Styjun

Setup

I am doing web site authorization, and want to embed best practices into it, while keeping code clean and readible. For now I have classic code like this:

let foundUser = await userModel.findOne( email: recievedEmail );
if(!foundUser)
 error("not authorized!");
const isPasswordMatch = await bcrypt.compare(recievedPassword, foundUser.password);
if(!isPasswordMatch)
 error("not authorized!");
foundUser.update( $set: lastLogin: new Date() , $push: myEvents: authEvent );
foundUser.save();
success("authorized OK!");

Meanwhile, I've asked a question on the best mongoose command to perform auth, and we've forged up the following "auth-check-and-update" command, in an "atomic" manner:

const foundUser = await userModel.findOneAndUpdate(
 email: recievedEmail, password: recievedPassword ,
 $set: lastLogin: new Date() , $push: myEvents: authEvent 
);
if(foundUser)
 success("authorized OK!");
else
 error("not authorized!");

Idea here is obvious - if a user with matching email and password is found then user is considered as authorized, and its last login timestamp is updated (simultaneously).

Problem

To combine best practices from the two above, I need somehow to embed bcrypt.compare() call inside findOneAndUpdate() call. That is tricky to do, because I cannot just "compare hashed passwords"; bcrypt just works differently from simple hashes (like sha or md5): For security reasons it returns different hashes every time. (Answers in the link explains "why and how").

Solution Attempt

I've looked into mongoose-bcrypt package: it is utilizing Schema.pre() functionality:

 schema.pre('update', preUpdate);
 schema.pre('findOneAndUpdate', preUpdate);

To get the idea, please, take a look at mongoose-bcryptindex.js.
You will see, that preUpdate affects only creating new user (..andUpdate part), but not actual checking (findOne.. part). So this plugin could fit for implementing "user registration" / "change password". But it can't work for authorization in the proposed way.

Question

How would you "combine" bcrypt.compare() and userModel.findOneAndUpdate() calls under such circumstances?

What about compare password in UserModel like this

// method to compare password input to password saved in database
UserModel.methods.isValidPassword = async function(password)
 const user = this;
 const compare = await bcrypt.compare(password, user.password);
 return compare;

And inside your auth or passport (i am using passport) do something like this

passport.use(new LocalStrategy(
 (username, password, done) => 
 // change your query here with findOneAndUpdate
 User.findOne( username: username , (err, user) => 
 if (err) return done(err); 
 if (!user) 

 return done(null, false, message: 'Incorrect username.' );
 
 if (!user.isValidPassword(password)) 

 return done(null, false, message: 'Incorrect password.' );
 
 return done(null, user);
 );
 
));