Tons of fixes to prepare for staged releases.

server/routes/attachmentController.js

@@ -7,8 +7,6 @@ let router = express.Router()
 let Attachment = require('@models/Attachment')
 let Note = require('@models/Note')
 
-let userId = null
-let masterKey = null
 
 // middleware that is specific to this router
 router.use(function setUserId (req, res, next) {
@@ -19,23 +17,33 @@ router.use(function setUserId (req, res, next) {
 	}
 
 	if(req.headers.userId){
-		userId = req.headers.userId
-		masterKey = req.headers.masterKey
 		next()
 	}
 })
 
 router.post('/search', function (req, res) {
+	//Bind per request. These were module-level singletons shared by every
+	//concurrent request, so one user's masterKey could overwrite another's.
+	const { userId, masterKey } = req.headers
+
 	Attachment.search(userId, req.body.noteId, req.body.attachmentType, req.body.offset, req.body.setSize, req.body.includeShared)
 	.then( data => res.send(data) )
 })
 
 router.post('/textsearch', function (req, res) {
+	//Bind per request. These were module-level singletons shared by every
+	//concurrent request, so one user's masterKey could overwrite another's.
+	const { userId, masterKey } = req.headers
+
 	Attachment.textSearch(userId, req.body.searchTerm)
 	.then( data => res.send(data) )
 })
 
 router.post('/update', function (req, res) {
+	//Bind per request. These were module-level singletons shared by every
+	//concurrent request, so one user's masterKey could overwrite another's.
+	const { userId, masterKey } = req.headers
+
 	Attachment.update(userId, req.body.attachmentId, req.body.updatedText, req.body.noteId)
 	.then( result => {
 		Note.reindex(userId, req.body.noteId)
@@ -44,11 +52,19 @@ router.post('/update', function (req, res) {
 })
 
 router.post('/delete', function (req, res) {
+	//Bind per request. These were module-level singletons shared by every
+	//concurrent request, so one user's masterKey could overwrite another's.
+	const { userId, masterKey } = req.headers
+
 	Attachment.delete(userId, req.body.attachmentId)
 	.then( data => res.send(data) )
 })
 
 router.post('/upload', upload.single('file'), function (req, res, next) {
+	//Bind per request. These were module-level singletons shared by every
+	//concurrent request, so one user's masterKey could overwrite another's.
+	const { userId, masterKey } = req.headers
+
 
 	//Create attachment with file information and node id
 	const noteId = parseInt(req.body.noteId)
@@ -67,6 +83,10 @@ router.post('/upload', upload.single('file'), function (req, res, next) {
 
 // get push key
 router.post('/getbookmarklet', function (req, res) {
+	//Bind per request. These were module-level singletons shared by every
+	//concurrent request, so one user's masterKey could overwrite another's.
+	const { userId, masterKey } = req.headers
+
 
 	Attachment.getPushkeyBookmarklet(userId)
 	.then( data => res.send(data) )