refactor(email): Fixes #352 Remove ability to fetch email address (#543) r=@shane-tomlinson

lib/routes/verify.js

@@ -12,7 +12,7 @@ module.exports = {
   validate: {
     payload: {
       token: validators.token.required(),
-      email: Joi.boolean().default(false)
+      email: Joi.boolean().optional()
     }
   },
   response: {
@@ -25,15 +25,14 @@ module.exports = {
   },
   handler: function verify(req, reply) {
     token.verify(req.payload.token).then(function(info) {
-      if (req.payload.email) {
+      if (req.payload.email !== undefined) {
         logger.warn('email.requested', {
           user: info.user,
           client_id: info.client_id,
           scope: info.scope
         });
-      } else {
-        delete info.email;
       }
+      delete info.email;
       logger.info('verify.success', {
         client_id: info.client_id,
         scope: info.scope

test/api.js

@@ -2768,7 +2768,7 @@ describe('/v1', function() {
       });
     });
 
-    it('should not return the email if email:false for profile:email scope', function() {
+    it('should not return email for payload having email:false', function() {
       return newToken({ scope: 'profile:email' }).then(function(res) {
         assert.equal(res.statusCode, 200);
         assertSecurityHeaders(res);
@@ -2786,7 +2786,7 @@ describe('/v1', function() {
       });
     });
 
-    it('should return the email if opted in', function() {
+    it('should not return email for payload having email:true', function() {
       return newToken({ scope: 'profile:email' }).then(function(res) {
         assert.equal(res.statusCode, 200);
         assertSecurityHeaders(res);
@@ -2800,7 +2800,7 @@ describe('/v1', function() {
       }).then(function(res) {
         assert.equal(res.statusCode, 200);
         assertSecurityHeaders(res);
-        assert.equal(res.result.email, VEMAIL);
+        assert.equal(res.result.email, undefined);
       });
     });