:memo: Made notes on needed security fix and ux edge case

backend/lib/services/user.js

@@ -325,6 +325,9 @@ module.exports = class UserService extends Schmervice.Service {
         const duration = 1000 * 60 * 10
 
         this.hashedEmails[hashedEmail] = Date.now() + duration
+        // TODO: See FrontEnd in Auth.vue and VerifyView.vue notes:
+        // if user closes browser, they'll need to be issued first session token based off of this:
+        // this.hashedEmails[hashedEmail][email] = userEmail
         const sendSmtpEmail = {
             to: [
                 {

frontend/src/components/onboarding/Auth.vue

@@ -51,6 +51,7 @@ export default {
             const sessionToken = await this.getSessionToken({
                 ...this.answered,
             })
+            // TODO: Flawed thinking, what if user closes browser and answers email later??
             document.cookie = `siimee_session=${sessionToken}; max-age=600; path=/; secure`
             await this.authenticator.sendAuthEmail(this.answered)
         } catch (err) {

frontend/src/services/auth.service.js

@@ -21,6 +21,7 @@ class Authenticator {
     async getAccessToken(req) {
         return await db.post('/user/getaccess', req, true)
     }
+    // TODO: Possible Security issue, returned .payload has user email in plain text...
     async validateSession(token) {
         return await db.get('/user/validatesession', token)
     }

frontend/src/views/OnboardingView.vue

@@ -107,6 +107,7 @@ export default {
                 cookieKey in cookies ? cookies[`${cookieKey}`] : undefined
             return cookieVal
         },
+        // TODO: Possible Security issue, returned .payload has user email in plain text...
         async verifyBothTokens() {
             const sessionTokenIsValid = await this.verifySessionToken(
                 sessionToken,
@@ -235,6 +236,8 @@ export default {
                 this.responses.push(response)
                 if (k === 'aspects') return
             }
+            // if user as finished minimum profile creation,
+            // Adds survey answers to responses table and verifies tokens on each step
             if (currentProfileId) {
                 // TODO: Still have to authenticate this route
                 await surveyFactory.addNewSurveyAnswer(

frontend/src/views/VerifyView.vue

@@ -56,6 +56,9 @@ export default {
             )
             if (!hashesMatch) throw new Error('Hash is not in registry!')
         },
+        // TODO: Flawed thinking, what if user closed browser and then answered email?
+        // session token won't exist, it will need to be generated here using the hashEmail, problem is:
+        // hashEmail cannot access
         async doesSessionTokenExist(sessionToken) {
             if (!sessionToken)
                 throw new Error('sessionToken not in cookie store!')