module.exports.updateUser = async (req, res) => {
  const { currentPassword, username, password, email, tags  } = req.body

  const user = await User.findOne({
    _id: req.session.user.id
  }).exec()

  if (!user) {
    req.session.destroy()
    return res.status(500).end()
  }

  if (tags) {
    user.tags = tags.push(tags)
  }

  if (username) {
    user.username = username

    try {
      await user.save()
    } catch (err) {
      if (err.code === 11000) {
        return res.status(400).json({
          message: 'This username is already used'
        })
      }

      return res.status(500).json({
        message: 'Could not change username'
      })
    }

    req.session.user.username = username
  } else {
    if (!(password || email)) {
      return res.status(400).json({
        message: 'Incomplete request'
      })
    }

    if (!(currentPassword && await validatePassword(currentPassword, user.password))) {
      return res.status(401).json({
        message: 'Invalid password'
      })
    }

    if (email) {
      if (!validateEmail(email)) {
        return res.status(400).json({
          message: 'Email must be valid'
        })
      }

      user.email = email
      user.isVerified = false

      try {
        await user.save()

        if (!config.skipEmailVerification) {
          mailer.sendVerificationEmail(user.username, email)
        }
      } catch (err) {
        if (err.code === 11000) {
          return res.status(400).json({
            message: 'This email is already used'
          })
        }

        return res.status(500).json({
          message: 'Could not change email'
        })
      }
    } else if (password) {
      user.password = password

      try {
        await user.save()
      } catch (err) {
        res.status(500).json({
          message: 'Could not update password'
        })
      }
    }
  }

  res.status(200).end()
}