setPassword on query middleware (findOneAndUpdate)

[linusbrolin]

Passport-local-mongoose currently only seems to support generating hashed password in document middleware, not in query middleware.
This means that saving documents through findOneAndUpdate, findByIdAndUpdate, etc, will not work if a password is part of that update.

I made an ugly workaround for this to work, but ideally this is something that should be handled by passport-local-mongoose.

Below is my ugly workaround to cover all ways of saving a document:

// document middleware code
// more information: http://mongoosejs.com/docs/middleware.html

UserSchema.pre('save', function(next: Function) {
  var user: User = this;
  user.updatedAt = new Date();

  // only hash the password if it has been modified (or is new)
  if (!user.isModified('password') || !user.password || user.password.length === 0) {
      return next();
  }

  user.setPassword(user.password, function(err: any, usr: User) {
    return next();
  });
});


// query middleware code
// more information: http://mongoosejs.com/docs/middleware.html

function updatePassword(query: any, cb: (err: any, res: any) => void): void {
  let u: User = new UserModel();

  // borrow the password hashing function from passport-local-mongoose
  u.setPassword(query.getUpdate().password, function(err: any, usr: User) {
    if (err) {
      return cb(err, null);
    }

    // we need to delete the clear-text password from the query in order to replace it with our hashed one
    delete query._update.password;

    // update the query with our newly generated hashed password and salt
    query.update({}, {
      $set: {
        password: usr.password,
        salt: usr.salt,
        updatedAt: new Date()
      }
    });

    return cb(null, query);
  });
}

UserSchema.pre('update', function(next: Function) {
  if (this._update.password) {
    updatePassword(this, function(err: any, res: any) {
      return next();
    });
  }
  else {
    // if the password is null then we need to delete it because null is a valid value and it will overwrite whatever is in the database
    delete this._update.password;
    this.update({}, { $set: { updatedAt: new Date() } });
    return next();
  }
});

UserSchema.pre('findOneAndUpdate', function(next: Function) {
  if (this._update.password) {
    updatePassword(this, function(err: any, res: any) {
      return next();
    });
  }
  else {
    // if the password is null then we need to delete it because null is a valid value and it will overwrite whatever is in the database
    delete this._update.password;
    this.update({}, { $set: { updatedAt: new Date() } });
    return next();
  }
});

[TimUnderhay]

I agree that this is a considerable issue. It would be lovely to get acknowledgement of it from the developers.