From 91502db9f1da0f4263e85f5074bf559844cd33d8 Mon Sep 17 00:00:00 2001
From: phairow <phairow@yahoo.com>
Date: Mon, 6 Mar 2017 19:27:40 -0800
Subject: [PATCH] Fix User.verify to convert uid to string

Applications using MongoDB connectors typically have `user.id`
property of type ObjectID.

This commit fixes the code building the verification URL to
correctly convert the user id value into string.
---
 common/models/user.js |  2 +-
 test/user.test.js     | 47 +++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 48 insertions(+), 1 deletion(-)

diff --git a/common/models/user.js b/common/models/user.js
index 077cc3c17..d2a445a33 100644
--- a/common/models/user.js
+++ b/common/models/user.js
@@ -430,7 +430,7 @@ module.exports = function(User) {
       displayPort +
       urlPath +
       '?' + qs.stringify({
-        uid: options.user[pkName],
+        uid: '' + options.user[pkName],
         redirect: options.redirect,
       });
 
diff --git a/test/user.test.js b/test/user.test.js
index 8074a5fef..daa94eea9 100644
--- a/test/user.test.js
+++ b/test/user.test.js
@@ -1428,6 +1428,53 @@ describe('User', function() {
           });
       });
 
+      it('converts uid value to string', function(done) {
+        var idString = '58be263abc88dd483956030a';
+        var actualVerifyHref;
+
+        User.afterRemote('create', function(ctx, user, next) {
+          assert(user, 'afterRemote should include result');
+
+          var options = {
+            type: 'email',
+            to: user.email,
+            from: 'noreply@myapp.org',
+            redirect: '/',
+            protocol: ctx.req.protocol,
+            host: ctx.req.get('host'),
+            templateFn: function(options, cb) {
+              actualVerifyHref = options.verifyHref;
+              cb(null, 'dummy body');
+            },
+          };
+
+          // replace the string id with an object
+          // TODO: find a better way to do this
+          Object.defineProperty(user, 'pk', {
+            get: function() { return this.__data.pk; },
+            set: function(value) { this.__data.pk = value; },
+          });
+          user.pk = {toString: function() { return idString; }};
+
+          user.verify(options, function(err, result) {
+            expect(result.uid).to.be.an('object');
+            expect(result.uid.toString()).to.equal(idString);
+            var parsed = url.parse(actualVerifyHref, true);
+            expect(parsed.query.uid, 'uid query field').to.eql(idString);
+            done();
+          });
+        });
+
+        request(app)
+          .post('/test-users')
+          .expect('Content-Type', /json/)
+          .expect(200)
+          .send({email: 'bar@bat.com', password: 'bar', pk: idString})
+          .end(function(err, res) {
+            if (err) return done(err);
+          });
+      });
+
       it('Verify a user\'s email address with custom token generator', function(done) {
         User.afterRemote('create', function(ctx, user, next) {
           assert(user, 'afterRemote should include result');