Tons of fixes to prepare for staged releases.

server/routes/metrictrackingController.js

@@ -1,45 +1,53 @@
-//
-// /api/metric-tracking
-//
-
-var express = require('express')
-var router = express.Router()
-
-let MetricTracking = require('@models/MetricTracking');
-
-let userId = null
-let masterKey = null
-
-// middleware that is specific to this router
-router.use(function setUserId (req, res, next) {
-
-	//Session key is required to continue
-	if(!req.headers.sessionId){
-		next('Unauthorized')
-	}
-
-	if(req.headers.userId){
-		userId = req.headers.userId
-		masterKey = req.headers.masterKey
-		next()
-	}
-})
-
-router.post('/get', function (req, res) {
-	MetricTracking.get(userId, masterKey)
-	.then( data => res.send(data) )
-})
-
-router.post('/create', function (req, res) {
-	MetricTracking.create(userId, masterKey)
-	.then( data => res.send(data) )
-})
-
-//Push text to quick note
-router.post('/save', function (req, res) {
-	MetricTracking.save(userId, req.body.cycleData, masterKey)
-	.then( data => res.send(data) )
-})
-
-
+//
+// /api/metric-tracking
+//
+
+var express = require('express')
+var router = express.Router()
+
+let MetricTracking = require('@models/MetricTracking');
+
+
+// middleware that is specific to this router
+router.use(function setUserId (req, res, next) {
+
+	//Session key is required to continue
+	if(!req.headers.sessionId){
+		next('Unauthorized')
+	}
+
+	if(req.headers.userId){
+		next()
+	}
+})
+
+router.post('/get', function (req, res) {
+	//Bind per request. These were module-level singletons shared by every
+	//concurrent request, so one user's masterKey could overwrite another's.
+	const { userId, masterKey } = req.headers
+
+	MetricTracking.get(userId, masterKey)
+	.then( data => res.send(data) )
+})
+
+router.post('/create', function (req, res) {
+	//Bind per request. These were module-level singletons shared by every
+	//concurrent request, so one user's masterKey could overwrite another's.
+	const { userId, masterKey } = req.headers
+
+	MetricTracking.create(userId, masterKey)
+	.then( data => res.send(data) )
+})
+
+//Push text to quick note
+router.post('/save', function (req, res) {
+	//Bind per request. These were module-level singletons shared by every
+	//concurrent request, so one user's masterKey could overwrite another's.
+	const { userId, masterKey } = req.headers
+
+	MetricTracking.save(userId, req.body.cycleData, masterKey)
+	.then( data => res.send(data) )
+})
+
+
 module.exports = router