lefnire/derby-auth

Provides authentication for DerbyJS projects

derby-auth's Issues

db.users.drop() causes trouble

db.users.drop() seems to cause problems - the code (derby-auth) assumes that everything is ok when the sess.userId is set, but actually the database can be empty, which isn't noticed that that point (https://github.com/lefnire/derby-auth/blob/master/index.js#L64), and it will lead to problems afterwards.

The client has to have a cookie set in order the sess.userId to be set (of course).

Error: Invalid plugin.decorate value: undefined

Whenever I try to run the example, I get

"Error: Invalid plugin.decorate value: undefined"

Error requiring server module from `C:\xampp\htdocs\Derbyjs\derby-auth\example\l
ib\server`

C:\xampp\htdocs\Derbyjs\derby-auth\example\node_modules\derby\lib\cluster.js:41
    throw e;
          ^
Error: Invalid plugin.decorate value: undefined
    at EventEmitter.module.exports.use (C:\xampp\htdocs\Derbyjs\derby-auth\examp
le\node_modules\derby\node_modules\racer\lib\plugin.js:32:13)
    at Object. (C:\xampp\htdocs\Derbyjs\derby-auth\example\lib\auth\i
ndex.js:4:7)
    at Module._compile (module.js:449:26)
    at Object.Module._extensions..js (module.js:467:10)
    at Module.load (module.js:356:32)
    at Function.Module._load (module.js:312:12)
    at Module.require (module.js:362:17)
    at require (module.js:378:17)
    at Object. (C:\xampp\htdocs\Derbyjs\derby-auth\example\lib\server
\index.js:6:11)
    at Module._compile (module.js:449:26)
    at Object.Module._extensions..js (module.js:467:10)
    at Module.load (module.js:356:32)
    at Function.Module._load (module.js:312:12)
    at Module.require (module.js:362:17)
    at require (module.js:378:17)
    at requireServer (C:\xampp\htdocs\Derbyjs\derby-auth\example\node_modules\de
rby\lib\cluster.js:38:18)
    at Object.run (C:\xampp\htdocs\Derbyjs\derby-auth\example\node_modules\derby
\lib\cluster.js:13:18)
    at EventEmitter.run (C:\xampp\htdocs\Derbyjs\derby-auth\example\node_modules
\derby\lib\derby.server.js:36:16)
    at Object. (C:\xampp\htdocs\Derbyjs\derby-auth\example\server.js:
4:22)
    at Module._compile (module.js:449:26)
    at Object.Module._extensions..js (module.js:467:10)
    at Module.load (module.js:356:32)
    at Function.Module._load (module.js:312:12)
    at Module.runMain (module.js:492:10)
    at process.startup.processNextTick.process._tickCallback (node.js:244:9)

Cannot GET /auth/google/return?...

Cannot GET /auth/google/return?openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&openid.mode=id_res&openid.op_endpoint=https%3A%2F%2Fwww.google.com%2Faccounts%2Fo8%2Fud&openid.response_nonce=2012-12-08T05%3A52%3A32ZdyNV5PtUsSofmg&openid.return_to=http%3A%2F%2Flocalhost%3A3000%2Fauth%2Fgoogle%2Freturn&openid.assoc_handle=AMlYA9XZyQjKJi0wjPBaH3DmRxaiRLuZVQBlvW9ic9t56GHG7hLAcBCHLwkCDMjHYjQhZ9eH&openid.signed=op_endpoint%2Cclaimed_id%2Cidentity%2Creturn_to%2Cresponse_nonce%2Cassoc_handle%2Cns.ext1%2Cext1.mode%2Cext1.type.firstname%2Cext1.value.firstname%2Cext1.type.lastname%2Cext1.value.lastname%2Cext1.type.email%2Cext1.value.email&openid.sig=kh%2BF03PMdXTj5nEJaw%2FabXFJO5oc8tVknnKHYWb%2F5zc%3D&openid.identity=https%3A%2F%2Fwww.google.com%2Faccounts%2Fo8%2Fid%3Fid%3DAItOawlhMZ0Wqq3hwPHevjfWaiYnj7dK6Y6THks&openid.claimed_id=https%3A%2F%2Fwww.google.com%2Faccounts%2Fo8%2Fid%3Fid%3DAItOawlhMZ0Wqq3hwPHevjfWaiYnj7dK6Y6THks&openid.ns.ext1=http%3A%2F%2Fopenid.net%2Fsrv%2Fax%2F1.0&openid.ext1.mode=fetch_response&openid.ext1.type.firstname=http%3A%2F%2Faxschema.org%2FnamePerson%2Ffirst&openid.ext1.value.firstname=Carter&openid.ext1.type.lastname=http%3A%2F%2Faxschema.org%2FnamePerson%2Flast&openid.ext1.value.lastname=Charbonneau&openid.ext1.type.email=http%3A%2F%2Faxschema.org%2Fcontact%2Femail&openid.ext1.value.email=zcarterc%40gmail.com

Pass in scope object to facebook login

http://passportjs.org/guide/facebook/

app.get('/auth/facebook',
  passport.authenticate('facebook', { scope: ['read_stream', 'publish_actions'] })
);

It should be here, I believe. https://github.com/lefnire/derby-auth/blob/master/index.js#L252

Support for multiple accounts

For some applications, it is useful to have multiple twitter accounts, etc.

'username not registered' unable to log on with new account

I created my account last night, username Asteroktonos. (I'm sure that's right because I can read it in the confirmation e-mail sent to me), but when I type it into the habitrpg login it says "Username not registered. Make sure you're using the same capitalization you used to register!" I can log in with the password I created at community.habitrpg.com but not into the game. I've also tried the beta site and it also won't work. Still excited to try this out.

Call back URL can be "/auth" + name + "/callback"

Following line in index.js works fine with Facebook
_.defaults(obj.conf, {callbackURL: "/auth/" + name + "/callback"})

Branch 0.5 initial load error

I made sure that I npm install both in the example folder as well as the derby-auth folder.

The code initially runs, but when I open up the browser I got the following error message:

Master pid 9960
9962 listening. Go to: http://localhost:3000/

/home/ge/sites/test_node_ge/derby-auth/example/node_modules/livedb-mongo/node_modules/mongoskin/node_modules/mongodb/lib/mongodb/connection/server.js:529
throw err;
^
Invalid snapshot data

Thanks lefnire! I was really happy when I saw your post of this 0.5 update.

I am running node 0.10.10

Ge

Send username in "forgot password" email

people are forgetting their username too, just add this to the email template

Retain access token

Plenty of apps return an access token so one can interact with the platform's API and do actions (i.e. status update, tweet).

This was brought up in #1 but deserves it's own thread.

example doesn't work in the 0.5 branch

Not sure if I'm doing anything wrong, but the following:

 git clone [email protected]:lefnire/derby-auth.git
 cd derby-auth && git checkout 0.5 && git pull origin 0.5
 npm install
 cd example && npm install
 node server.js

And separately visiting localhost:3000 triggers this:

 TypeError: undefined is not a function
    at next (/Users/dstaudigel/dev/derby-auth/example/node_modules/derby/node_modules/racer/node_modules/share/lib/server/index.js:70:5)
    at ShareInstance._trigger (/Users/dstaudigel/dev/derby-auth/example/node_modules/derby/node_modules/racer/node_modules/share/lib/server/index.js:77:3)
    at UserAgent.trigger (/Users/dstaudigel/dev/derby-auth/example/node_modules/derby/node_modules/racer/node_modules/share/lib/server/useragent.js:59:17)
    at UserAgent.fetch (/Users/dstaudigel/dev/derby-auth/example/node_modules/derby/node_modules/racer/node_modules/share/lib/server/useragent.js:65:9)
    at Session._handleMessage (/Users/dstaudigel/dev/derby-auth/example/node_modules/derby/node_modules/racer/node_modules/share/lib/server/session.js:290:15)
    at Session.pump (/Users/dstaudigel/dev/derby-auth/example/node_modules/derby/node_modules/racer/node_modules/share/lib/server/session.js:168:10)
.....

Change password

Make Derby-auth work with stock Derby and Racer

Can the stock Derby and Racer be patched up so that derby-auth works with the stock Derby and Racer?

Confirmation email

add a confirmation email feature

Password reset email should be configurable

https://github.com/lefnire/derby-auth/blob/master/index.js#L316-L322

HabitRPG shouldn't be hard-coded anywhere in this library.

Some other issues:

• The username and new password should be HTML-escaped
• This allows attackers to bother users by resetting their passwords every 5 minutes; you should have some kind of verification before resetting (or, better yet, a single-use expiring link in the email that lets the user enter a new password)

Registering user fails because undefined function is passed to _fetchUser

Registering a user fails in expressApp.post('/register') when it makes the following call "_fetchUser(q, model, done, function" because the parameter done is undefined.

It's duplicating another user's facebook profile into new local registrations

see HabitRPG/habitica#22 . When new users register with local strategy (uname / password), it's duplicating a specific facebook profile into their own .auth.facebook (even though they didn't register with facebook). And when I say a specific profile, it's the same person every time (name not included for privacy). This problem doesn't occur for any other facebook profiles in the database. Still happens with server reset, database reset, and db.sessions.drop() in mongo - so I don't think it's some stale session issues.

While it is "benign" in that their login and data is their own, and they don't even know they have that vestigial profile data in their profile - it's a security issue.

Login Error: Branch 0.5

Hey guys:

I am running the example. I can register a new user but I can't log in a registered user. This is part of the error log:

404: /login

.../example/node_modules/redis/index.js:535
throw err;
^
Error: Document already exists
at Array.defaultCallback (.../example/node_modules/racer/lib/Model/events.js:25:40)
at Doc._clearInflightOp (.../example/node_modules/racer/node_modules/share/lib/client/doc.js:799:17)
at Doc._onMessage (.../example/node_modules/racer/node_modules/share/lib/client/doc.js:259:14)
at StreamSocket.socket.onmessage (.../node_modules/racer/node_modules/share/lib/client/connection.js:116:13)

....

email confirmation for reset password

Cannot read property '1' of undefined

@lefnire would like to use derby-auth but no idea what's going on.

i've:

• set up the middleware
• set up the store
• required the ui components
• followed the example

however, i'm not using mongodb... i'm using racer's memory store.

i can go to the login or register pages... but when i try to register a user, and click the register button, i get this stack trace:

TypeError: Cannot read property '1' of undefined
    at Object.module.exports.getId (/Users/razic/timely/guideadvisor/node_modules/derby/node_modules/racer/lib/transaction.js:24:37)
    at Object.module.exports.server._commit.res.fail (/Users/razic/timely/guideadvisor/node_modules/derby/node_modules/racer/lib/txns/txns.Model.js:324:43)
    at module.exports.events.init.store.eachContext.context.guardWrite.context.guardWrite (/Users/razic/timely/guideadvisor/node_modules/derby/node_modules/racer/lib/accessControl/accessControl.Store.js:58:26)
    at next (/Users/razic/timely/guideadvisor/node_modules/derby/node_modules/racer/lib/middleware.js:7:26)
    at guard (/Users/razic/timely/guideadvisor/node_modules/derby/node_modules/racer/lib/accessControl/accessControl.Store.js:215:37)
    at next (/Users/razic/timely/guideadvisor/node_modules/derby/node_modules/racer/lib/middleware.js:7:26)
    at Object.run [as guardWrite] (/Users/razic/timely/guideadvisor/node_modules/derby/node_modules/racer/lib/middleware.js:10:12)
    at accessController (/Users/razic/timely/guideadvisor/node_modules/derby/node_modules/racer/lib/txns/txns.Store.js:103:17)
    at next (/Users/razic/timely/guideadvisor/node_modules/derby/node_modules/racer/lib/middleware.js:7:26)
    at Object.run (/Users/razic/timely/guideadvisor/node_modules/derby/node_modules/racer/lib/middleware.js:10:12)
    at Model.module.exports.server._commit (/Users/razic/timely/guideadvisor/node_modules/derby/node_modules/racer/lib/txns/txns.Model.js:332:29)
    at Model.module.exports.proto._sendOp (/Users/razic/timely/guideadvisor/node_modules/derby/node_modules/racer/lib/txns/txns.Model.js:405:12)
    at Model.module.exports.proto.set.fn [as set] (/Users/razic/timely/guideadvisor/node_modules/derby/node_modules/racer/lib/mutators/mutators.Model.js:99:21)
    at /Users/razic/timely/guideadvisor/lib/guideadvisor/index.js:65:39
    at onRoute (/Users/razic/timely/guideadvisor/node_modules/derby/lib/derby.server.js:69:7)
    at app.router (/Users/razic/timely/guideadvisor/node_modules/derby/node_modules/tracks/lib/index.js:96:16)
    at callbacks (/Users/razic/timely/guideadvisor/node_modules/derby/node_modules/tracks/node_modules/express/lib/router/index.js:160:37)
    at param (/Users/razic/timely/guideadvisor/node_modules/derby/node_modules/tracks/node_modules/express/lib/router/index.js:134:11)
    at pass (/Users/razic/timely/guideadvisor/node_modules/derby/node_modules/tracks/node_modules/express/lib/router/index.js:141:5)
    at Router._dispatch (/Users/razic/timely/guideadvisor/node_modules/derby/node_modules/tracks/node_modules/express/lib/router/index.js:169:5)
    at dispatch (/Users/razic/timely/guideadvisor/node_modules/derby/node_modules/tracks/lib/index.js:43:21)
    at Object.middleware [as handle] (/Users/razic/timely/guideadvisor/node_modules/derby/node_modules/tracks/lib/index.js:58:7)
    at next (/Users/razic/timely/guideadvisor/node_modules/express/node_modules/connect/lib/proto.js:190:15)
    at app.use.fn (/Users/razic/timely/guideadvisor/node_modules/express/lib/application.js:121:9)
    at next (/Users/razic/timely/guideadvisor/node_modules/express/node_modules/connect/lib/proto.js:127:23)
    at pass (/Users/razic/timely/guideadvisor/node_modules/express/lib/router/index.js:107:24)
    at Router._dispatch (/Users/razic/timely/guideadvisor/node_modules/express/lib/router/index.js:170:5)
    at Object.router (/Users/razic/timely/guideadvisor/node_modules/express/lib/router/index.js:33:10)
    at Context.next (/Users/razic/timely/guideadvisor/node_modules/express/node_modules/connect/lib/proto.js:190:15)
    at Context.actions.pass (/Users/razic/timely/guideadvisor/node_modules/derby-auth/node_modules/passport/lib/passport/context/http/actions.js:77:8)
    at SessionStrategy.authenticate (/Users/razic/timely/guideadvisor/node_modules/derby-auth/node_modules/passport/lib/passport/strategies/session.js:49:12)
    at pass (/Users/razic/timely/guideadvisor/node_modules/derby-auth/node_modules/passport/lib/passport/index.js:307:31)
    at Passport.deserializeUser (/Users/razic/timely/guideadvisor/node_modules/derby-auth/node_modules/passport/lib/passport/index.js:318:35)
    at /Users/razic/timely/guideadvisor/node_modules/derby-auth/index.js:86:16
    at pass (/Users/razic/timely/guideadvisor/node_modules/derby-auth/node_modules/passport/lib/passport/index.js:318:7)
    at Passport.deserializeUser (/Users/razic/timely/guideadvisor/node_modules/derby-auth/node_modules/passport/lib/passport/index.js:322:5)
    at SessionStrategy.authenticate (/Users/razic/timely/guideadvisor/node_modules/derby-auth/node_modules/passport/lib/passport/strategies/session.js:41:28)
    at attempt (/Users/razic/timely/guideadvisor/node_modules/derby-auth/node_modules/passport/lib/passport/middleware/authenticate.js:243:16)
    at Passport.authenticate (/Users/razic/timely/guideadvisor/node_modules/derby-auth/node_modules/passport/lib/passport/middleware/authenticate.js:244:7)
    at next (/Users/razic/timely/guideadvisor/node_modules/express/node_modules/connect/lib/proto.js:190:15)
    at Passport.initialize (/Users/razic/timely/guideadvisor/node_modules/derby-auth/node_modules/passport/lib/passport/middleware/initialize.js:69:5)
    at next (/Users/razic/timely/guideadvisor/node_modules/express/node_modules/connect/lib/proto.js:190:15)
    at Object.handle (/Users/razic/timely/guideadvisor/node_modules/derby-auth/index.js:71:16)
    at next (/Users/razic/timely/guideadvisor/node_modules/express/node_modules/connect/lib/proto.js:190:15)
    at Object.module.exports [as handle] (/Users/razic/timely/guideadvisor/node_modules/derby-auth/node_modules/connect-flash/lib/flash.js:20:5)
    at next (/Users/razic/timely/guideadvisor/node_modules/express/node_modules/connect/lib/proto.js:190:15)
    at Object.expressInit [as handle] (/Users/razic/time

here is some information:

razic at razic in ~/timely/guideadvisor
node --version
v0.8.8

razic at razic in ~/timely/guideadvisor
cat package.json
{
  "name": "guideadvisor",
  "description": "",
  "version": "0.0.0",
  "main": "./server.js",
  "dependencies": {
    "derby": "git://github.com/Unroll-Me/derby#master",
    "racer": "git://github.com/SLaks/racer#master",
    "derby-auth": "git://github.com/lefnire/derby-auth.git",
    "express": "3.x",
    "gzippo": ">=0.2.0",
    "derby-ui-boot": "*"
  },
  "devDependencies": {
    "grunt": "~0.4.1",
    "chai": "~1.5.0",
    "grunt-cli": "~0.1.7",
    "grunt-contrib-jshint": "~0.1.1",
    "grunt-simple-mocha": "~0.4.0",
    "wd": "*"
  },
  "private": true
}

User registration doesn't set "_loggedIn" path to true

When user registration completes "user.id.auth.local" is set, however, session.passport is unchanged so "_loggedIn" does not evaluate to true after the redirect.

consolidate social network accounts

the ability to consolidate accounts (link twitter, link google, etc) after you've already created an account

Logout problem

When I log-out (by navigating to /logout) and immediately login - everything is fine.
But if I refresh the page after logout - the browser hangs. It will continue to do so until browser cookies are cleared.

TypeError: Cannot read property '_at' of undefined

Hi!
I have a problem with the authentication example.

/usr/bin/node server.js
Master pid 4693
info: socket.io started
4696 listening. Go to: http://localhost:3000/
connect.multipart() will be removed in connect 3.0
visit https://github.com/senchalabs/connect/wiki/Connect-3.0 for alternatives
connect.limit() will be removed in connect 3.0
TypeError: Cannot read property '_at' of undefined
    at Model.mixin.proto._createRef (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/racer/lib/refs/index.js:159:20)
    at Model.mixin.proto.ref (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/racer/lib/refs/index.js:125:19)
    at /home/lev/Projects/DerbyJS/derby-auth-master/example/lib/auth/index.js:12:11
    at Object.fail (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/racer/lib/descriptor/descriptor.Model.js:291:21)
    at Object._res.fail (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/racer/lib/pubSub/pubSub.Store.js:81:40)
    at /home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/racer/lib/accessControl/accessControl.Store.js:199:34
    at Object.<anonymous> (/home/lev/Projects/DerbyJS/derby-auth-master/store.js:27:9)
    at guard (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/racer/lib/accessControl/accessControl.Store.js:198:14)
    at next (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/racer/lib/middleware.js:7:26)
    at Object.run [as guardQuery] (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/racer/lib/middleware.js:10:12)
    at context.guardQuery (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/racer/lib/accessControl/accessControl.Store.js:48:19)
    at /home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/racer/lib/pubSub/pubSub.Store.js:89:11
    at next (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/racer/lib/middleware.js:7:26)
    at Object.run [as subscribe] (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/racer/lib/middleware.js:10:12)
    at /home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/racer/lib/descriptor/descriptor.Model.js:257:26
    at Object.Promise.on (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/racer/lib/util/Promise.js:29:7)
    at Model.module.exports.server._addSub (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/racer/lib/descriptor/descriptor.Model.js:241:29)
    at subscribe (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/racer/lib/descriptor/descriptor.Model.js:290:9)
    at Model.module.exports.proto.subscribe (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/racer/lib/descriptor/descriptor.Model.js:106:7)
    at Object.create.subscribe.value (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/racer/lib/descriptor/query/query.Model.js:349:13)
    at /home/lev/Projects/DerbyJS/derby-auth-master/example/lib/auth/index.js:11:53
    at onRoute (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/derby/lib/derby.server.js:69:7)
    at /home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/derby/node_modules/tracks/lib/index.js:84:16
    at callbacks (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/derby/node_modules/tracks/vendor/express/router/index.js:172:37)
    at param (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/derby/node_modules/tracks/vendor/express/router/index.js:146:11)
    at pass (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/derby/node_modules/tracks/vendor/express/router/index.js:153:5)
    at Router._dispatch (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/derby/node_modules/tracks/vendor/express/router/index.js:181:5)
    at Object.middleware [as handle] (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/derby/node_modules/tracks/lib/index.js:48:21)
    at next (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/express/node_modules/connect/lib/proto.js:193:15)
    at /home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/express/lib/application.js:121:9
    at next (/home/lev/Projects/DerbyJS/derby-auth-master/node_modules/express/node_modules/connect/lib/proto.js:129:23)
    at pass (/home/lev/Projects/DerbyJS/derby-auth-master/node_modules/express/lib/router/index.js:110:24)
    at Router._dispatch (/home/lev/Projects/DerbyJS/derby-auth-master/node_modules/express/lib/router/index.js:173:5)
    at Object.router (/home/lev/Projects/DerbyJS/derby-auth-master/node_modules/express/lib/router/index.js:33:10)
    at Context.next (/home/lev/Projects/DerbyJS/derby-auth-master/node_modules/express/node_modules/connect/lib/proto.js:193:15)
    at Context.actions.pass (/home/lev/Projects/DerbyJS/derby-auth-master/node_modules/passport/lib/passport/context/http/actions.js:77:8)
    at SessionStrategy.authenticate (/home/lev/Projects/DerbyJS/derby-auth-master/node_modules/passport/lib/passport/strategies/session.js:67:10)
    at attempt (/home/lev/Projects/DerbyJS/derby-auth-master/node_modules/passport/lib/passport/middleware/authenticate.js:243:16)
    at Passport.authenticate (/home/lev/Projects/DerbyJS/derby-auth-master/node_modules/passport/lib/passport/middleware/authenticate.js:244:7)
    at next (/home/lev/Projects/DerbyJS/derby-auth-master/node_modules/express/node_modules/connect/lib/proto.js:193:15)
    at Passport.initialize (/home/lev/Projects/DerbyJS/derby-auth-master/node_modules/passport/lib/passport/middleware/initialize.js:69:5)
    at next (/home/lev/Projects/DerbyJS/derby-auth-master/node_modules/express/node_modules/connect/lib/proto.js:193:15)
    at Object.handle (/home/lev/Projects/DerbyJS/derby-auth-master/index.js:72:16)
    at next (/home/lev/Projects/DerbyJS/derby-auth-master/node_modules/express/node_modules/connect/lib/proto.js:193:15)
    at Object.handle (/home/lev/Projects/DerbyJS/derby-auth-master/node_modules/connect-flash/lib/flash.js:21:5)
    at next (/home/lev/Projects/DerbyJS/derby-auth-master/node_modules/express/node_modules/connect/lib/proto.js:193:15)
    at Object.expressInit [as handle] (/home/lev/Projects/DerbyJS/derby-auth-master/node_modules/express/lib/middleware.js:30:5)
    at next (/home/lev/Projects/DerbyJS/derby-auth-master/node_modules/express/node_modules/connect/lib/proto.js:193:15)
    at Object.query [as handle] (/home/lev/Projects/DerbyJS/derby-auth-master/node_modules/express/node_modules/connect/lib/middleware/query.js:44:5)
    at next (/home/lev/Projects/DerbyJS/derby-auth-master/node_modules/express/node_modules/connect/lib/proto.js:193:15)
    at Function.app.handle (/home/lev/Projects/DerbyJS/derby-auth-master/node_modules/express/node_modules/connect/lib/proto.js:201:3)
    at Object.fn [as handle] (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/express/lib/application.js:118:11)
    at next (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/express/node_modules/connect/lib/proto.js:193:15)
    at Object.modelMiddleware [as handle] (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/racer/lib/session/session.Store.js:119:5)
    at next (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/express/node_modules/connect/lib/proto.js:193:15)
    at Object.session [as handle] (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/racer/node_modules/connect/lib/middleware/session.js:307:7)
    at next (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/express/node_modules/connect/lib/proto.js:193:15)
    at Object.cookieParser [as handle] (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/express/node_modules/connect/lib/middleware/cookieParser.js:60:5)
    at next (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/express/node_modules/connect/lib/proto.js:193:15)
    at Object.methodOverride [as handle] (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/express/node_modules/connect/lib/middleware/methodOverride.js:48:5)
    at next (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/express/node_modules/connect/lib/proto.js:193:15)
    at multipart (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/express/node_modules/connect/lib/middleware/multipart.js:90:37)
    at /home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/express/node_modules/connect/lib/middleware/bodyParser.js:57:9
    at urlencoded (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/express/node_modules/connect/lib/middleware/urlencoded.js:49:37)
    at /home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/express/node_modules/connect/lib/middleware/bodyParser.js:55:7
    at json (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/express/node_modules/connect/lib/middleware/json.js:51:37)
    at Object.bodyParser [as handle] (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/express/node_modules/connect/lib/middleware/bodyParser.js:53:5)
    at next (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/express/node_modules/connect/lib/proto.js:193:15)
    at Object.compress [as handle] (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/express/node_modules/connect/lib/middleware/compress.js:182:5)
    at next (/home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/express/node_modules/connect/lib/proto.js:193:15)
    at /home/lev/Projects/DerbyJS/derby-auth-master/example/node_modules/gzippo/lib/staticGzip.js:217:24
    at Object.oncomplete (fs.js:107:15)

Installation errors

if i run npm install in the exampels dir I get :

npm ERR! git clone git://github.com/twitter/bootstrap.git Cloning into bare repository '/Users/daslicht/.npm/_git-remotes/git-github-com-twitter-bootstrap-git-8e14791d'...
npm ERR! git clone git://github.com/twitter/bootstrap.git 
npm ERR! git clone git://github.com/twitter/bootstrap.git fatal: remote error: 
npm ERR! git clone git://github.com/twitter/bootstrap.git   Repository not found.
npm http GET https://registry.npmjs.org/stylus
npm http GET https://registry.npmjs.org/chokidar
npm http GET https://registry.npmjs.org/nib
unbuild [email protected]
npm ERR! Error: Command failed: fatal: remote error: 
npm ERR!   Repository not found.
npm ERR! 
npm ERR!     at ChildProcess.exithandler (child_process.js:637:15)
npm ERR!     at ChildProcess.EventEmitter.emit (events.js:98:17)
npm ERR!     at maybeClose (child_process.js:735:16)
npm ERR!     at Socket.<anonymous> (child_process.js:948:11)
npm ERR!     at Socket.EventEmitter.emit (events.js:95:17)
npm ERR!     at Pipe.close (net.js:466:12)
npm ERR! If you need help, you may report this log at:
npm ERR!     <http://github.com/isaacs/npm/issues>
npm ERR! or email it to:
npm ERR!     <[email protected]>

npm ERR! System Darwin 12.4.0
npm ERR! command "node" "/usr/local/bin/npm" "install"
npm ERR! cwd /Users/daslicht/derby/derby-auth/example
npm ERR! node -v v0.10.13
npm ERR! npm -v 1.3.2
npm ERR! code 128

JSLint proposed issues

Others JSLint proposed issues. Before going to the issues some thoughts:

• since there are lots of unused variables, my guess is that you put them in order to keep the number and the order of function parameters correct, and to keep the function arguments documented some how. Is it right?
• It seems that jslint warning may be silenced. I would eventually consider this option for the future. What do you think?
• I'm a newbie with javascript, and I'm approaching the language since less then a month. So, I hope that my hints mean something, but most importantly take them with a grain of salt... ;) :)
• index.js:
  • line 44: "res" unused
  • lline 112: "accessToken" and "accessToken" unused
  • line 137: "req" and "res" unused
  • line 173: "req" unused
  • line 202: "done" undeclared variable (missing "done" parameter in the post callback?)
  • line 217: "strategy" unused
  • line 225: "req" and "res" unused, but the whole function is unused as explained in the comment...
  • line 237: "req" unused
• lib/store.js:
  • line 3, 11, 19, 27, 43, 48, 53, 59: the warning is "use of 'this' in callback function". Does "this" refer to "store.query"? If so I would put it explicitly. What do you think?
  • line 5, 13, 21, 29: "methodArgs" unused

Regards,
Matteo

Configuring derby-auth 0.5

In the README file it says:
Make sure your express app is using sessions:
.use(store.sessionMiddleware ...

I think this doesn't work anymore in derby0.5, and instead we have:
.use(express.session ...

I did everything in the README file (I think...) but I get an error trying to use derby-auth:
Error: req.flash() requires sessions
at Error (:null:null)
at IncomingMessage._flash as flash
at Object.handle (node_modules/derby-auth/middleware.coffee:52:5, :54:39)
at next (node_modules/express/node_modules/connect/lib/proto.js:190:15)
at Object.handle (node_modules/derby-auth/node_modules/connect-flash/lib/flash.js:21:5)
at next (node_modules/express/node_modules/connect/lib/proto.js:190:15)
at Object.expressInit as handle
at next (node_modules/express/node_modules/connect/lib/proto.js:190:15)
at Object.query as handle
at next (node_modules/express/node_modules/connect/lib/proto.js:190:15)
at Function.app.handle (node_modules/express/node_modules/connect/lib/proto.js:198:3)
at Object.fn as handle
at next (node_modules/express/node_modules/connect/lib/proto.js:190:15)
at Object.modelMiddleware as handle
at next (node_modules/express/node_modules/connect/lib/proto.js:190:15)
at Object.middleware as handle
at next (node_modules/express/node_modules/connect/lib/proto.js:190:15)
at Object.scriptsMiddleware as handle
at next (node_modules/express/node_modules/connect/lib/proto.js:190:15)
at Object.compress as handle
at next (node_modules/express/node_modules/connect/lib/proto.js:190:15)
at Object.favicon as handle
at next (node_modules/express/node_modules/connect/lib/proto.js:190:15)
at Object.expressInit as handle
at next (node_modules/express/node_modules/connect/lib/proto.js:190:15)
at Object.query as handle
at next (node_modules/express/node_modules/connect/lib/proto.js:190:15)
at Function.app.handle (node_modules/express/node_modules/connect/lib/proto.js:198:3)
at Server.app (node_modules/express/node_modules/connect/lib/connect.js:65:37)
at Server.EventEmitter.emit (events.js:98:17)
at HTTPParser.parser.onIncoming (http.js:2045:12)
at HTTPParser.parserOnHeadersComplete as onHeadersComplete
at Socket.socket.ondata (http.js:1935:22)
at TCP.onread (net.js:524:27)

email confirmation for registration

TypeError: Cannot read property 'passport' of undefined

TypeError: Cannot read property 'passport' of undefined
    at Object.module.exports.passport.use.done.message [as handle] (/Users/cartercharbonneau/ddderby/node_modules/derby-auth/index.js:58:36)
    at next (/Users/cartercharbonneau/ddderby/node_modules/express/node_modules/connect/lib/proto.js:190:15)
    at Object.module.exports [as handle] (/Users/cartercharbonneau/ddderby/node_modules/derby-auth/node_modules/connect-flash/lib/flash.js:20:5)
    at next (/Users/cartercharbonneau/ddderby/node_modules/express/node_modules/connect/lib/proto.js:190:15)
    at Object.expressInit [as handle] (/Users/cartercharbonneau/ddderby/node_modules/express/lib/middleware.js:31:5)
    at next (/Users/cartercharbonneau/ddderby/node_modules/express/node_modules/connect/lib/proto.js:190:15)
    at Object.query [as handle] (/Users/cartercharbonneau/ddderby/node_modules/express/node_modules/connect/lib/middleware/query.js:44:5)
    at next (/Users/cartercharbonneau/ddderby/node_modules/express/node_modules/connect/lib/proto.js:190:15)
    at Function.app.handle (/Users/cartercharbonneau/ddderby/node_modules/express/node_modules/connect/lib/proto.js:198:3)
    at Object.app.use.fn [as handle] (/Users/cartercharbonneau/ddderby/node_modules/express/lib/application.js:117:11)

Add "Reset Password"

Due to derby-ui-boot not functioning derby-auth example does not work

Recently Derby UI Boot stopped working.

Update: issue was due to order of variables being changed?

memory leak / performance issue

see HabitRPG/habitica#11, there's something going awry in derby-auth that causes habitrpg to crash due to maxing memory (only when logged in)

Error when reconnect example to server/

1. Run example
2. turn off server
3. wait appearing of "reconect" link
4. Turn on server

And got in console error every 5-6 seconds, application can`t reconnect.

if not authorized we got:

Error parsing forward channel Error: If you have fetch middleware you need to also make bulk fetch middleware
    at Error (<anonymous>)
    at UserAgent.bulkFetch (/home/srv/startup/node_modules/derby/node_modules/racer/node_modules/share/lib/server/useragent.js:149:11)
    at Session.bulkSubscribe (/home/srv/startup/node_modules/derby/node_modules/racer/node_modules/share/lib/server/session.js:228:9)
    at Session._handleMessage (/home/srv/startup/node_modules/derby/node_modules/racer/node_modules/share/lib/server/session.js:550:12)
    at Session.pump (/home/srv/startup/node_modules/derby/node_modules/racer/node_modules/share/lib/server/session.js:324:10)
    at Duplex.<anonymous> (/home/srv/startup/node_modules/derby/node_modules/racer/node_modules/share/lib/server/session.js:335:15)
    at Duplex.g (events.js:175:14)
    at Duplex.EventEmitter.emit (events.js:92:17)
    at emitReadable_ (_stream_readable.js:408:10)
    at emitReadable (_stream_readable.js:404:5)
    at readableAddChunk (_stream_readable.js:165:9)
    at Duplex.Readable.push (_stream_readable.js:127:10)
    at onMessage (/home/srv/startup/node_modules/racer-browserchannel/lib/server.js:64:12)
    at EventEmitter.emit (events.js:117:20)
    at /home/srv/startup/node_modules/racer-browserchannel/node_modules/browserchannel/dist/server.js:405:30
    at null._mapBuffer (/home/srv/startup/node_modules/racer-browserchannel/node_modules/browserchannel/dist/server.js:191:9)
    at /home/srv/startup/node_modules/racer-browserchannel/node_modules/browserchannel/dist/server.js:390:17
    at null._ridBuffer (/home/srv/startup/node_modules/racer-browserchannel/node_modules/browserchannel/dist/server.js:191:9)
    at BrowserChannelSession._receivedData (/home/srv/startup/node_modules/racer-browserchannel/node_modules/browserchannel/dist/server.js:376:15)
    at processData (/home/srv/startup/node_modules/racer-browserchannel/node_modules/browserchannel/dist/server.js:646:21)
    at Object.middleware [as handle] (/home/srv/startup/node_modules/racer-browserchannel/node_modules/browserchannel/dist/server.js:668:18)
    at next (/home/srv/startup/node_modules/express/node_modules/connect/lib/proto.js:190:15)
    at Object.methodOverride [as handle] (/home/srv/startup/node_modules/express/node_modules/connect/lib/middleware/methodOverride.js:37:5)
    at next (/home/srv/startup/node_modules/express/node_modules/connect/lib/proto.js:190:15)
    at multipart (/home/srv/startup/node_modules/express/node_modules/connect/lib/middleware/multipart.js:60:27)
    at /home/srv/startup/node_modules/express/node_modules/connect/lib/middleware/bodyParser.js:57:9
    at IncomingMessage.<anonymous> (/home/srv/startup/node_modules/express/node_modules/connect/lib/middleware/urlencoded.js:70:11)
    at IncomingMessage.EventEmitter.emit (events.js:92:17)
    at _stream_readable.js:920:16
    at process._tickCallback (node.js:415:13)

and if authorized

Error parsing forward channel TypeError: Object #<Object> has no method '_setSubscribed'
    at cancel (/home/srv/startup/node_modules/derby/node_modules/racer/node_modules/share/lib/server/session.js:218:14)
    at /home/srv/startup/node_modules/derby/node_modules/racer/node_modules/share/lib/server/session.js:248:9
    at UserAgent.bulkSubscribe (/home/srv/startup/node_modules/derby/node_modules/racer/node_modules/share/lib/server/useragent.js:234:12)
    at /home/srv/startup/node_modules/derby/node_modules/racer/node_modules/share/lib/server/session.js:246:11
    at UserAgent.bulkFetch (/home/srv/startup/node_modules/derby/node_modules/racer/node_modules/share/lib/server/useragent.js:134:48)
    at Session.bulkSubscribe (/home/srv/startup/node_modules/derby/node_modules/racer/node_modules/share/lib/server/session.js:228:9)
    at Session._handleMessage (/home/srv/startup/node_modules/derby/node_modules/racer/node_modules/share/lib/server/session.js:550:12)
    at Session.pump (/home/srv/startup/node_modules/derby/node_modules/racer/node_modules/share/lib/server/session.js:324:10)
    at Duplex.<anonymous> (/home/srv/startup/node_modules/derby/node_modules/racer/node_modules/share/lib/server/session.js:335:15)
    at Duplex.g (events.js:175:14)
    at Duplex.EventEmitter.emit (events.js:92:17)
    at emitReadable_ (_stream_readable.js:408:10)
    at emitReadable (_stream_readable.js:404:5)
    at readableAddChunk (_stream_readable.js:165:9)
    at Duplex.Readable.push (_stream_readable.js:127:10)
    at onMessage (/home/srv/startup/node_modules/racer-browserchannel/lib/server.js:64:12)
    at EventEmitter.emit (events.js:117:20)
    at /home/srv/startup/node_modules/racer-browserchannel/node_modules/browserchannel/dist/server.js:405:30
    at null._mapBuffer (/home/srv/startup/node_modules/racer-browserchannel/node_modules/browserchannel/dist/server.js:191:9)
    at /home/srv/startup/node_modules/racer-browserchannel/node_modules/browserchannel/dist/server.js:390:17
    at null._ridBuffer (/home/srv/startup/node_modules/racer-browserchannel/node_modules/browserchannel/dist/server.js:191:9)
    at BrowserChannelSession._receivedData (/home/srv/startup/node_modules/racer-browserchannel/node_modules/browserchannel/dist/server.js:376:15)
    at processData (/home/srv/startup/node_modules/racer-browserchannel/node_modules/browserchannel/dist/server.js:646:21)
    at Object.middleware [as handle] (/home/srv/startup/node_modules/racer-browserchannel/node_modules/browserchannel/dist/server.js:668:18)
    at next (/home/srv/startup/node_modules/express/node_modules/connect/lib/proto.js:190:15)
    at Object.methodOverride [as handle] (/home/srv/startup/node_modules/express/node_modules/connect/lib/middleware/methodOverride.js:37:5)
    at next (/home/srv/startup/node_modules/express/node_modules/connect/lib/proto.js:190:15)
    at multipart (/home/srv/startup/node_modules/express/node_modules/connect/lib/middleware/multipart.js:60:27)
    at /home/srv/startup/node_modules/express/node_modules/connect/lib/middleware/bodyParser.js:57:9
    at IncomingMessage.<anonymous> (/home/srv/startup/node_modules/express/node_modules/connect/lib/middleware/urlencoded.js:70:11)
    at IncomingMessage.EventEmitter.emit (events.js:92:17)
    at _stream_readable.js:920:16
    at process._tickCallback (node.js:415:13)

Cannot set property 'readPath' of undefined

I tried to use debry-auth with my project. I created blank derby project, followed instructions and resulted into:

/node_modules/derby-auth/store.js:126
    store.accessControl.readPath = true;
                                 ^
TypeError: Cannot set property 'readPath' of undefined
    at module.exports (/node_modules/derby-auth/store.js:126:34)
    at Object.module.exports.store (/node_modules/derby-auth/index.js:11:5)
    at Object.<anonymous> (/lib/server/index.js:43:6)
    at Module._compile (module.js:456:26)
    at Object.Module._extensions..js (module.js:474:10)
    at Module.load (module.js:356:32)
    at Function.Module._load (module.js:312:12)
    at Module.require (module.js:364:17)
    at require (module.js:380:17)
    at createServer (/node_modules/derby/lib/derby.server.js:34:46)

crypto-browserify to SHA crypt pass in browser, don't send to server in clear

I'm not sure that this is strictly necessary, since we're encrypting / storing with SHA & salt on server - and protecting clear text sends with SSL. Opening topic here in case people have something to say.

See conversation here, and crypto-browserify

Unable to find validation.js

It was working for a while but all of suddenly it throws and error in the browser saying it can't find validation.js. Not sure what changed. I'll do some more debugging but if someone else has seen this before that would help me a bit.

case insensitive username

many people are logging in with improper case, evidently it's actually standard to not check uname case sensitivity.

Problem with mongo and derby auth

Hi when I run your app on Windows 8 I get this output

https://gist.github.com/4501506

the app will run but I cannot click on Register or Forgot password, they lead nowhere..

mongodb is running on 28017 as normal I have checked this..

Do you know what is causing this?

Remove "Staging" user, require registration

Currently derby-auth creates all new visitors as a "staging" user, initialized with _session.userId and a document in the database. This is pretty cool, and lets users play with derby apps before committing to registration.

However, over time this fills up the database. For Habit, we have a preen cron script which wipes unregistered staging users older than a few days. But even at that we have about 200k unreg'd users at any given time. Additionally, a DDOS attack would flood the database substantially. The best method would be that the staging user doesn't persist any data to the database, but that would be pretty difficult to implement. So the solution for now is we're gonna have to remove the "staging" user paradigm.

Limit login to one session per user only

It'd be nice to have an option that limit a user to have one session only, e.g. logouts all other same user's sessions and keep only the newest logged in one. This is good for game apps.

New maintainers

There is а new derby 0.6/passportjs register/login project with projections so on - https://github.com/vmakhaev/derby-login

It's derby-auth successor.

Please, place the information in your readme-file.

Missclick ...

Examples not working

https://gist.github.com/daslicht/b6c2daeeea1e6495044b is an error from attempting to use the example that comes with derby-auth.

I'm not the one trying the package. He was on IRC trying to get help.

derby daslicht

model.fetch 'users' -- security?

I'm seeing that I can do model.fetch 'users' or model.subscribe 'users' and get every user, on the client side.

I have a feeling this might be a security issue? The readPathAccess is checking against users.* and it's letting this through?

Email login

a lot of people are attempting with their email addresses and thinking they lost their accounts. Allow email login, in addition to usernmae

404 on npm install

After trying to reinstall, I got a 404 here. I did do npm cache clean:

npm http GET https://registry.npmjs.org/derby-auth
npm http 304 https://registry.npmjs.org/derby-auth
npm http GET https://registry.npmjs.org/derby-auth/-/derby-auth-0.0.21.tgz
npm http 404 https://registry.npmjs.org/derby-auth/-/derby-auth-0.0.21.tgz
npm ERR! fetch failed https://registry.npmjs.org/derby-auth/-/derby-auth-0.0.21.tgz
npm ERR! Error: 404 Not Found
npm ERR!     at null.<anonymous> (/usr/local/lib/node_modules/npm/lib/utils/fetch.js:47:16)
npm ERR!     at EventEmitter.emit (events.js:126:20)
npm ERR!     at WriteStream.flush (fs.js:1517:12)
npm ERR!     at fs.close (/usr/local/lib/node_modules/npm/node_modules/graceful-fs/graceful-fs.js:90:5)
npm ERR!     at Object.oncomplete (fs.js:297:15)
npm ERR! If you need help, you may report this log at:
npm ERR!     <http://github.com/isaacs/npm/issues>
npm ERR! or email it to:
npm ERR!     <[email protected]>

The referenced page states: {"error":"not_found","reason":"Document is missing attachment"}