Tons of fixes to prepare for staged releases.

server/routes/tagController.js

@@ -3,8 +3,6 @@ var router = express.Router()
 
 let Tags = require('@models/Tag')
 
-let userId = null
-let masterKey = null
 
 // middleware that is specific to this router
 router.use(function setUserId (req, res, next) {
@@ -15,49 +13,75 @@ router.use(function setUserId (req, res, next) {
 	}
 
 	if(req.headers.userId){
-		userId = req.headers.userId
-		masterKey = req.headers.masterKey
 		next()
 	}
 })
 
 //Get the latest notes the user has created
 router.post('/suggest', function (req, res) {
+	//Bind per request. These were module-level singletons shared by every
+	//concurrent request, so one user's masterKey could overwrite another's.
+	const { userId, masterKey } = req.headers
+
 	Tags.suggest(userId, req.body.noteId, req.body.tagText)
 	.then( data => res.send(data) )
 })
 
 //Get latest tags based on when it was put on a note
 router.post('/latest', function (req, res) {
+	//Bind per request. These were module-level singletons shared by every
+	//concurrent request, so one user's masterKey could overwrite another's.
+	const { userId, masterKey } = req.headers
+
 	Tags.latest(userId, req.body.noteId)
 	.then( data => res.send(data) )
 })
 
 //Get the latest notes the user has created
 router.post('/addtonote', function (req, res) {
+	//Bind per request. These were module-level singletons shared by every
+	//concurrent request, so one user's masterKey could overwrite another's.
+	const { userId, masterKey } = req.headers
+
 	Tags.addToNote(userId, req.body.noteId, req.body.tagText.toLowerCase())
 	.then( data => res.send(data) )
 })
 
 router.post('/removefromnote', function (req, res) {
+	//Bind per request. These were module-level singletons shared by every
+	//concurrent request, so one user's masterKey could overwrite another's.
+	const { userId, masterKey } = req.headers
+
 	Tags.removeTagFromNote(userId, req.body.tagId)
 	.then( data => res.send(data) )
 })
 
 //Get the latest notes the user has created
 router.post('/get', function (req, res) {
+	//Bind per request. These were module-level singletons shared by every
+	//concurrent request, so one user's masterKey could overwrite another's.
+	const { userId, masterKey } = req.headers
+
 	Tags.get(userId, req.body.noteId)
 	.then( data => res.send(data) )
 })
 
 //Get the latest notes the user has created
 router.post('/fornote', function (req, res) {
+	//Bind per request. These were module-level singletons shared by every
+	//concurrent request, so one user's masterKey could overwrite another's.
+	const { userId, masterKey } = req.headers
+
 	Tags.fornote(userId, req.body.noteId)
 	.then( data => res.send(data) )
 })
 
 //Get all the tags for this user in order of usage
 router.post('/usertags', function (req, res) {
+	//Bind per request. These were module-level singletons shared by every
+	//concurrent request, so one user's masterKey could overwrite another's.
+	const { userId, masterKey } = req.headers
+
 	Tags.userTags(userId, req.body.searchQuery, req.body.searchTags, req.body.fastFilters)
 	.then( data => res.send(data) )
 })