text: var User = require("user");
  var authenticate = require("./authenticate");
  var LogInError = require("./logInError");
  
  // The purpose of this function is to check to see if the
  // user has requested the log in page with a one-time access
  // token. If so, validate it, then redirect the user to the
  // appropriate page: the dashboard homepage or somewhere specified
  // in the query 'then'.
  module.exports = function checkToken(req, res, next) {
    var token, then;
  
    // There is no token,  then proceed to the next middleware.
    if (!req.query || !req.query.token) return next();
  
    token = req.query.token;
  
    // I had previously introduced a bug caused by the fact
    // decodeURIComponent(undefined) === 'undefined'
    // First check that there is 'then' query before attempting to decode
    if (req.query.then) then = decodeURIComponent(req.query.then);
  
    // First we make sure that the access token passed is valid.
    User.checkAccessToken(token, function (err, uid) {
      if (err) return next(new LogInError("BADTOKEN"));
  
      // Then we load the user associated with the access token.
      // Tokens are stored against UIDs in the database.
      User.getById(uid, function (err, user) {
        if (err || !user) return next(new LogInError("NOUSER"));
  
        // You used to be able to disable your account
        // but this is no longer possible. Once all
        // users with isDisabled:true are removed you
        // can delete this check safely.
        if (user.isDisabled) return res.redirect("/account/disabled");
  
        // Store the valid user'd ID in the session.
        authenticate(req, user);
  
        // If the user does not need to be redirected to another page
        // send them to the dashboard's homepage. Users will be redirected
        // elsewhere when they attempt to visit private pages, or when they
        // request a link to reset their password.
        if (then !== "/account/password/set") {
          return res.redirect("/");
        }
  
        User.generateAccessToken({ uid }, function (err, token) {
          if (err) return next(err);
  
          // This token is used to authenticate a password change
          // without an existing password. It's stored in the user's
          // session instead of a query string to keep the URLs tidy.
          req.session.passwordSetToken = token;
  
          res.redirect(then);
        });
      });
    });
  };
  