bcrypt error with passport and mongoose

Question

Bcrypt is throwing an Incorrect arguments error which I traced back to this function in user.js

userSchema.methods.comparePassword = (candidatePassword, callback) => {
  bcrypt.compare(candidatePassword, this, (err, isMatch) => {
    console.log('candidatePassword= ', candidatePassword, '&  this= ', this);
    if (err) { return callback(err); }
    callback(null, isMatch);
  });
};

   /* 
     candidatePassword=  bird
     this=  {}
     this.password=  undefined */

The user object is coming back as an empty object, and therefore this.password is undefined. I assume the this parameter in bcrypt.compare refers to the userSchema instance. The userSchema is declared in passport.js

const passport = require('passport');
const ExtractJwt = require('passport-jwt').ExtractJwt;
const JwtStrategy = require('passport-jwt').Strategy;
const LocalStrategy = require('passport-local').Strategy;

const User = require('../models/user');
const config = require('../config');

var localOptions = {
  usernameField: 'email',
};

// Verifies user by checking if a password matches the specified email during signin
var localStrategy = new LocalStrategy(localOptions, function (email, password, done) {
  User.findOne({ email:email.toLowerCase()}, function (err, user) {
    console.log('/passport.js/localStrategy- user object: ', user)
    if (err) { return done(err); }
    if (!user) { return done(null, false); }
    user.comparePassword(password, function (err, isMatch) {
      console.log('/passport.js/localStrategy- password: ', password)
      if (err) { return done(err); }
      if (!isMatch) { return done(err, false); }
      return done(null, user);
    });
  });
}); 

// ... jwt strategy ...

passport.use(localStrategy);

/* 
  user object:  { _id: 58a1018dc3f89eb5955b8638,
  email: 'bird@bird.com',
  password: '$2a$10$lAJ9hoGKt9ggfk1TISfkOedxDIs/waLB5e4PccHAKt286XCKCY0/q',
  __v: 0 } */

I'm not sure quite what the issue as it seems a user object is returned with an encrypted password field from mongodb, and user.comparepassword() is called...

I signed the user up with the same Schema object as well.

Any help / tips appreciated!

Answer 1

You are only setting up your model so that it pulls in the candidatePassword but never finds the stored password from the database. Since this is returning an empty object, either the email is not being matched or the password is not being compared to what is stored. Try simplifying the comparePassword function and adding 'sync' to the bcrypt.compare which removes the need for a callback.

In models:

userSchema.methods.comparePassword = (candidatePassword) => {
    return bcrypt.compareSync(candidatePassword, this.password);
};