From 9cae851e3a43108ad2de744578217155fd69b8fe Mon Sep 17 00:00:00 2001
From: Dan Head <me@danielhead.com>
Date: Mon, 13 Feb 2017 20:43:54 +0000
Subject: [PATCH] Ensure bouncer intercepts '/:code' requests

---
 src/server.js | 43 ++++++++++++++++++++++++++-----------------
 1 file changed, 26 insertions(+), 17 deletions(-)

diff --git a/src/server.js b/src/server.js
index a9a2937..609cc08 100644
--- a/src/server.js
+++ b/src/server.js
@@ -94,24 +94,33 @@ app.use('/graphql', expressGraphQL(req => ({
 //
 // Register RSVP routes
 // -----------------------------------------------------------------------------
-//
+// TODO: This could do with cleaning up, to prevent duplicate bouncer tests and Person queries
 
-app.get('/:code', (req, res, next) => {
-  if (req.params.code.length !== 4) {
-    // Not a password
-    next();
-  } else {
-    Person.findAll({ where: { password: req.params.code } })
-      .then(data => {
-        if (data.length > 0) {
-          res.redirect(`/rsvp/${req.params.code}`);
-        } else {
-          next();
-        }
-      }).catch((err) => {
-        Rollbar.handleError(err);
-        next(err);
-      });
+app.get('/:code', bouncer.block, (req, res, next) => {
+  try {
+    // Hijack router to test if url is a RSVP code
+    if (req.params.code.length === 4) {
+      // Possibly a password
+      Person.findAll({ where: { password: req.params.code } })
+        .then(data => {
+          if (data.length > 0) {
+            // It is a password
+            bouncer.reset(req);
+            res.redirect(`/rsvp/${req.params.code}`);
+          } else {
+            next();
+          }
+        }).catch((err) => {
+          Rollbar.handleError(err);
+          next(err);
+        });
+    } else {
+      bouncer.reset(req);
+      next();
+    }
+  } catch (err) {
+    Rollbar.handleError(err);
+    next(err);
   }
 });