      accessToken: chance.hash()
    })

    savedId = user._id

    const userPopulated = await user.populate('role')

    let groups = []
    if (postData.groups) {
      groups = await Group.getGroups(postData.groups)
      for (const group in groups) {
        await group.addMember(savedId)
        await group.save()
      }
    }

    let teams = []
    if (postData.teams) {
      const dbTeams = await Team.getTeamsByIds(postData.teams)
      for (const team of dbTeams) {
        await team.addMember(savedId)
        await team.save()
      }

      teams = dbTeams
    }

    const departments = await Department.getUserDepartments(savedId)
    user = userPopulated.toJSON()
    user.groups = groups.map(g => {
      return { _id: g._id, name: g.name }
    })

    if ((user.role.isAgent || user.role.isAdmin) && teams.length > 0) {
      user.teams = teams.map(t => {
        return { _id: t._id, name: t.name }
      })

      user.departments = departments.map(d => {
        return { _id: d._id, name: d.name }
      })
    }

    return apiUtil.sendApiSuccess(res, { account: user })
  } catch (e) {
    winston.warn(e)
    return apiUtil.sendApiError(res, 500, e.message)
  }
}
The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.