/* jslint node: true */
const insecurity = require('../lib/insecurity')
const utils = require('../lib/utils')
const challenges = require('../data/datacache').challenges

module.exports = (sequelize, { STRING, BOOLEAN }) => {
  const User = sequelize.define('User', {
    username: {
      type: STRING,
      defaultValue: '',
      set (username) {
        username = username.replace(/<(?:\w+)\W+?[\w]/gi, '') // FIXME Move homegrown sanitizer RegEx function to insecurity.js
        console.log(username)
        if (utils.notSolved(challenges.usernameXssChallenge) && utils.contains(username, '<script>alert(`xss`);</script>')) {
          utils.solve(challenges.usernameXssChallenge)
        }
        this.setDataValue('username', username)
      }
    },
    email: {
      type: STRING,
      unique: true,
      set (email) {
        if (utils.notSolved(challenges.persistedXssChallengeUser) && utils.contains(email, '<iframe src="javascript:alert(`xss`)">')) {
          utils.solve(challenges.persistedXssChallengeUser)
        }
        this.setDataValue('email', email)
      }
    },
    password: {
      type: STRING,
      set (clearTextPassword) {
        this.setDataValue('password', insecurity.hash(clearTextPassword))
      }
    },
    isAdmin: {
      type: BOOLEAN,
      defaultValue: false
    },
    lastLoginIp: {
      type: STRING,
      defaultValue: '0.0.0.0'
    },
    profileImage: {
      type: STRING,
      defaultValue: 'default.svg'
    }
  })

  return User
}

@@ -475,38 +475,8 @@
 .js%0A
-        console.log(username)%0A
     
@@ -585,9 +585,8 @@
 ss%60)
-;
 %3C/sc

Remove semicolon from expected XSS payload