Tons of fixes to prepare for staged releases.

server/routes/noteController.js

@@ -5,8 +5,6 @@ let Note = require('@models/Note')
 let User = require('@models/User')
 let ShareNote = require('@models/ShareNote')
 
-let userId = null
-let masterKey = null
 
 // middleware that is specific to this router
 router.use(function setUserId (req, res, next) {
@@ -17,8 +15,6 @@ router.use(function setUserId (req, res, next) {
 	}
 
 	if(req.headers.userId){
-		userId = req.headers.userId
-		masterKey = req.headers.masterKey
 		next()
 	}
 })
@@ -27,6 +23,10 @@ router.use(function setUserId (req, res, next) {
 // Note actions
 //
 router.post('/get', function (req, res) {
+	//Bind per request. These were module-level singletons shared by every
+	//concurrent request, so one user's masterKey could overwrite another's.
+	const { userId, masterKey } = req.headers
+
 	Note.get(userId, req.body.noteId, masterKey)
 	.then( noteObject => {
 
@@ -39,21 +39,37 @@ router.post('/get', function (req, res) {
 })
 
 router.post('/delete', function (req, res) {
+	//Bind per request. These were module-level singletons shared by every
+	//concurrent request, so one user's masterKey could overwrite another's.
+	const { userId, masterKey } = req.headers
+
 	Note.delete(userId, req.body.noteId, masterKey)
 	.then( data => res.send(data) )
 })
 
 router.post('/create', function (req, res) {
+	//Bind per request. These were module-level singletons shared by every
+	//concurrent request, so one user's masterKey could overwrite another's.
+	const { userId, masterKey } = req.headers
+
 	Note.create(userId, req.body.title, req.body.text, masterKey)
 	.then( id => res.send({id}) )
 })
 
 router.post('/update', function (req, res) {
+	//Bind per request. These were module-level singletons shared by every
+	//concurrent request, so one user's masterKey could overwrite another's.
+	const { userId, masterKey } = req.headers
+
 	Note.update(userId, req.body.noteId, req.body.text, req.body.title, req.body.color, req.body.pinned, req.body.archived, req.body.hash, masterKey)
 	.then( id => res.send({id}) )
 })
 
 router.post('/search', function (req, res) {
+	//Bind per request. These were module-level singletons shared by every
+	//concurrent request, so one user's masterKey could overwrite another's.
+	const { userId, masterKey } = req.headers
+
 	Note.search(userId, req.body.searchQuery, req.body.searchTags, req.body.fastFilters, masterKey)
 	.then( NoteAndTags => {
 		res.send(NoteAndTags)
@@ -61,6 +77,10 @@ router.post('/search', function (req, res) {
 })
 
 router.post('/reindex', function (req, res) {
+	//Bind per request. These were module-level singletons shared by every
+	//concurrent request, so one user's masterKey could overwrite another's.
+	const { userId, masterKey } = req.headers
+
 	Note.reindex(userId, masterKey)
 	.then( data => {
 		res.send(data)
@@ -72,18 +92,30 @@ router.post('/reindex', function (req, res) {
 // Update single note attributes
 //
 router.post('/setpinned', function (req, res) {
+	//Bind per request. These were module-level singletons shared by every
+	//concurrent request, so one user's masterKey could overwrite another's.
+	const { userId, masterKey } = req.headers
+
 	Note.setPinned(userId, req.body.noteId, req.body.pinned)
 	.then( results => {
 		res.send(results)
 	})
 })
 router.post('/setarchived', function (req, res) {
+	//Bind per request. These were module-level singletons shared by every
+	//concurrent request, so one user's masterKey could overwrite another's.
+	const { userId, masterKey } = req.headers
+
 	Note.setArchived(userId, req.body.noteId, req.body.archived)
 	.then( results => {
 		res.send(results)
 	})
 })
 router.post('/settrashed', function (req, res) {
+	//Bind per request. These were module-level singletons shared by every
+	//concurrent request, so one user's masterKey could overwrite another's.
+	const { userId, masterKey } = req.headers
+
 	Note.setTrashed(userId, req.body.noteId, req.body.trashed, masterKey)
 	.then( results => {
 		res.send(results)
@@ -94,11 +126,19 @@ router.post('/settrashed', function (req, res) {
 // Share Note Actions
 //
 router.post('/getshareinfo', function (req, res) {
+	//Bind per request. These were module-level singletons shared by every
+	//concurrent request, so one user's masterKey could overwrite another's.
+	const { userId, masterKey } = req.headers
+
 	ShareNote.getShareInfo(userId, req.body.noteId, req.body.rawTextId)
 	.then(results => res.send(results))
 })
 
 router.post('/shareadduser', function (req, res) {
+	//Bind per request. These were module-level singletons shared by every
+	//concurrent request, so one user's masterKey could overwrite another's.
+	const { userId, masterKey } = req.headers
+
 	// ShareNote.addUser(userId, req.body.noteId, req.body.rawTextId, req.body.username, masterKey)
 	User.getByUserName(req.body.username)
 	.then( user => {
@@ -111,22 +151,38 @@ router.post('/shareadduser', function (req, res) {
 })
 
 router.post('/shareremoveuser', function (req, res) {
+	//Bind per request. These were module-level singletons shared by every
+	//concurrent request, so one user's masterKey could overwrite another's.
+	const { userId, masterKey } = req.headers
+
 	// (userId, noteId, shareNoteUserId, shareUserId, masterKey)
 	ShareNote.removeUserFromSharedNote(userId, req.body.noteId, req.body.shareUserNoteId, masterKey)
 	.then(results => res.send(results))
 })
 
 router.post('/enableshare', function (req, res) {
+	//Bind per request. These were module-level singletons shared by every
+	//concurrent request, so one user's masterKey could overwrite another's.
+	const { userId, masterKey } = req.headers
+
 	//Create Shared Encryption Key for Note
 	ShareNote.migrateToShared(userId, req.body.noteId, masterKey)
 	.then(results => res.send(true))
 })
 router.post('/getsharekey', function (req, res) {
+	//Bind per request. These were module-level singletons shared by every
+	//concurrent request, so one user's masterKey could overwrite another's.
+	const { userId, masterKey } = req.headers
+
 	//Get Shared Key for a note
 	ShareNote.decryptSharedKey(userId, req.body.noteId, masterKey)
 	.then(results => res.send(results))
 })
 router.post('/disableshare', function (req, res) {
+	//Bind per request. These were module-level singletons shared by every
+	//concurrent request, so one user's masterKey could overwrite another's.
+	const { userId, masterKey } = req.headers
+
 	//Removed shared encryption key from note
 	ShareNote.migrateToNormal(userId, req.body.noteId, masterKey)
 	.then(results => res.send(true))