Revert "Revert "modify twitter auth to fail if mismatch between selec…

…ted user and current user"" This reverts commit df335b0.
kanakaduruvasula · Dec 31, 2014 · a8d08b1 · a8d08b1
1 parent 713383b
commit a8d08b1
Showing 1 changed file with 24 additions and 18 deletions.
diff --git a/config/passport.js b/config/passport.js
@@ -109,26 +109,32 @@ passport.use(
       } else {
         User.findOne({ twitter: profile.id }, function(err, existingUser) {
           if (err) { return done(err); }
-          var user = existingUser || new User();
-          user.twitter = profile.id;
-          user.email = user.email || '';
-          user.tokens.push({
-            kind: 'twitter',
-            accessToken: accessToken,
-            tokenSecret: tokenSecret
-          });
-          user.profile.name = user.profile.name || profile.displayName;
-          user.profile.username = user.profile.username || profile.username;
+          if (!existingUser || (existingUser && existingUser.twitter == profile.id)) {
+            var user = existingUser || new User();
+            user.twitter = profile.id;
+            user.email = user.email || '';
+            user.tokens.push({
+              kind: 'twitter',
+              accessToken: accessToken,
+              tokenSecret: tokenSecret
+            });
+            user.profile.name = user.profile.name || profile.displayName;
+            user.profile.username = user.profile.username || profile.username;
 
-          user.profile.location =
-            user.profile.location || profile._json.location;
-          user.profile.picture =
-            user.profile.picture || profile._json.profile_image_url_https;
+            user.profile.location =
+                user.profile.location || profile._json.location;
+            user.profile.picture =
+                user.profile.picture || profile._json.profile_image_url_https;
 
-          user.save(function(err) {
-            if (err) { return done(err); }
-            done(null, user);
-          });
+            user.save(function (err) {
+              if (err) {
+                return done(err);
+              }
+              done(null, user);
+            });
+          } else {
+            return done("Sorry, we experienced an error. This has been reported. Try logging in with a different authentication method.");
+          }
         });
       }
     })