From 474b3f81857ff27717cf97c63e16d0e075f16e3c Mon Sep 17 00:00:00 2001
From: Stephan <57194608+stephan418@users.noreply.github.com>
Date: Thu, 9 Jun 2022 13:50:26 +0200
Subject: [PATCH] Rewrite parts of the requestTokenEmailController

---
 src/Controllers/user_auth.controller.ts | 19 ++++++++++---------
 src/Routes/user_auth.routes.ts          |  3 ++-
 2 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/src/Controllers/user_auth.controller.ts b/src/Controllers/user_auth.controller.ts
index c2f02ef..268e1cc 100644
--- a/src/Controllers/user_auth.controller.ts
+++ b/src/Controllers/user_auth.controller.ts
@@ -97,7 +97,7 @@ export const register = async (req: Request<{}, {}, CreateTeamBody>, res: Respon
 };
 
 export const requestToken = async (req: Request, res: Response) => {
-  const data = z.object({ teamId: z.string().min(1) }).safeParse(req);
+  const data = z.object({ teamId: z.string().min(1) }).safeParse(req.body);
 
   if (data.success == false) {
     return res.status(400).json(generateInvalidBodyError({ teamId: DataType.STRING }, data.error));
@@ -130,7 +130,7 @@ export const requestToken = async (req: Request, res: Response) => {
 };
 
 export const requestTokenEmail = async (req: Request, res: Response) => {
-  const data = z.object({ email: z.string().min(1) }).safeParse(req);
+  const data = z.object({ email: z.string().email() }).safeParse(req.body);
 
   if (data.success == false) {
     return res.status(400).json(generateInvalidBodyError({ email: DataType.STRING }, data.error));
@@ -149,23 +149,24 @@ export const requestTokenEmail = async (req: Request, res: Response) => {
     },
   });
 
-  if (!teams) {
-    return res.status(404).json(generateError("Team does not exist!"));
+  if (teams.length <= 0) {
+    // REVIEW: Potential for time-based attacks
+    return res
+      .status(200)
+      .json({ type: "sucess", payload: { message: "If a team with the provided email exist, the token was sent!" } });
   }
 
   const team = teams[0]; //REVIEW: maybe a email should be only able to be responsible for one team
 
-  if (!team) {
-    return res.status(404).json(generateError("Team does not exist!"));
-  }
-
   const usid = nanoid();
 
   (await mailClient).set(usid, team.pid);
 
   verificationMail(team.leaderEmail, team.discipline.name, usid);
 
-  res.status(200).json({ type: "sucess", payload: { message: "Email sent!" } });
+  res
+    .status(200)
+    .json({ type: "sucess", payload: { message: "If a team with the provided email exist, the token was sent!" } });
 };
 
 export const verifyEmail = async (req: Request, res: Response) => {
diff --git a/src/Routes/user_auth.routes.ts b/src/Routes/user_auth.routes.ts
index 568b764..a673928 100644
--- a/src/Routes/user_auth.routes.ts
+++ b/src/Routes/user_auth.routes.ts
@@ -1,10 +1,11 @@
 import express from "express";
-import { register, requestToken, verifyEmail } from "../Controllers/user_auth.controller";
+import { register, requestToken, requestTokenEmail, verifyEmail } from "../Controllers/user_auth.controller";
 
 const router = express.Router();
 
 router.post("/", register);
 router.get("/verify/:code", verifyEmail);
 router.get("/token", requestToken);
+router.post("/email-token", requestTokenEmail);
 
 export default router;