'),
+    pass = require('../authn');
+
+module.exports = function(app) {
+  app.get('/login', function(req, res) {
+    res.render('login', { user: req.user, message: req.flash('error')});
+  });
+
+  app.get('/logout', function(req, res){
+    req.logout();
+    res.redirect('/');
+  });
+
+  app.post('/login', passport.authenticate('local',
+      {
+        successRedirect: '/profile',
+        failureRedirect: '/login',
+        failureFlash: true
+      }));
+
+  app.get('/profile', ensureAuthenticated, function(req, res){
+    res.render('profile', { username: req.user.username});
+  });
+
+  function ensureAuthenticated(req, res, next) {
+    if (req.isAuthenticated()) { return next(); }
+      res.redirect('/login')
+  }
+}

lib/routes/signup.js

@@ -0,0 +1,24 @@
+var User = require('../models/user');
+
+module.exports = function(app) {
+
+  app.get('/signup', function(req, res) {
+    res.render('signup');
+  });
+
+  app.post('/signup', function(req, res){
+    var user = new User({ username: req.body.username, email: req.body.email,
+        password: req.body.password });
+    user.save(function(err) {
+      if(err) {
+        console.log(err);
+        //TODO (Jose) make this error more user friendly
+        res.render('signup', { user: req.user, message: err });
+      } else {
+        console.log('user: ' + user.username + " saved.");
+        res.render('profile', { username: user.username }); 
+      }
+    });
+  });
+
+}

lib/views/login.jade

@@ -0,0 +1,13 @@
+div
+  if message
+    div= message
+  form(action='/login',method='post')
+    div
+      fieldset
+       label(for='username') Username:
+       input(name='username',type='text',value='',placeholder='username')
+       label(for='password') Password:
+       input(name='password',type='password',value='',placeholder='password')
+       div
+         input(type='submit',value='Login')
+

lib/views/profile.jade

@@ -0,0 +1,7 @@
+a(href='/') home  
+&&
+a(href='/logout') logout
+div
+  p
+    | This is the profile for:
+    span= username

lib/views/signup.jade

@@ -0,0 +1,10 @@
+if message
+  div= message
+form(id="signup", method="POST", action="/signup")
+  label(for='username') Username
+  input#email(type='text', name='username')
+  label(for='email') Email
+  input#email(type='text', name='email')
+  label(for='password') Password
+  input#password(type='password', name='password')
+  input(type="submit", value="SignUp")