Withdraw

app.post("/withdraw/:appid", ensureAuthenticated, function(req, res){

var token = req.get("Authorization")
, decoded = jwt.verify(token, secret)
, steamId = decoded.steamid
, appid = req.params.appid;

var withdrawableItems = [];
var itemsQuery = [];


console.log(info("Incoming withdraw from "+steamId+", with "+req.body.items.length+" items."));


Mongo.query("users", {"steamId": steamId}, function(UserResult){
  if(UserResult != null && typeof UserResult[0].verified != "undefined" && UserResult[0].verified == true){


  for (var i = req.body.items.length - 1; i >= 0; i--) {
     itemsQuery.push({"_id": Mongo.fixId(req.body.items[i]._id)});
     if(req.body.items[i].appid != appid){
       console.log(error("User "+steamId+" tried to withdraw items. But body.items obj contained mixed appids"));
      res.json({"successfull": false, "error": "Mixed withdraw items. Only select items from one game."});
      res.end();
      return false;
    }
  }

  Mongo.query("withdraws", {"userId": steamId}, function(withdrawResult){
    var canWithdraw = false;

    if(withdrawResult.length > 0){

      var timestamp = new Date(withdrawResult[0]._created);
      var timestamp = new Date(timestamp.getTime() + 15*60000);
      var timestampObj = countTime(timestamp);


      if(timestampObj.minutes < 0){
        canWithdraw = true;
      }
    }else{
        canWithdraw = true;
    }



    if(canWithdraw == true){
      Mongo.query("inventory", {$and : [{"steamId": steamId, "appid": parseInt(appid)},  { "$or" :  itemsQuery  }]}, function(result){

        withdrawableItems = result;

        var offer = manager.createOffer(UserResult[0].settings.tradeUrl);
        var id = makeid();

        offer.addMyItems(withdrawableItems);
        offer.setMessage('Confirm this hash: '+id);

          // Send offer
          offer.send(function(err, status) {
            if(err) {
              console.log(error("Tried do send a trade-offer to "+UserResult[0].settings.tradeUrl+ ", SteamAPI did not allow."));

              res.json({"successfull": false, "error": err});
              res.end();
              return;
            }

            //if(status == 'pending') {
            //  h1z1._bots[index].community.acceptConfirmationForObject(_get_identity_secret(h1z1._config['bots'][index].accountName), offer.id);
            //}

            for (var i = withdrawableItems.length - 1; i >= 0; i--) {
              Mongo.delete("inventory", {"_id": Mongo.fixId(withdrawableItems[i]._id)}, function(result){});
            }

            Mongo.insert("withdraws", {
              "offerId":offer.id,
              "userId": offer.partner.getSteamID64(),
              "items": withdrawableItems,
              "status": offer.state
            }, function(result){

            });

            res.json({"successfull": true, "offerId": offer.id, "hash": id});
            res.end();

          });


        });
    }else{

    }

  }, {"_created": -1});


}else{
  console.log(error("Incoming deposit from "+steamId+", with "+req.body.items.length+" items could not go through. The user does not exists in the DB."));

  res.json({"successfull": false, "error": "Could not fetch user"});
  res.end();
}
});
});