node.js - 仅在 NodeJS 和 ExpressJS 中满足条件后才更新密码

Question

我正在尝试创建一个组件，在其中向用户请求当前密码和两个需要匹配才能更改密码的 iinput。

到目前为止，我创建的路线如下:

// @route       POST api/profiles/edit-password
// @description Update user password
// @access      Private
// @task        ALMOST DONE - NEEDS TO AVOID PASSWORD UPDATING IF NULL
router.post(
  '/edit-password',
  [
    auth,
    [
      check('old_password', 'Old Password is required')
        .not()
        .isEmpty(),
      check('old_password', 'Old Password does not match')
        .exists(),
      check('password', 'New Password is required')
        .not()
        .isEmpty(),
      check('new_password', 'Confirm Password is required')
        .not()
        .isEmpty()
    ]
  ],
  async (req, res) => {
    const errors = validationResult(req);
    // Check for errors
    if (!errors.isEmpty()) {
      return res.status(400).json({ errors: errors.array() });
    }

    // Destructure
    const {
      old_password,
      password,
      new_password,
    } = req.body;

    // Build profile object
    const profileFields = {};
    profileFields.user = req.user.id;
    if (password === new_password) {
      // Encrypt Password
      passwordEncrypt = password;
      const salt = await bcrypt.genSalt(10);
      profileFields.password = await bcrypt.hash(passwordEncrypt, salt);
    }

    try {

      let formOldPassword = old_password; // req.body.old_password can be used as well.
      let loggedPassword = await User.findById(req.user.id).select('password');

      // Old password input with password stored in DB
      const isMatch = await bcrypt.compare(formOldPassword, loggedPassword);

      console.log(isMatch ? 'yes' : 'no');

      // In case old password input does not match with password stored in DB, prevent from updating password
      if (!isMatch) {
        return res
          .status(400)
          .json({ errors: [{ msg: 'Invalid credentials' }] });
      }

      let profile = await User.findByIdAndUpdate(req.user.id, profileFields, { new: true });

      return res.json(profile);


    } catch (err) {
      console.error(err.message);
      res.status(500).send('Server error');
    }
  }
);

我从功能组件中的表单传递三个输入，这些输入是:

• 旧密码
• 密码
• 新密码

之后，我构建一个空对象，用于更新与用户请求相对应的所述值。之后，我提出一个条件，如果 new_password 和 recognize_password 都匹配，则应该使用哈希对密码进行加密(这是我假设导致错误的地方；我可能是错的):

if (password === new_password) {
      // Encrypt Password
      passwordEncrypt = password;
      const salt = await bcrypt.genSalt(10);
      profileFields.password = await bcrypt.hash(passwordEncrypt, salt);
    }

然后，我调用数据库来获取与登录用户相对应的密码，并将其存储的密码与从表单提交的数据进行比较:

let formOldPassword = old_password; // req.body.old_password can be used as well.
let loggedPassword = await User.findById(req.user.id).select('password');

// Old password input with password stored in DB
const isMatch = await bcrypt.compare(formOldPassword, loggedPassword);

现在两个输入必须匹配，但如果不匹配，则返回 400 http 错误。如果到目前为止一切都成功，请更新登录的用户数据。

// In case old password input does not match with password stored in DB, prevent from updating password
if (!isMatch) {
  return res
    .status(400)
    .json({ errors: [{ msg: 'Invalid credentials' }] });
}

let profile = await User.findByIdAndUpdate(req.user.id, profileFields, { new: true });

return res.json(profile);

我在控制台中得到的意外(错误)输出是这样的:

Illegal arguments: string, object

知道如何解决这个问题吗？

Answer 1

您正在将字符串新密码与对象(而不是字符串)进行比较。尝试下面并打印旧密码

   try {
            const userObj = await User.findById(req.user.id);
            const oldPassword = userObj.password;
             console.log("OLD password" + password);
            //Then do your comparision logic
        } catch (err) {
            console.log('error occured' +err);   
        }