app.js

var express = require('express');
var path = require('path');
var favicon = require('serve-favicon');
var logger = require('morgan');
var cookieParser = require('cookie-parser');
var bodyParser = require('body-parser');

var passport = require('passport');
var authenticate = require('./authenticate');
const uploadRouter = require('./routes/uploadRouter');
var session = require('express-session');
var FileStore = require('session-file-store')(session);

var index = require('./routes/index');
var users = require('./routes/users');

var dishRouter = require('./routes/dishRouter');
var promoRouter = require('./routes/promoRouter');
var leaderRouter = require('./routes/leaderRouter');
var favoriteRouter = require('./routes/favorite');

const mongoose =  require('mongoose');
mongoose.Promise = require('bluebird');

const Dishes = require('./models/dishes.js');
const Leader = require('./models/leaders.js');
const Promotion = require('./models/promotion.js');
const User = require('./models/users.js');

// const url = 'mongodb://localhost:27017/confusion';

var config = require('./config');
const url = config.mongoUrl;

const connect = mongoose.connect(url, {
  useMongoClient: true
});

connect.then((db) => {
  console.log('connected to server');
},(err) => { console.log(err); })

var app = express();

// view engine setup
app.set('views', path.join(__dirname, 'views'));
app.set('view engine', 'jade');

// uncomment after placing your favicon in /public
//app.use(favicon(path.join(__dirname, 'public', 'favicon.ico')));
app.use(logger('dev'));
app.use(bodyParser.json());
app.use(bodyParser.urlencoded({ extended: false }));
// app.use(cookieParser('12345-67890-09876-54321'));

app.use(session({
  name: 'session-id',
  secret: '12345-67890-09876-54321',
  saveUninitialized: false,
  resave: false,
  store: new FileStore()
}));

app.use(passport.initialize());
app.use(passport.session());

// Secure traffic only
app.all('*', (req, res, next) => {
  if (req.secure) {
    return next();
  }
  else {
    res.redirect(307, 'https://' + req.hostname + ':' + app.get('secPort') + req.url);
  }
});
// function auth(req,res,next) {
//   console.log(req.signedCookies);
//   if(!req.signedCookies.user) {
//     var authHeader = req.headers.authorization;
//     if(!authHeader) {
//       var err = new Error('you are not authenticated');
//       res.setHeader('WWW-Authenticate','Basic');
//       err.status = 401;
//       next(err);
//       return next(err);
//     }

//     var auth = new Buffer(authHeader.split(' ')[1], 'base64').toString().split(':');

//     var username = auth[0];
//     var password = auth[1];

//     if(username == 'admin' && password == 'password') {
//       res.cookie('user','admin',{signed:true});
//       next();
//     } else {
//       var err = new Error('you are not authenticated');
//       res.setHeader('WWW-Authenticate','Basic');
//       err.status = 401;
//       return next(err);
//     }

//   } else {
//     if(req.signedCookies.user == "admin") {
//       next();
//     } else {
//       var err = new Error('you are not authenticated');
//       err.status = 401;
//       return next(err);
//     }
//   }


// }


// function auth (req, res, next) {
//   console.log(req.session);

//   if (!req.session.user) {
//       var authHeader = req.headers.authorization;
//       if (!authHeader) {
//           var err = new Error('You are not authenticated!');
//           res.setHeader('WWW-Authenticate', 'Basic');
//           err.status = 401;
//           next(err);
//           return;
//       }
//       var auth = new Buffer(authHeader.split(' ')[1], 'base64').toString().split(':');
//       var user = auth[0];
//       var pass = auth[1];
//       if (user == 'admin' && pass == 'password') {
//           req.session.user = 'admin';
//           next(); // authorized
//       } else {
//           var err = new Error('You are not authenticated!');
//           res.setHeader('WWW-Authenticate', 'Basic');
//           err.status = 401;
//           next(err);
//       }
//   }
//   else {
//       if (req.session.user === 'admin') {
//           console.log('req.session: ',req.session);
//           next();
//       }
//       else {
//           var err = new Error('You are not authenticated!');
//           err.status = 401;
//           next(err);
//       }
//   }
// }

app.use('/', index);
app.use('/users', users);
app.use('/imageUpload',uploadRouter);
app.use('/favorite',favoriteRouter);

// function auth (req, res, next) {
//   console.log(req.session);

// if(!req.session.user) {
//     var err = new Error('You are not authenticated!');
//     err.status = 403;
//     return next(err);
// }
// else {
//   if (req.session.user === 'authenticated') {
//     next();
//   }
//   else {
//     var err = new Error('You are not authenticated!');
//     err.status = 403;
//     return next(err);
//   }
// }
// }


// function auth (req, res, next) {
//   console.log(req.user);

//   if (!req.user) {
//     var err = new Error('You are not authenticated!');
//     res.setHeader('WWW-Authenticate', 'Basic');
//     err.status = 401;
//     next(err);
//   }
//   else {
//         next();
//   }
// }

// app.use(auth);

app.use(express.static(path.join(__dirname, 'public')));


app.use('/dishes', dishRouter);
app.use('/promotion', promoRouter);
app.use('/leaders', leaderRouter);

// catch 404 and forward to error handler
app.use(function(req, res, next) {
  var err = new Error('Not Found');
  err.status = 404;
  next(err);
});

// error handler
app.use(function(err, req, res, next) {
  // set locals, only providing error in development
  res.locals.message = err.message;
  res.locals.error = req.app.get('env') === 'development' ? err : {};

  // render the error page
  res.status(err.status || 500);
  res.render('error');
});

module.exports = app;


==============================================================
favorite.js

const mongoose = require('mongoose');
const Schema = mongoose.Schema;
require('mongoose-currency').loadType(mongoose);
const Currency = mongoose.Types.Currency;


var favoriteSchema = new Schema({

    user: {
        type: mongoose.Schema.Types.ObjectId,
        ref: 'User'
    },
    dish: [ {
        type: mongoose.Schema.Types.ObjectId,
        ref: 'Dish'
    }]
}, {
    timestamps: true
});

var Favorite = mongoose.model('Favorite', favoriteSchema);

module.exports = Favorite;

========================================================================

favoriteRouter.js


const express = require('express');
const bodyParser = require('body-parser');
const mongoose = require('mongoose');
var authenticate = require('../authenticate');
const cors = require('./cors');
const Favorite = require('../models/favorite');
const favoriteRouter = express.Router();

favoriteRouter.use(bodyParser.json());

favoriteRouter.route('/')
.options(cors.corsWithOptions, (req, res) => { res.sendStatus(200); })
.get(cors.cors,(req,res,next) => {
    Favorite.find({})
    .populate('user')
    .populate('dish')
    .then((fav) => {
        res.statusCode = 200;
        res.setHeader('Content-Type', 'application/json');
        res.json(fav);
    }, (err) => next(err))
    .catch((err) => next(err));
})
.post(cors.corsWithOptions,authenticate.verifyUser,(req, res, next) => {
   authenticate.verifyAdmin(req.user._id, (p, q) => {
        if(q == true) {
            Favorite.find({})
            .then((favData) => {
                if(favData.user == req.user._id) {
                    for(let i = 0;i<favData.dish.length;i++) {
                        for(let j = 0;j< req.body.dish;j++) {
                            if(favData.dish[i] != req.body.dish[j]) {
                                favData.dish.push(req.body.dish[j])
                            }
                        }
                    }

                    favData.save()
                    .then((favdata) => {
                        res.statusCode = 200;
                        res.setHeader('Content-Type', 'application/json');
                        res.json(favdata);
                    }, (err) => next(err));

                } else {
                    Favorite.create(req.body)
                    .then((fav) => {
                        console.log('fav created', fav);
                        res.statusCode = 200;
                        res.setHeader('Content-Type','application/json');
                        res.json(fav);
                    },(err) => next(err))
                    .catch((err) => next(err));
                }

            })

        } else if(q == false){
            console.log('admin false');
            res.statusCode = 403;
            res.end('you are not authorize to perform this operation');

        } else {
            next(err);
        }
   })

})
.delete(cors.corsWithOptions,authenticate.verifyUser,(req, res, next) => {
    authenticate.verifyAdmin(req.user._id, (p, q,next) => {
        if(q == true) {
            Favorite.remove({})
            .then((resp) => {
                res.statusCode = 200;
                res.setHeader('Content-Type','application/json');
                res.json(resp);
            },(err) => next(err))
            .catch((err) => next(err));
        }
        else if(q == false) {
            res.statusCode = 403;
            res.end('you are not authorize to perform this operation');
        } else {
            next(err);
        }
    });
});


favoriteRouter.route('/:dishId')
.options(cors.corsWithOptions, (req, res) => { res.sendStatus(200); })
.post(cors.corsWithOptions,authenticate.verifyUser,(req, res, next) => {
    authenticate.verifyAdmin(req.user._id, (p, q,next) => {
        if(q == true) {
            Favorite.find({})
            .then((favData) => {
                var index ;
                var finalIndex;
                for(index =0;index<favData.length;index++) {
                    if(favData[index].user.equals(req.user._id))
                        finalIndex = index;
                }
                if(favData[finalIndex].user.equals(req.user._id)) {
                    var pushVal =  false;
                    for(let i = 0;i<favData[finalIndex].dish.length;i++) {
                            if(!favData[finalIndex].dish[i].equals(req.params.dishId)) {
                                pushVal =  true;
                            } else {
                                pushVal =  false;
                            }

                    }
                    if(pushVal) {
                        favData[finalIndex].dish.push(req.params.dishId);
                        favData[finalIndex].save()
                        .then((favdata) => {
                            res.statusCode = 200;
                            res.setHeader('Content-Type', 'application/json');
                            res.json(favdata);
                        }, (err) => next(err));
                    }
                    else {
                        res.statusCode = 403;
                        res.json("already dishid exist");
                    }

                }
            });
        }
        else if(q == false) {
            res.statusCode = 403;
            res.end('you are not authorize to perform this operation');
        } else {
            next(err);
        }


})
})

.delete(cors.corsWithOptions,authenticate.verifyUser,(req, res, next) => {

    authenticate.verifyAdmin(req.user._id, (p, q,next) => {
        if(q == true) {


            Favorite.find({})
            .then((favData) => {
                var index ;
                var finalIndex;
                for(index =0;index<favData.length;index++) {
                    if(favData[index].user.equals(req.user._id))
                        finalIndex = index;
                }
                if(favData[finalIndex].user.equals(req.user._id)) {
                    var popVal =  false;
                    for(let i = 0;i<favData[finalIndex].dish.length;i++) {
                            if(favData[finalIndex].dish[i].equals(req.params.dishId)) {
                                popVal =  true;
                            }

                    }
                    console.log("popVal",popVal)
                    if(popVal) {
                        var popIndex = favData[finalIndex].dish.indexOf(req.params.dishId)
                        if(popIndex> -1) {
                            favData[finalIndex].dish.splice(popIndex, 1);
                        }
                        favData[finalIndex].save()
                        .then((favdata) => {
                            res.statusCode = 200;
                            res.setHeader('Content-Type', 'application/json');
                            res.json(favdata);
                        }, (err) => next(err));
                    }
                    else {
                        res.statusCode = 403;
                        res.json("dishid doesnot exist");
                    }

                }
            });
        }
        else if(q == false) {
            res.statusCode = 403;
            res.end('you are not authorize to perform this operation');
        } else {
            next(err);
        }



});
});


module.exports = favoriteRouter;