strongloop loopback: extending built-in user model with remote hook results in endless loop

Question

I need to enable email registration confirmation in my loopback application.

Following the docs at: https://docs.strongloop.com/display/public/LB/Registering+users#Registeringusers-Verifyingemailaddresses

I haven't been able to properly work on the built-in User model, and the docs here are not very clear.

So I created an additional model, called RegisteredUser.

//registereduser.js: this is mostly from the docs


var path = require('path');

  //send verification email after registration
module.exports = function(RegisteredUser) {
  RegisteredUser.observe('after save',function(ctx,next) {
    var user = ctx.instance;
    console.log('> user.afterRemote triggered');
    console.log(user);
    var options = { 
      type: 'email',
      to: user.email,
      from: '[email protected]',
      subject: 'Gracias por registrarte!',
      template: path.resolve(__dirname, '../../server/views/email_verify.html'),
      redirect: '/verified',
      user: user
    };  
    console.log("> before verify");
    user.verify(options, function(err, response) {
      if (err) {
        console.log("errrrrrrrrrrrr");
        console.log(err);
        next(err);
        return;
      }   
      console.log('> verification email sent:', response);
      ctx.res.render('response', {
        title: '¡Registración completada con éxito!',
        content: 'Por favor revisa tu correo y haz clic en el enlace que ahí encontrarás antes de usar la app',
        redirectTo: '/',
        redirectToLinkText: 'Ingresar'
      }); 
    }); 
    console.log("> after verify");
  }); 
}

//registereduser.json
{
  "name": "RegisteredUser",
  "base": "User",
  "idInjection": true,
  "properties": {
  },
  "validations": [],
  "relations": {
  },
  "acls": [
    {
      "accessType": "READ",
      "principalType": "ROLE",
      "principalId": "$everyone",
      "permission": "DENY"
    },
    {
      "accessType": "WRITE",
      "principalType": "ROLE",
      "principalId": "$everyone",
      "permission": "DENY"
    },
    {
      "accessType": "WRITE",
      "principalType": "ROLE",
      "principalId": "admin",
      "permission": "ALLOW"
    }
  ],
  "methods": {}
}

The relevant section in model-config.json:

 "RegisteredUser": {
    "dataSource": "my_ps_DS",
     "options": {
      "emailVerificationRequired": true
    }   
  },  

Now, what happens is that indeed the after hook gets triggered, but apparently it enters an endless loop - as if it would be logging in right away and keeping logging in, as console.log(user) seems to show a constantly changing token. Server output:

> before verify
> after verify
> user.afterRemote triggered
{ password: '$2a$10$M/YCJSfWZub3T0ADEbERW.Sa5sxqOKleA3GS6dSKZobXsnFNYkayG',
  email: '[email protected]',
  verificationToken: 'e93ee25b4be9706364e9c52c31391c8a6ee1e552e1dee55bb0bb2df497877bc6c0004079fc30ab78124aad827d1454898b9cddefd356d889629a0b37183986a3',
  firstName: 'Miller',
  lastName: 'Muller' }
> before verify
> after verify
> user.afterRemote triggered
{ password: '$2a$10$M/YCJSfWZub3T0ADEbERW.Sa5sxqOKleA3GS6dSKZobXsnFNYkayG',
  email: '[email protected]',
  verificationToken: '59eba928609fabb8d1856ed2ac914dd147aa331fd73418c83c898deaf84fbaf01c24f6a8a97a0ae609940c15af42a9f472da417b381beb771f48b2c98220d1c8',
  firstName: 'Miller',
  lastName: 'Muller' }
> before verify
> after verify
> user.afterRemote triggered
{ password: '$2a$10$M/YCJSfWZub3T0ADEbERW.Sa5sxqOKleA3GS6dSKZobXsnFNYkayG',
  email: '[email protected]',
  verificationToken: '13c8c86695487ba830e4d8c9f3f49bb0ab56cab31924cede9dc02780bf81c244980f8a486d28faae353c7cc0826218ce774931f9baa3e5047b4d6988a5eea169',
  firstName: 'Miller',
  lastName: 'Muller' }
> before verify
> after verify
> user.afterRemote triggered
{ password: '$2a$10$M/YCJSfWZub3T0ADEbERW.Sa5sxqOKleA3GS6dSKZobXsnFNYkayG',
  email: '[email protected]',
  verificationToken: 'd09e050d36f872832cf6002d2e0f2fdf57de392ba798248df5b5b2f25e7852cb8f135cf09bf3f92852d7a7683b3bda15ec164eeab90a1f7321a13a30725f82f1',
  firstName: 'Miller',
  lastName: 'Muller' }
> before verify
> after verify
> user.afterRemote triggered

I'd like to think I am doing something wrong before thinking it's a bug in loopback or something?

Answer 1

Ooops my very bad.

It's after create not after save. However, it's not working yet still, reverting to old notation RegisteredUser.afterRemote('create', function....