From 6fd020dc7ed38f50c75cf40a56813e74bc9f3bda Mon Sep 17 00:00:00 2001
From: Phil Booth <pmbooth@gmail.com>
Date: Thu, 22 Jun 2017 14:07:05 +0100
Subject: [PATCH] fix(server): do not return flowId from consumeSigninCodes
 endpoint

https://github.com/mozilla/fxa-auth-server/pull/1952
r=vbudhram
---
 lib/routes/signin-codes.js        |  2 +-
 test/local/routes/signin-codes.js | 14 +++++++++++---
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/lib/routes/signin-codes.js b/lib/routes/signin-codes.js
index 04f386e0..f106c87b 100644
--- a/lib/routes/signin-codes.js
+++ b/lib/routes/signin-codes.js
@@ -56,7 +56,7 @@ module.exports = (log, db, customs) => {
                     return request.emitMetricsEvent(`flow.continued.${result.flowId}`)
                   }
                 })
-                .then(() => result)
+                .then(() => ({ email: result.email }))
             })
         }
       }
diff --git a/test/local/routes/signin-codes.js b/test/local/routes/signin-codes.js
index 3438bebd..8af97914 100644
--- a/test/local/routes/signin-codes.js
+++ b/test/local/routes/signin-codes.js
@@ -10,10 +10,14 @@ const mocks = require('../../mocks')
 const P = require('../../../lib/promise')
 
 describe('/signinCodes/consume:', () => {
-  let log, db, customs, routes, route, request
+  let log, db, customs, routes, route, request, response
 
   describe('success, db does not return flowId:', () => {
-    beforeEach(() => setup({ db: { email: 'foo@bar' } }))
+    beforeEach(() => setup({ db: { email: 'foo@bar' } }).then(r => response = r))
+
+    it('returned the correct response', () => {
+      assert.deepEqual(response, { email: 'foo@bar' })
+    })
 
     it('called log.begin correctly', () => {
       assert.equal(log.begin.callCount, 1)
@@ -56,7 +60,11 @@ describe('/signinCodes/consume:', () => {
   })
 
   describe('success, db returns flowId:', () => {
-    beforeEach(() => setup({ db: { email: 'foo@bar', flowId: 'baz' } }))
+    beforeEach(() => setup({ db: { email: 'foo@bar', flowId: 'baz' } }).then(r => response = r))
+
+    it('returned the correct response', () => {
+      assert.deepEqual(response, { email: 'foo@bar' })
+    })
 
     it('called log.begin once', () => {
       assert.equal(log.begin.callCount, 1)