How to find MongoDB document and compare to data posted to server - mongodb

Question

I'm new to server-side programming, and I'm trying to understand how to send data server-side, find a document in a collection and compare it against that data, and then send a status back to the client depending on whether or not it exists.
Here's what's being sent server-side via the /login post request:
{"email":"johndoe#gmail.com","password":"pass"}
Here's the document I'm wanting to compare against in the users collection in my DB:
{
"_id" : ObjectId("580bcf9874ae28934705c0fc"),
"email" : "johndoe#gmail.com",
"password" : "pass"
}
And here's my server-side script (areas I'm guessing are problematic have comments above them):
var express = require("express");
var app = express();
var bodyParser = require("body-parser");
var fs = require("fs");
var mongoose = require("mongoose");
app.use(bodyParser.json());
app.use(bodyParser.urlencoded({extended: false}));
app.use(express.static("./public"));
mongoose.connect('mongodb://localhost:27017', function (err, db) {
app.post("/login", function(req, res) {
var emailRegex = /^(([^<>()\[\]\\.,;:\s#"]+(\.[^<>()\[\]\\.,;:\s#"]+)*)|(".+"))#((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/;
var userInDb;
// ***** HERE 1 ******
db.collection("users").findOne( {"email": req.body["email"], "password": req.body["password"]} ).toArray(function(err, results) {
userInDb = results;
db.close();
});
// ***** HERE 2 ******
var emailInDb = userInDb["email"];
var passwordInDb = userInDb["password"];
if (!req.body["email"] || !req.body["password"]) {
res.sendStatus(403);
} else if ( !emailRegex.test(req.body["email"])) {
res.sendStatus(403);
} else if ( (req.body["email"] != emailInDb) && (req.body["password"] != passwordInDb) ) {
res.sendStatus(403);
} else {
res.sendStatus(200);
}
});
});
I've also experimented with the following in place of the "HERE 1" section:
var findUser = function (db, callback) {
var users = db.collection("users");
users.findOne({"email": req.body["email"], "password": req.body["password"]}).toArray(function(err, results) {
userInDb = results;
callback(results);
});
=================== EDIT ========================
Here's what it looks like after implementing the below:
mongoose.connect('mongodb://localhost:27017', function (err, db) {
app.post("/login", function(req, res) {
var emailRegex = /^(([^<>()\[\]\\.,;:\s#"]+(\.[^<>()\[\]\\.,;:\s#"]+)*)|(".+"))#((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/;
var userInDb;
if (!req.body["email"] || !req.body["password"]) {
return res.sendStatus(403);
} else if ( !emailRegex.test(req.body["email"])) {
return res.sendStatus(403);
} else {
db.collection("users").findOne( {"email": req.body["email"], "password": req.body["password"]}, function(err, results) {
if(err || !result) {
return res.sendStatus(403);
} else {
userInDb = results;
db.close();
return res.sendStatus(200);
}
});
}
});
});
But I'm getting this error in the terminal:
POST request for '/login' - {"email":"johndoe#gmail.com","password":"pass"}
TypeError: Cannot read property 'collection' of undefined at app.js:30:6
Here's what's at line 30:
db.collection("users").findOne( {"email": req.body["email"], "password": req.body["password"]}, function(err, results) {
Does the collection need to be stored somewhere other than the /db/data/ folder you set up when installing MongoDB, do I need to mongoose.connect directly to the users collection, or something else?

Answer 1

findOne is an async function, you have to put the code above here 2 on the callback like this :
db.collection("users").findOne( {"email": req.body["email"], "password": req.body["password"]} ).toArray(function(err, results) {
// ***** HERE 2 ******
var emailInDb = userInDb["email"];
var passwordInDb = userInDb["password"];
.....
});
Then, you forget to check error and result,
db.collection("users").findOne( {"email": req.body["email"], "password": req.body["password"]} ).toArray(function(err, results) {
if(err || !result)
res.sendStatus(403);
// ***** HERE 2 ******
var emailInDb = userInDb["email"];
var passwordInDb = userInDb["password"];
.....
});
Then, you call findOne with the toArray function, why ? You only want 1 result, you don't need to transformed it. In addition you don't use the result as an array, so replace it with
db.collection("users").findOne( {"email": req.body["email"], "password": req.body["password"]}, function(err, results) {
if(err || !result)
return res.sendStatus(403);
// ***** HERE 2 ******
var emailInDb = userInDb["email"];
var passwordInDb = userInDb["password"];
.....
});
Finally, do control before mongo call to prevent useless db call and no need to check (req.body["email"] != emailInDb) && (req.body["password"] != passwordInDb) as it has been already done in mongo query.
Final code :
var emailInDb = userInDb["email"];
var passwordInDb = userInDb["password"];
if (!req.body["email"] || !req.body["password"]) {
return res.sendStatus(403);
} else if ( !emailRegex.test(req.body["email"])) {
return res.sendStatus(403);
} else {
db.collection("users").findOne( {"email": req.body["email"], "password": req.body["password"], function(err, results) {
if(err || !result)
return res.sendStatus(403);
else
{
userInDb = results;
db.close();
return res.sendStatus(200);
}
});
});
}
Other optimisations :
you don't need to put your call in the mongo db connect callback.
hash your password in db
================ EDIT =============
Don't use db.collection
File app.js
var mongoose = require("mongoose");
var User = require("./models/User");
mongoose.connect('mongodb://localhost:27017');
app.post("/login", function(req, res) {
var emailRegex = /^(([^<>()\[\]\\.,;:\s#"]+(\.[^<>()\[\]\\.,;:\s#"]+)*)|(".+"))#((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/;
var userInDb;
if (!req.body["email"] || !req.body["password"]) {
return res.sendStatus(403);
} else if ( !emailRegex.test(req.body["email"])) {
return res.sendStatus(403);
} else {
Users.findOne( {"email": req.body["email"], "password": req.body["password"]}, function(err, results) {
if(err || !results) {
return res.sendStatus(403);
} else {
return res.sendStatus(200);
}
});
}
});
app.listen(....
File models/User.js
var mongoose = require('mongoose');
var userSchema = new mongoose.Schema({
// auth fields
email: {type: String, unique: true, lowercase: true },
password: {type: String, default: ""}
... other fields
});
module.exports = mongoose.model('User', userSchema);