added solution by Demtar23 · Pull Request #274 · mate-academy/node_auth-app

Demtar23 · 2026-04-30T13:17:23Z

No description provided.

mateacademy-ai-mentor

Review Summary

Your implementation covers most core authentication functionality, but there are critical issues that need to be addressed. First, the auth routes (registration, activation, login, password reset) lack middleware to restrict access based on authentication status - these endpoints should only be accessible to non-authenticated users per checklist items #2, #5, #9, and #15, and logout should only be for authenticated users per #13. Currently these routes are accessible to everyone. Second, the password validation only checks minimum length (6 characters) without informing users about actual password rules as required by checklist item #3. Additionally, there's a typo on line ~47 in profile.controller.js where 'Password is incorect' should be 'Password is incorrect'. The API also returns tokens after activation and login but doesn't provide redirect URLs for the frontend as specified in checklist items #7 and #11. Please add the appropriate middleware to enforce authentication-based access control on auth routes, enhance password validation messaging, fix the typo, and consider including redirect URLs in API responses.

✨ Please rate this review in the Platform's notification center¹. I will be grateful for your feedback! ✨

Important

Fix the issues, commit the changes, and then re-request my review using the Re-request review button² in the Reviewers tab.

Tip

If you have any comments about this review, please leave a message in the Add a comment section below and mention me with the @mateacademy-ai-mentor tag³.
I will read your message during my next review of your pull request. Please do not reply directly to my comments, as that feature is not supported yet.

Caution

Do not close the pull request until the review is complete. Closing it early can lead to unexpected behavior and disrupt the review process.

mateacademy-ai-mentor · 2026-04-30T13:20:04Z

+export function createServer() {
+  const app = express();


Registration endpoint lacks middleware to ensure it's only accessible to non-authenticated users (checklist item #2). Consider adding a middleware that blocks authenticated users from accessing registration.

mateacademy-ai-mentor · 2026-04-30T13:20:04Z

+
+  app.use(


Password validation only checks for minimum length (6 characters), but the description mentions 'rules for a password' (checklist item #3). Consider adding more validation rules (uppercase, numbers, special characters) and informing users about them.

mateacademy-ai-mentor · 2026-04-30T13:20:04Z

+    });
+  }
+
+  const isOldPasswordValid = await bcrypt.compare(oldPassword, user.password);
+
+  if (!isOldPasswordValid) {
+    return res.status(401).json({
+      errors: { oldPassword: 'Current password is incorrect' },
+      message: 'Validation error',
+    });
+  }
+
+  const hasNewPasswordError = userService.validatePassword(newPassword);
+
+  if (hasNewPasswordError) {
+    return res.status(400).json({
+      errors: { newPassword: hasNewPasswordError },


The activate function returns authentication tokens after activation instead of redirecting to Profile as required by checklist item #7. Consider either returning a redirect URL for the frontend or redirecting directly from the backend.

mateacademy-ai-mentor · 2026-04-30T13:20:04Z

+
+  await mailer.sendChangeEmailNotification(oldEmail, newEmail);
+
+  res.json({
+    message: 'Email changed. Please confirm your new email address',
+  });
+};
+
+export const profileController = {
+  getProfile,
+  updateName,


The logout function only sends 204 status without redirecting to the login page as required by checklist item #14.

mateacademy-ai-mentor · 2026-04-30T13:20:04Z

+  const { id } = req.user;
+
+  const user = await usersRepository.getById(id);
+
+  if (!user) {
+    return res.status(404).json({
+      message: 'User not found',
+    });
+  }
+
+  res.json({ user: userService.normalize(user) });
+};
+
+const updateName = async (req, res) => {
+  const { name } = req.body;
+  const { id } = req.user;
+
+  if (!name) {
+    return res.status(400).json({
+      errors: { name: 'Name is required' },
+      message: 'Validation error',
+    });
+  }
+
+  const hasNameError = userService.validateName(name);
+
+  if (hasNameError) {
+    return res.status(400).json({
+      errors: { name: hasNameError },
+      message: 'Validation error',
+    });
+  }
+
+  const user = await usersRepository.getById(id);
+
+  if (!user) {
+    return res.status(404).json({
+      message: 'User not found',
+    });
+  }
+


The registration endpoint (and other auth endpoints like activate, login, requestPasswordReset) should have middleware to block already-authenticated users, as specified in checklist items #2, #5, #9, and #15. Currently only the profile router has auth middleware protection.

mateacademy-ai-mentor · 2026-04-30T13:20:04Z

+import { catchError } from '../utils/catchError.js';
+import { profileController } from '../controllers/profile.controller.js';
+
+export const profileRouter = Router();


Registration endpoint is missing middleware to restrict access to non-authenticated users only (checklist item #2). Consider adding a middleware that blocks authenticated users from registering.

mateacademy-ai-mentor · 2026-04-30T13:20:04Z

+profileRouter.use(authMiddleware);
+
+profileRouter.get('/', catchError(profileController.getProfile));
+profileRouter.patch('/name', catchError(profileController.updateName));


Activation endpoint is missing middleware to restrict access to non-authenticated users (checklist item #5).

mateacademy-ai-mentor · 2026-04-30T13:20:04Z

+profileRouter.get('/', catchError(profileController.getProfile));
+profileRouter.patch('/name', catchError(profileController.updateName));
+profileRouter.patch('/password', catchError(profileController.updatePassword));
+profileRouter.patch('/email', catchError(profileController.updateEmail));


Login endpoint is missing middleware to restrict access to non-authenticated users (checklist item #9).

mateacademy-ai-mentor · 2026-04-30T13:20:04Z

+function normalize({ id, email, name }) {
+  return { id, email, name };
+}
+
+function validateEmail(email) {
+  const emailPattern = /^[\w.+-]+@([\w-]+\.){1,3}[\w-]{2,}$/;
+
+  if (!email) {
+    return 'Email is required';
+  }
+
+  if (!emailPattern.test(email)) {
+    return 'Email is not valid';
+  }
+
+  return null;
+}
+
+function validatePassword(password) {
+  if (!password) {
+    return 'Password is required';
+  }
+
+  if (password.length < 6) {
+    return 'At least 6 characters';
+  }


Auth routes (registration, activation, login, logout, password reset) are missing middleware to restrict access based on authentication status. According to checklist items #2, #5, #9, #13, and #15, registration/activation/login/password reset should be for non-authenticated users only, while logout should be for authenticated users. Consider adding middleware to check authentication status for these routes.

mateacademy-ai-mentor · 2026-04-30T13:20:04Z

+
+function validatePassword(password) {
+  if (!password) {
+    return 'Password is required';
+  }
+
+  if (password.length < 6) {
+    return 'At least 6 characters';
+  }
+
+  return null;


The password validation only checks minimum length (6 characters). The task mentions 'rules for a password' (checklist item #3). Consider adding more comprehensive validation (uppercase, numbers, special characters) and returning all errors at once instead of just the first one found.

mateacademy-ai-mentor

Review Summary

This implementation requires changes due to two critical blockers. First, the /logout route in auth.router.js (line 21) lacks authMiddleware, which violates checklist item #13 requiring logout to be accessible only to authenticated users. Second, the typo 'Password is incorect' on line 135 of profile.controller.js was flagged in a previous review but remains unfixed - it should read 'Password is incorrect'. Additionally, there's a minor grammar issue in the password validation message on line 38 of user.service.js where 'must be contain' should be 'must contain'. These issues directly impact requirement compliance and code quality standards.

✨ Please rate this review in the Platform's notification center¹. I will be grateful for your feedback! ✨

Important

Fix the issues, commit the changes, and then re-request my review using the Re-request review button² in the Reviewers tab.

Tip

If you have any comments about this review, please leave a message in the Add a comment section below and mention me with the @mateacademy-ai-mentor tag³.
I will read your message during my next review of your pull request. Please do not reply directly to my comments, as that feature is not supported yet.

Caution

Do not close the pull request until the review is complete. Closing it early can lead to unexpected behavior and disrupt the review process.

mateacademy-ai-mentor · 2026-05-01T06:37:42Z

+
+  await mailer.sendActivationLink(newEmail, activationToken);
+
+  await mailer.sendChangeEmailNotification(oldEmail, newEmail);


The /logout route lacks authentication middleware. According to the requirements, logout should only be accessible to authenticated users. Add authMiddleware to protect this route.

mateacademy-ai-mentor · 2026-05-01T06:37:42Z

+    res.clearCookie('refreshToken');
+
+    res.status(401).json({
+      message: 'Invalid token',


This typo was flagged in the previous review and remains unfixed. Change 'Password is incorect' to 'Password is incorrect'.

mateacademy-ai-mentor · 2026-05-01T06:37:42Z

+
+const activate = async (req, res) => {
+  const { email, token } = req.params;
+


The logout route lacks authentication middleware. Per requirements, logout should only be accessible to authenticated users. Consider adding authMiddleware to this route.

mateacademy-ai-mentor · 2026-05-01T06:37:42Z

+  const hashedPassword = await bcrypt.hash(password, 10);
+  const user = await usersRepository.create({
+    name,
+    email,


Minor grammar issue in error message: 'Password must be contain' should be 'Password must contain' (remove 'be').

mateacademy-ai-mentor · 2026-05-01T06:37:42Z

+);
+
+authRouter.post('/login', guestMiddleware, catchError(authController.login));
+authRouter.get('/refresh', catchError(authController.refresh));


The /logout route lacks authentication middleware. Per requirements, logout should only be accessible to authenticated users. Add authMiddleware from '../middlewares/auth.middleware.js' to this route to enforce this restriction.

mateacademy-ai-mentor · 2026-05-01T06:37:42Z

+    email: {
+      type: DataTypes.STRING,
+      allowNull: false,
+      unique: true,


The /logout route should be restricted to authenticated users only (per requirements: 'Logout (only authenticated)'). Add authMiddleware to this route.

mateacademy-ai-mentor · 2026-05-01T06:37:42Z

+    <a href="${link}">${link}</a>
+  `;
+
+  return send(email, 'Password reset', html);


Minor grammar issue: 'Password must be contain' should be 'Password must contain' (remove 'be')

mateacademy-ai-mentor · 2026-05-01T06:37:42Z

+    errors.push('Password must contain letters');
+  }
+
+  if (errors.length > 0) {


Minor grammar issue: 'Password must be contain' should be 'Password must contain' (remove 'be').

mateacademy-ai-mentor

Review Summary

I am approving this solution as an educational override to help you continue learning. Good progress: the previous HIGH severity issue (missing authMiddleware on /logout) has been fixed. However, there are two issues to address:

Fix the typo: In src/controllers/profile.controller.js line 135, change 'Password is incorect' to 'Password is incorrect' — this was flagged in the previous review and still needs correction.
ESLint configuration: The project uses ES modules ("type": "module" in package.json), but .eslintrc.js uses CommonJS syntax (module.exports). Rename .eslintrc.js to .eslintrc.cjs so Node.js treats it as CommonJS, resolving the linting error.
Optional improvement: The activation route in auth.router.js lacks guestMiddleware — while not critical, adding it would restrict the route to non-authenticated users only, matching the pattern used for login/registration routes.

Keep up the good work on the functional implementation!

✨ Please rate this review in the Platform's notification center¹. I will be grateful for your feedback! ✨

Important

Fix the issues, commit the changes, and then re-request my review using the Re-request review button² in the Reviewers tab.

Tip

If you have any comments about this review, please leave a message in the Add a comment section below and mention me with the @mateacademy-ai-mentor tag³.
I will read your message during my next review of your pull request. Please do not reply directly to my comments, as that feature is not supported yet.

Caution

Do not close the pull request until the review is complete. Closing it early can lead to unexpected behavior and disrupt the review process.

mateacademy-ai-mentor · 2026-05-01T06:49:53Z

+    res.clearCookie('refreshToken');
+
+    res.status(401).json({
+      message: 'Invalid token',


Typo: 'incorect' should be 'incorrect'

mateacademy-ai-mentor · 2026-05-01T06:49:53Z

+  const app = express();
+
+  app.use(express.json());
+


The activation route lacks guestMiddleware. Per task requirements, this route should only be accessible to non-authenticated users (like login/registration routes on lines 14 and 16 which have this middleware).

mateacademy-ai-mentor · 2026-05-01T06:49:53Z

+  const isPasswordValid = await bcrypt.compare(password, user.password);
+
+  if (!isPasswordValid) {
+    return res.status(401).json({


Typo: 'incorect' should be 'incorrect'

alexander-ignatow

LGTM

added solution

03e2038

mateacademy-ai-mentor suggested changes Apr 30, 2026

View reviewed changes

added changes from comments

095ed8d

Demtar23 requested a review from mateacademy-ai-mentor May 1, 2026 06:34

mateacademy-ai-mentor suggested changes May 1, 2026

View reviewed changes

added final changes from comments

c70cbc0

Demtar23 requested a review from mateacademy-ai-mentor May 1, 2026 06:46

mateacademy-ai-mentor suggested changes May 1, 2026

View reviewed changes

added final changes from comments

f1e96f7

Demtar23 requested a review from mateacademy-ai-mentor May 1, 2026 06:52

added changes

c5579ee

alexander-ignatow approved these changes May 5, 2026

View reviewed changes


		await mailer.sendActivationLink(newEmail, activationToken);

		await mailer.sendChangeEmailNotification(oldEmail, newEmail);


		const activate = async (req, res) => {
		const { email, token } = req.params;

Conversation

Demtar23 commented Apr 30, 2026

Uh oh!

mateacademy-ai-mentor left a comment

Choose a reason for hiding this comment

Review Summary

Footnotes

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mateacademy-ai-mentor left a comment

Choose a reason for hiding this comment

Review Summary

Footnotes

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mateacademy-ai-mentor left a comment

Choose a reason for hiding this comment

Review Summary

Footnotes

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

alexander-ignatow left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants