email validation using express passport and sequelize - node.js

Question

I need a basic email verification after a user signs up.
my pseudo code for this is something like
1.user signs up
2.his data is stored in database.
3.a token is generated using crypto.
4.token is then send to email id provided.
5.user clicks the link a account is verified.
meanwhile a separate sequelize schema is created that stores the email id and the token.
now my problem is how to implement this in my project
passport.use('local-signup', new LocalStrategy(
{
usernameField: 'email',
passwordField: 'password',
passReqToCallback: true // allows us to pass back the entire request to the callback
},
function (req, email, password, done) {
var generateHash = function (password) {
return bCrypt.hashSync(password, bCrypt.genSaltSync(8), null);
};
User.findOne({
where: {
email: email.toLowerCase()
}
}).then(function (user) {
if (user) {
return done(null, false, {
message: 'That email is already taken'
});
}
else {
var userPassword = generateHash(password);
var data =
{
email: email.toLowerCase(),
password: userPassword,
firstname: req.body.firstname,
lastname: req.body.lastname,
mobileno: req.body.mobileno,
//verified_email: false,
//verified_mob: false
};
User.create(data).then(function (newUser, created) {
if (!newUser) {
return done(null, false);
}
if (newUser) {
return done(null, newUser);
}
});
}
});
}
));
i am new to nodejs but with all my understanding i guess things need to be impemented in
if (newUser) {
return done(null, newUser);
}
any guidance is appreciated.
my user schema..
module.exports = function (sequelize, Sequelize) {
var User = sequelize.define('user', {
id: {
autoIncrement: true,
primaryKey: true,
type: Sequelize.INTEGER
},
firstname: {
type: Sequelize.STRING,
notEmpty: true
},
lastname: {
type: Sequelize.STRING,
notEmpty: true
},
//username: { type: Sequelize.STRING },
//about: { type: Sequelize.TEXT },
mobileno: {
type: Sequelize.STRING
},
email: {
type: Sequelize.STRING,
validate: { isEmail: true }
},
password: {
type: Sequelize.STRING,
allowNull: false
},
last_login: {
type: Sequelize.DATE
},
verified_email: {
type: Sequelize.BOOLEAN,
defaultValue: false,
},
verified_mob: {
type: Sequelize.BOOLEAN,
defaultValue: false,
}
//status: { type: Sequelize.ENUM('active', 'inactive'), defaultValue: 'active' }
});
return User;
}

Answer 1

At any circumstances do not share your token with any of your users. User ID's can easily be extracted by tokens and this can be harmful.
Instead, try this approach;
I assume your user model is something like this at your database
{
name: String,
auth: {
password: String //This will be bcrypted.
email: {
address: String,
verified: String || Boolean,
}
}
}
As you can see, verified field holds a String field or Boolean field.
At the moment you create user, (model.create({...}) sequence) preset the value of verified to sha256 of current time (you can use sha256(moment().format())) and save user.
At mail, send user a link like, yoursite.com/verify?code=[code] and then,
Create a route for user/verify?code=[code] in controller. Get user get the user holds code in verified field and change it to 'true'
You are done.