From 82d5ac99df0d6b46b2130aea9b393525c6ec2815 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Wolfgang=20Hu=C3=9F?= <wolle.huss@pjannto.com>
Date: Fri, 13 Sep 2019 11:55:38 +0200
Subject: [PATCH 01/22] Make hashtag links URL safe

---
 backend/src/middleware/hashtags/extractHashtags.js         | 2 +-
 backend/src/middleware/hashtags/extractHashtags.spec.js    | 6 +++---
 backend/src/middleware/hashtags/hashtagsMiddleware.spec.js | 4 ++--
 webapp/components/Editor/nodes/Hashtag.js                  | 2 +-
 webapp/pages/admin/tags.vue                                | 2 +-
 webapp/pages/index.vue                                     | 3 ++-
 webapp/pages/search/hashtag/_id.vue                        | 5 +++--
 7 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/backend/src/middleware/hashtags/extractHashtags.js b/backend/src/middleware/hashtags/extractHashtags.js
index c7782e59d..13f29475e 100644
--- a/backend/src/middleware/hashtags/extractHashtags.js
+++ b/backend/src/middleware/hashtags/extractHashtags.js
@@ -20,7 +20,7 @@ export default function(content) {
     .get()
   const hashtags = []
   urls.forEach(url => {
-    const match = exec(url, regX)
+    const match = exec(decodeURI(url), regX)
     if (match != null) {
       hashtags.push(match[1])
     }
diff --git a/backend/src/middleware/hashtags/extractHashtags.spec.js b/backend/src/middleware/hashtags/extractHashtags.spec.js
index 2e1761718..0881e33a3 100644
--- a/backend/src/middleware/hashtags/extractHashtags.spec.js
+++ b/backend/src/middleware/hashtags/extractHashtags.spec.js
@@ -27,14 +27,14 @@ describe('extractHashtags', () => {
         expect(extractHashtags(content)).toEqual(['Democracy'])
       })
 
-      it('ignores Hashtag links with not allowed character combinations', () => {
+      it('ignores Hashtag links with not allowed character combinations and handles `encodeURI` URLs', () => {
         // Allowed are all unicode letters '\pL' and all digits '0-9'. There haveto be at least one letter in it.
         const content =
-          '<p>Something inspirational about <a href="/search/hashtag/AbcDefXyz0123456789!*(),2" class="hashtag" target="_blank">#AbcDefXyz0123456789!*(),2</a>, <a href="/search/hashtag/0123456789" class="hashtag" target="_blank">#0123456789</a>, <a href="/search/hashtag/0123456789a" class="hashtag" target="_blank">#0123456789a</a>, <a href="/search/hashtag/AbcDefXyz0123456789" target="_blank">#AbcDefXyz0123456789</a>, and <a href="/search/hashtag/λαπ" target="_blank">#λαπ</a>.</p>'
+          '<p>Something inspirational about <a href="/search/hashtag/AbcDefXyz0123456789!*(),2" class="hashtag" target="_blank">#AbcDefXyz0123456789!*(),2</a>, <a href="/search/hashtag/0123456789" class="hashtag" target="_blank">#0123456789</a>, <a href="/search/hashtag/0123456789a" class="hashtag" target="_blank">#0123456789a</a>, <a href="/search/hashtag/AbcDefXyz0123456789" target="_blank">#AbcDefXyz0123456789</a>, and <a href="/search/hashtag/%C4%A7%CF%80%CE%B1%CE%BB" target="_blank">#ħπαλ</a>.</p>'
         expect(extractHashtags(content).sort()).toEqual([
           '0123456789a',
           'AbcDefXyz0123456789',
-          'λαπ',
+          'ħπαλ',
         ])
       })
     })
diff --git a/backend/src/middleware/hashtags/hashtagsMiddleware.spec.js b/backend/src/middleware/hashtags/hashtagsMiddleware.spec.js
index 3f101f778..16cd96eb7 100644
--- a/backend/src/middleware/hashtags/hashtagsMiddleware.spec.js
+++ b/backend/src/middleware/hashtags/hashtagsMiddleware.spec.js
@@ -129,8 +129,8 @@ describe('hashtags', () => {
         )
       })
 
-      describe('afterwards update the Post by removing a Hashtag, leaving a Hashtag and add a Hashtag', () => {
-        // The already existing Hashtag has no class at this point.
+      describe('afterwards update the Post by removing a hashtag, leaving a hashtag and add a hashtag', () => {
+        // The already existing hashtag has no class at this point.
         const postContent =
           '<p>Hey Dude, <a class="hashtag" href="/search/hashtag/Elections">#Elections</a> should work equal for everybody!? That seems to be the only way to have equal <a href="/search/hashtag/Liberty">#Liberty</a> for everyone.</p>'
 
diff --git a/webapp/components/Editor/nodes/Hashtag.js b/webapp/components/Editor/nodes/Hashtag.js
index 97220668f..bf1530ceb 100644
--- a/webapp/components/Editor/nodes/Hashtag.js
+++ b/webapp/components/Editor/nodes/Hashtag.js
@@ -25,7 +25,7 @@ export default class Hashtag extends TipTapMention {
           'a',
           {
             class: this.options.mentionClass,
-            href: `/search/hashtag/${node.attrs.id}`,
+            href: `/search/hashtag/${encodeURI(node.attrs.id)}`,
             'data-hashtag-id': node.attrs.id,
             target: '_blank',
           },
diff --git a/webapp/pages/admin/tags.vue b/webapp/pages/admin/tags.vue
index 9ede1d502..e068d68fa 100644
--- a/webapp/pages/admin/tags.vue
+++ b/webapp/pages/admin/tags.vue
@@ -5,7 +5,7 @@
         {{ scope.index + 1 }}.
       </template>
       <template slot="id" slot-scope="scope">
-        <nuxt-link :to="{ path: '/', query: { hashtag: scope.row.id } }">
+        <nuxt-link :to="{ path: '/', query: { hashtag: encodeURI(scope.row.id) } }">
           <b>#{{ scope.row.id | truncate(20) }}</b>
         </nuxt-link>
       </template>
diff --git a/webapp/pages/index.vue b/webapp/pages/index.vue
index 31e07f382..99668f67a 100644
--- a/webapp/pages/index.vue
+++ b/webapp/pages/index.vue
@@ -75,7 +75,8 @@ export default {
     MasonryGridItem,
   },
   data() {
-    const { hashtag = null } = this.$route.query
+    let { hashtag = null } = this.$route.query
+    hashtag = decodeURI(hashtag)
     return {
       posts: [],
       hasMore: true,
diff --git a/webapp/pages/search/hashtag/_id.vue b/webapp/pages/search/hashtag/_id.vue
index d180b4e4f..f501b67bc 100644
--- a/webapp/pages/search/hashtag/_id.vue
+++ b/webapp/pages/search/hashtag/_id.vue
@@ -5,8 +5,9 @@
 <script>
 export default {
   mounted() {
-    const { id: hashtag } = this.$route.params
-    this.$router.push({ path: '/', query: { hashtag } })
+    let { id: hashtag } = this.$route.params
+    // 'hashtag' seems automatically 'decodeURI' on macOS Firefox. Don't know if this is always the case.
+    this.$router.push({ path: '/', query: { hashtag: encodeURI(hashtag) } })
   },
 }
 </script>

From ee8ce5a153a7aad290c30edb06e67766216620a9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Wolfgang=20Hu=C3=9F?= <wolle.huss@pjannto.com>
Date: Fri, 13 Sep 2019 13:07:12 +0200
Subject: [PATCH 02/22] Comment clearification

---
 webapp/pages/search/hashtag/_id.vue | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/webapp/pages/search/hashtag/_id.vue b/webapp/pages/search/hashtag/_id.vue
index f501b67bc..38364d86f 100644
--- a/webapp/pages/search/hashtag/_id.vue
+++ b/webapp/pages/search/hashtag/_id.vue
@@ -6,7 +6,7 @@
 export default {
   mounted() {
     let { id: hashtag } = this.$route.params
-    // 'hashtag' seems automatically 'decodeURI' on macOS Firefox. Don't know if this is always the case.
+    // 'hashtag' seems automatically to be 'decodeURI' (on macOS Firefox). Don't know if this is always the case.
     this.$router.push({ path: '/', query: { hashtag: encodeURI(hashtag) } })
   },
 }

From 0157cc3700f42b8c2885502c5ea396f5b6256435 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Wolfgang=20Hu=C3=9F?= <wolle.huss@pjannto.com>
Date: Fri, 13 Sep 2019 13:58:59 +0200
Subject: [PATCH 03/22] Refactor routing of of hashtag links

---
 webapp/middleware/searchHashtag.js  | 16 ++++++++++++++++
 webapp/nuxt.config.js               |  2 +-
 webapp/pages/search/hashtag/_id.vue | 13 -------------
 3 files changed, 17 insertions(+), 14 deletions(-)
 create mode 100644 webapp/middleware/searchHashtag.js
 delete mode 100644 webapp/pages/search/hashtag/_id.vue

diff --git a/webapp/middleware/searchHashtag.js b/webapp/middleware/searchHashtag.js
new file mode 100644
index 000000000..a1bdda7e9
--- /dev/null
+++ b/webapp/middleware/searchHashtag.js
@@ -0,0 +1,16 @@
+import { exec, build } from 'xregexp/xregexp-all.js'
+
+export default async ({ store, env, route, redirect }) => {
+  let publicPages = env.publicPages
+  // only affect non public pages
+  if (publicPages.indexOf(route.name) >= 0) {
+    return true
+  }
+
+  const regX = build('^/search/hashtag/((\\pL+[\\pL0-9]*)|([0-9]+\\pL+[\\pL0-9]*))$')
+  const matchHashtag = exec(decodeURI(route.name), regX)
+
+  if (!matchHashtag) return true
+
+  return redirect(`/?hashtag=${encodeURI(matchHashtag[0])}`)
+}
diff --git a/webapp/nuxt.config.js b/webapp/nuxt.config.js
index 858294f37..5942d34e0 100644
--- a/webapp/nuxt.config.js
+++ b/webapp/nuxt.config.js
@@ -123,7 +123,7 @@ export default {
   ],
 
   router: {
-    middleware: ['authenticated', 'termsAndConditions'],
+    middleware: ['authenticated', 'termsAndConditions', 'searchHashtag'],
     linkActiveClass: 'router-link-active',
     linkExactActiveClass: 'router-link-exact-active',
     scrollBehavior: (to, _from, savedPosition) => {
diff --git a/webapp/pages/search/hashtag/_id.vue b/webapp/pages/search/hashtag/_id.vue
deleted file mode 100644
index 38364d86f..000000000
--- a/webapp/pages/search/hashtag/_id.vue
+++ /dev/null
@@ -1,13 +0,0 @@
-<template>
-  <div></div>
-</template>
-
-<script>
-export default {
-  mounted() {
-    let { id: hashtag } = this.$route.params
-    // 'hashtag' seems automatically to be 'decodeURI' (on macOS Firefox). Don't know if this is always the case.
-    this.$router.push({ path: '/', query: { hashtag: encodeURI(hashtag) } })
-  },
-}
-</script>

From 92df820323453ad6885fc623f70fb76bd4bcd730 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Wolfgang=20Hu=C3=9F?= <wolle.huss@pjannto.com>
Date: Fri, 13 Sep 2019 15:09:33 +0200
Subject: [PATCH 04/22] Rename `/admin/tags.vue` to `/admin/hashtags.vue`

---
 webapp/locales/de.json                        |  2 +-
 webapp/locales/en.json                        |  2 +-
 webapp/pages/admin.vue                        |  4 ++--
 webapp/pages/admin/{tags.vue => hashtags.vue} | 10 +++++-----
 4 files changed, 9 insertions(+), 9 deletions(-)
 rename webapp/pages/admin/{tags.vue => hashtags.vue} (79%)

diff --git a/webapp/locales/de.json b/webapp/locales/de.json
index 381e493f8..567febbeb 100644
--- a/webapp/locales/de.json
+++ b/webapp/locales/de.json
@@ -269,7 +269,7 @@
       "categoryName": "Name",
       "postCount": "Beiträge"
     },
-    "tags": {
+    "hashtags": {
       "name": "Hashtags",
       "number": "Nr.",
       "nameOfHashtag": "Name",
diff --git a/webapp/locales/en.json b/webapp/locales/en.json
index 66ab4a47b..2cb22e690 100644
--- a/webapp/locales/en.json
+++ b/webapp/locales/en.json
@@ -270,7 +270,7 @@
       "categoryName": "Name",
       "postCount": "Posts"
     },
-    "tags": {
+    "hashtags": {
       "name": "Hashtags",
       "number": "No.",
       "nameOfHashtag": "Name",
diff --git a/webapp/pages/admin.vue b/webapp/pages/admin.vue
index 4d498dc9b..7852673b0 100644
--- a/webapp/pages/admin.vue
+++ b/webapp/pages/admin.vue
@@ -48,8 +48,8 @@ export default {
           path: `/admin/categories`,
         },
         {
-          name: this.$t('admin.tags.name'),
-          path: `/admin/tags`,
+          name: this.$t('admin.hashtags.name'),
+          path: `/admin/hashtags`,
         },
         {
           name: this.$t('admin.invites.name'),
diff --git a/webapp/pages/admin/tags.vue b/webapp/pages/admin/hashtags.vue
similarity index 79%
rename from webapp/pages/admin/tags.vue
rename to webapp/pages/admin/hashtags.vue
index e068d68fa..76306873a 100644
--- a/webapp/pages/admin/tags.vue
+++ b/webapp/pages/admin/hashtags.vue
@@ -1,5 +1,5 @@
 <template>
-  <ds-card :header="$t('admin.tags.name')">
+  <ds-card :header="$t('admin.hashtags.name')">
     <ds-table :data="Tag" :fields="fields" condensed>
       <template slot="index" slot-scope="scope">
         {{ scope.index + 1 }}.
@@ -25,14 +25,14 @@ export default {
   computed: {
     fields() {
       return {
-        index: this.$t('admin.tags.number'),
-        id: this.$t('admin.tags.name'),
+        index: this.$t('admin.hashtags.number'),
+        id: this.$t('admin.hashtags.name'),
         taggedCountUnique: {
-          label: this.$t('admin.tags.tagCountUnique'),
+          label: this.$t('admin.hashtags.tagCountUnique'),
           align: 'right',
         },
         taggedCount: {
-          label: this.$t('admin.tags.tagCount'),
+          label: this.$t('admin.hashtags.tagCount'),
           align: 'right',
         },
       }

From 7759e54fd45666ff6214ee711c704def4aca3ff6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Wolfgang=20Hu=C3=9F?= <wolle.huss@pjannto.com>
Date: Fri, 13 Sep 2019 15:31:15 +0200
Subject: [PATCH 05/22] Correct hashtag link routing

---
 webapp/middleware/searchHashtag.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/webapp/middleware/searchHashtag.js b/webapp/middleware/searchHashtag.js
index a1bdda7e9..ed2b62de0 100644
--- a/webapp/middleware/searchHashtag.js
+++ b/webapp/middleware/searchHashtag.js
@@ -8,9 +8,9 @@ export default async ({ store, env, route, redirect }) => {
   }
 
   const regX = build('^/search/hashtag/((\\pL+[\\pL0-9]*)|([0-9]+\\pL+[\\pL0-9]*))$')
-  const matchHashtag = exec(decodeURI(route.name), regX)
+  const matchHashtag = route.fullPath ? exec(decodeURI(route.fullPath), regX) : null
 
   if (!matchHashtag) return true
 
-  return redirect(`/?hashtag=${encodeURI(matchHashtag[0])}`)
+  return redirect(`/?hashtag=${encodeURI(matchHashtag[1])}`)
 }

From 2ad4bb34766f681b39c2642b86e2c7ff100ce53b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Wolfgang=20Hu=C3=9F?= <wolle.huss@pjannto.com>
Date: Fri, 13 Sep 2019 15:37:43 +0200
Subject: [PATCH 06/22] Fix decodeURI on indexpage

---
 webapp/pages/index.vue | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/webapp/pages/index.vue b/webapp/pages/index.vue
index 99668f67a..f1d793f1e 100644
--- a/webapp/pages/index.vue
+++ b/webapp/pages/index.vue
@@ -76,7 +76,9 @@ export default {
   },
   data() {
     let { hashtag = null } = this.$route.query
-    hashtag = decodeURI(hashtag)
+    if (hashtag) {
+      hashtag = decodeURI(hashtag)
+    }
     return {
       posts: [],
       hasMore: true,

From 15816dd97bf8b6feecb3b2000d8580dc5ebea65e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Wolfgang=20Hu=C3=9F?= <wolle.huss@pjannto.com>
Date: Mon, 16 Sep 2019 16:16:09 +0200
Subject: [PATCH 07/22] Update
 backend/src/middleware/hashtags/hashtagsMiddleware.spec.js
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: Robert Schäfer <git@roschaefer.de>
---
 backend/src/middleware/hashtags/hashtagsMiddleware.spec.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/src/middleware/hashtags/hashtagsMiddleware.spec.js b/backend/src/middleware/hashtags/hashtagsMiddleware.spec.js
index 16cd96eb7..710382949 100644
--- a/backend/src/middleware/hashtags/hashtagsMiddleware.spec.js
+++ b/backend/src/middleware/hashtags/hashtagsMiddleware.spec.js
@@ -129,7 +129,7 @@ describe('hashtags', () => {
         )
       })
 
-      describe('afterwards update the Post by removing a hashtag, leaving a hashtag and add a hashtag', () => {
+      describe('updates the Post by removing, keeping and adding one hashtag respectively', () => {
         // The already existing hashtag has no class at this point.
         const postContent =
           '<p>Hey Dude, <a class="hashtag" href="/search/hashtag/Elections">#Elections</a> should work equal for everybody!? That seems to be the only way to have equal <a href="/search/hashtag/Liberty">#Liberty</a> for everyone.</p>'

From 431de3319f26ac4c58b66187aa650ab25f5291e0 Mon Sep 17 00:00:00 2001
From: roschaefer <git@roschaefer.de>
Date: Mon, 16 Sep 2019 22:57:57 +0200
Subject: [PATCH 08/22] Make `data-hashtag-id` authoritive for #links

This adds consistency: The mention links with `@` was implemented
that way already. Instead of parsing the URL, we add some redundancy and
add another attribute: data-hashtag-id

So, what characters are valid for html attributes?
Read: https://stackoverflow.com/questions/925994/what-characters-are-allowed-in-an-html-attribute-name

Thanks to @Tirokk, who added some validations on the hahstag ids, I
think we are all set. If you try to write a hashtag with a `"` double
quotation mark for example, it gets automatically replaced with a valid
hashtag. If someone wants to send us invalid hashtag ids to the backend
directly, the regex there would filter it out.
---
 .../middleware/hashtags/extractHashtags.js    | 10 +--
 .../hashtags/extractHashtags.spec.js          | 89 ++++++++++++++-----
 .../hashtags/hashtagsMiddleware.spec.js       | 46 +++++++++-
 backend/src/seed/seed-db.js                   |  4 +-
 webapp/components/Editor/nodes/Hashtag.js     |  6 +-
 webapp/middleware/searchHashtag.js            | 16 ----
 webapp/nuxt.config.js                         |  2 +-
 webapp/pages/index.vue                        |  5 +-
 8 files changed, 125 insertions(+), 53 deletions(-)
 delete mode 100644 webapp/middleware/searchHashtag.js

diff --git a/backend/src/middleware/hashtags/extractHashtags.js b/backend/src/middleware/hashtags/extractHashtags.js
index 13f29475e..ee90102dc 100644
--- a/backend/src/middleware/hashtags/extractHashtags.js
+++ b/backend/src/middleware/hashtags/extractHashtags.js
@@ -6,21 +6,21 @@ import { exec, build } from 'xregexp/xregexp-all.js'
 //    0. Search for whole string.
 //    1. Hashtag has only all unicode characters and '0-9'.
 //    2. If it starts with a digit '0-9' than a unicode character has to follow.
-const regX = build('^/search/hashtag/((\\pL+[\\pL0-9]*)|([0-9]+\\pL+[\\pL0-9]*))$')
+const regX = build('^((\\pL+[\\pL0-9]*)|([0-9]+\\pL+[\\pL0-9]*))$')
 
 export default function(content) {
   if (!content) return []
   const $ = cheerio.load(content)
   // We can not search for class '.hashtag', because the classes are removed at the 'xss' middleware.
   //   But we have to know, which Hashtags are removed from the content as well, so we search for the 'a' html-tag.
-  const urls = $('a')
+  const ids = $('a[data-hashtag-id]')
     .map((_, el) => {
-      return $(el).attr('href')
+      return $(el).attr('data-hashtag-id')
     })
     .get()
   const hashtags = []
-  urls.forEach(url => {
-    const match = exec(decodeURI(url), regX)
+  ids.forEach(id => {
+    const match = exec(id, regX)
     if (match != null) {
       hashtags.push(match[1])
     }
diff --git a/backend/src/middleware/hashtags/extractHashtags.spec.js b/backend/src/middleware/hashtags/extractHashtags.spec.js
index 0881e33a3..0a129682a 100644
--- a/backend/src/middleware/hashtags/extractHashtags.spec.js
+++ b/backend/src/middleware/hashtags/extractHashtags.spec.js
@@ -8,9 +8,24 @@ describe('extractHashtags', () => {
   })
 
   describe('searches through links', () => {
-    it('finds links with and without ".hashtag" class and extracts Hashtag names', () => {
-      const content =
-        '<p><a class="hashtag" href="/search/hashtag/Elections">#Elections</a><a href="/search/hashtag/Democracy">#Democracy</a></p>'
+    it('not `class="hashtag"` but `data-hashtag-id="something"` makes a link a hashtag link', () => {
+      const content = `
+        <p>
+          <a
+            class="hashtag"
+            data-hashtag-id="Elections"
+            href="/?hashtag=Elections"
+          >
+            #Elections
+          </a>
+          <a
+            data-hashtag-id="Democracy"
+            href="/?hashtag=Democracy"
+          >
+            #Democracy
+          </a>
+        </p>
+      `
       expect(extractHashtags(content)).toEqual(['Elections', 'Democracy'])
     })
 
@@ -20,23 +35,57 @@ describe('extractHashtags', () => {
       expect(extractHashtags(content)).toEqual([])
     })
 
-    describe('handles links', () => {
-      it('ignores links with domains', () => {
-        const content =
-          '<p><a class="hashtag" href="http://localhost:3000/search/hashtag/Elections">#Elections</a><a href="/search/hashtag/Democracy">#Democracy</a></p>'
-        expect(extractHashtags(content)).toEqual(['Democracy'])
-      })
-
-      it('ignores Hashtag links with not allowed character combinations and handles `encodeURI` URLs', () => {
-        // Allowed are all unicode letters '\pL' and all digits '0-9'. There haveto be at least one letter in it.
-        const content =
-          '<p>Something inspirational about <a href="/search/hashtag/AbcDefXyz0123456789!*(),2" class="hashtag" target="_blank">#AbcDefXyz0123456789!*(),2</a>, <a href="/search/hashtag/0123456789" class="hashtag" target="_blank">#0123456789</a>, <a href="/search/hashtag/0123456789a" class="hashtag" target="_blank">#0123456789a</a>, <a href="/search/hashtag/AbcDefXyz0123456789" target="_blank">#AbcDefXyz0123456789</a>, and <a href="/search/hashtag/%C4%A7%CF%80%CE%B1%CE%BB" target="_blank">#ħπαλ</a>.</p>'
-        expect(extractHashtags(content).sort()).toEqual([
-          '0123456789a',
-          'AbcDefXyz0123456789',
-          'ħπαλ',
-        ])
-      })
+    it('ignores hashtag links with not allowed character combinations', () => {
+      // Allowed are all unicode letters '\pL' and all digits '0-9'. There haveto be at least one letter in it.
+      const content = `
+      <p>
+        Something inspirational about
+        <a
+          href="/?hashtag=AbcDefXyz0123456789!*(),2"
+          data-hashtag-id="AbcDefXyz0123456789!*(),2"
+          class="hashtag"
+          target="_blank"
+        >
+          #AbcDefXyz0123456789!*(),2
+        </a>,
+        <a
+          href="/?hashtag=0123456789"
+          data-hashtag-id="0123456789"
+          class="hashtag"
+          target="_blank"
+        >
+          #0123456789
+        </a>,
+        <a href="?hashtag=0123456789a"
+          data-hashtag-id="0123456789a"
+          class="hashtag"
+          target="_blank"
+        >
+          #0123456789a
+        </a>,
+        <a
+          href="/?hashtag=AbcDefXyz0123456789"
+          data-hashtag-id="AbcDefXyz0123456789"
+          class="hashtag"
+          target="_blank"
+        >
+          #AbcDefXyz0123456789
+        </a>, and
+        <a
+          href="/?hashtag=%C4%A7%CF%80%CE%B1%CE%BB"
+          data-hashtag-id="ħπαλ"
+          class="hashtag"
+          target="_blank"
+        >
+          #ħπαλ
+        </a>.
+      </p>
+      `
+      expect(extractHashtags(content).sort()).toEqual([
+        '0123456789a',
+        'AbcDefXyz0123456789',
+        'ħπαλ',
+      ])
     })
 
     describe('does not crash if', () => {
diff --git a/backend/src/middleware/hashtags/hashtagsMiddleware.spec.js b/backend/src/middleware/hashtags/hashtagsMiddleware.spec.js
index 710382949..89f1bdd86 100644
--- a/backend/src/middleware/hashtags/hashtagsMiddleware.spec.js
+++ b/backend/src/middleware/hashtags/hashtagsMiddleware.spec.js
@@ -69,8 +69,27 @@ afterEach(async () => {
 describe('hashtags', () => {
   const id = 'p135'
   const title = 'Two Hashtags'
-  const postContent =
-    '<p>Hey Dude, <a class="hashtag" href="/search/hashtag/Democracy">#Democracy</a> should work equal for everybody!? That seems to be the only way to have equal <a class="hashtag" href="/search/hashtag/Liberty">#Liberty</a> for everyone.</p>'
+  const postContent = `
+    <p>
+      Hey Dude,
+      <a
+        class="hashtag"
+        data-hashtag-id="Democracy"
+        href="/?hashtag=Democracy">
+          #Democracy
+      </a>
+      should work equal for everybody!? That seems to be the only way to have
+      equal
+      <a
+        class="hashtag"
+        data-hashtag-id="Liberty"
+        href="/?hashtag=Liberty"
+      >
+        #Liberty
+      </a>
+      for everyone.
+    </p>
+  `
   const postWithHastagsQuery = gql`
     query($id: ID) {
       Post(id: $id) {
@@ -131,8 +150,27 @@ describe('hashtags', () => {
 
       describe('updates the Post by removing, keeping and adding one hashtag respectively', () => {
         // The already existing hashtag has no class at this point.
-        const postContent =
-          '<p>Hey Dude, <a class="hashtag" href="/search/hashtag/Elections">#Elections</a> should work equal for everybody!? That seems to be the only way to have equal <a href="/search/hashtag/Liberty">#Liberty</a> for everyone.</p>'
+        const postContent = `
+          <p>
+            Hey Dude,
+            <a
+              class="hashtag"
+              data-hashtag-id="Elections"
+              href="?hashtag=Elections"
+            >
+              #Elections
+            </a>
+            should work equal for everybody!? That seems to be the only way to
+            have equal
+            <a
+              data-hashtag-id="Liberty"
+              href="?hashtag=Liberty"
+            >
+              #Liberty
+            </a>
+            for everyone.
+          </p>
+        `
 
         it('only one previous Hashtag and the new Hashtag exists', async () => {
           await mutate({
diff --git a/backend/src/seed/seed-db.js b/backend/src/seed/seed-db.js
index 48a739529..17a20a87d 100644
--- a/backend/src/seed/seed-db.js
+++ b/backend/src/seed/seed-db.js
@@ -413,9 +413,9 @@ import { gql } from '../jest/helpers'
     const mention2 =
       'Hey <a class="mention" data-mention-id="u3" href="/profile/u3">@jenny-rostock</a>, here is another notification for you!'
     const hashtag1 =
-      'See <a class="hashtag" href="/search/hashtag/NaturphilosophieYoga">#NaturphilosophieYoga</a> can really help you!'
+      'See <a class="hashtag" data-hashtag-id="NaturphilosophieYoga" href="/?hashtag=NaturphilosophieYoga">#NaturphilosophieYoga</a> can really help you!'
     const hashtagAndMention1 =
-      'The new physics of <a class="hashtag" href="/search/hashtag/QuantenFlussTheorie">#QuantenFlussTheorie</a> can explain <a class="hashtag" href="/search/hashtag/QuantumGravity">#QuantumGravity</a>! <a class="mention" data-mention-id="u1" href="/profile/u1">@peter-lustig</a> got that already. ;-)'
+      'The new physics of <a class="hashtag" data-hashtag-id="QuantenFlussTheorie" href="/?hashtag=QuantenFlussTheorie">#QuantenFlussTheorie</a> can explain <a class="hashtag" data-hashtag-id="QuantumGravity" href="/?hashtag=QuantumGravity">#QuantumGravity</a>! <a class="mention" data-mention-id="u1" href="/profile/u1">@peter-lustig</a> got that already. ;-)'
     const createPostMutation = gql`
       mutation($id: ID, $title: String!, $content: String!, $categoryIds: [ID]) {
         CreatePost(id: $id, title: $title, content: $content, categoryIds: $categoryIds) {
diff --git a/webapp/components/Editor/nodes/Hashtag.js b/webapp/components/Editor/nodes/Hashtag.js
index bf1530ceb..495a1532f 100644
--- a/webapp/components/Editor/nodes/Hashtag.js
+++ b/webapp/components/Editor/nodes/Hashtag.js
@@ -21,11 +21,15 @@ export default class Hashtag extends TipTapMention {
     return {
       ...super.schema,
       toDOM: node => {
+        // use a dummy domain because URL cannot handle relative urls
+        const url = new URL('/', 'http://example.org')
+        url.searchParams.append('hashtag', node.attrs.id)
+
         return [
           'a',
           {
             class: this.options.mentionClass,
-            href: `/search/hashtag/${encodeURI(node.attrs.id)}`,
+            href: `/${url.search}`,
             'data-hashtag-id': node.attrs.id,
             target: '_blank',
           },
diff --git a/webapp/middleware/searchHashtag.js b/webapp/middleware/searchHashtag.js
deleted file mode 100644
index ed2b62de0..000000000
--- a/webapp/middleware/searchHashtag.js
+++ /dev/null
@@ -1,16 +0,0 @@
-import { exec, build } from 'xregexp/xregexp-all.js'
-
-export default async ({ store, env, route, redirect }) => {
-  let publicPages = env.publicPages
-  // only affect non public pages
-  if (publicPages.indexOf(route.name) >= 0) {
-    return true
-  }
-
-  const regX = build('^/search/hashtag/((\\pL+[\\pL0-9]*)|([0-9]+\\pL+[\\pL0-9]*))$')
-  const matchHashtag = route.fullPath ? exec(decodeURI(route.fullPath), regX) : null
-
-  if (!matchHashtag) return true
-
-  return redirect(`/?hashtag=${encodeURI(matchHashtag[1])}`)
-}
diff --git a/webapp/nuxt.config.js b/webapp/nuxt.config.js
index 5942d34e0..858294f37 100644
--- a/webapp/nuxt.config.js
+++ b/webapp/nuxt.config.js
@@ -123,7 +123,7 @@ export default {
   ],
 
   router: {
-    middleware: ['authenticated', 'termsAndConditions', 'searchHashtag'],
+    middleware: ['authenticated', 'termsAndConditions'],
     linkActiveClass: 'router-link-active',
     linkExactActiveClass: 'router-link-exact-active',
     scrollBehavior: (to, _from, savedPosition) => {
diff --git a/webapp/pages/index.vue b/webapp/pages/index.vue
index f1d793f1e..31e07f382 100644
--- a/webapp/pages/index.vue
+++ b/webapp/pages/index.vue
@@ -75,10 +75,7 @@ export default {
     MasonryGridItem,
   },
   data() {
-    let { hashtag = null } = this.$route.query
-    if (hashtag) {
-      hashtag = decodeURI(hashtag)
-    }
+    const { hashtag = null } = this.$route.query
     return {
       posts: [],
       hasMore: true,

From 01e4cf83e6432a9307ce19a0f09317842987fef6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=A4fer?= <git@roschaefer.de>
Date: Tue, 17 Sep 2019 02:28:53 +0200
Subject: [PATCH 09/22] Add CodeTriage helpers badge

---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index 1e305b201..b2f42c8b9 100644
--- a/README.md
+++ b/README.md
@@ -4,6 +4,7 @@
 [![Codecov Coverage](https://img.shields.io/codecov/c/github/Human-Connection/Human-Connection/master.svg?style=flat-square)](https://codecov.io/gh/Human-Connection/Human-Connection/)
 [![MIT License](https://img.shields.io/badge/license-MIT-green.svg)](https://github.com/Human-Connection/Nitro-Backend/blob/backend/LICENSE.md)
 [![Discord Channel](https://img.shields.io/discord/489522408076738561.svg)](https://discordapp.com/invite/DFSjPaX)
+[![Open Source Helpers](https://www.codetriage.com/human-connection/human-connection/badges/users.svg)](https://www.codetriage.com/human-connection/human-connection)
 
 Human Connection is a nonprofit social, action and knowledge network that connects information to action and promotes positive local and global change in all areas of life.
 

From a8aee791df1ba539bb3efe55e7d0d26fbfb983ac Mon Sep 17 00:00:00 2001
From: "dependabot-preview[bot]"
 <27856297+dependabot-preview[bot]@users.noreply.github.com>
Date: Tue, 17 Sep 2019 04:21:41 +0000
Subject: [PATCH 10/22] Bump metascraper-audio from 5.6.6 to 5.7.4 in /backend

Bumps [metascraper-audio](https://github.com/microlinkhq/metascraper) from 5.6.6 to 5.7.4.
- [Release notes](https://github.com/microlinkhq/metascraper/releases)
- [Changelog](https://github.com/microlinkhq/metascraper/blob/master/CHANGELOG.md)
- [Commits](https://github.com/microlinkhq/metascraper/compare/v5.6.6...v5.7.4)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
---
 backend/package.json |  2 +-
 backend/yarn.lock    | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/backend/package.json b/backend/package.json
index 3806f9b8f..8fc65e36c 100644
--- a/backend/package.json
+++ b/backend/package.json
@@ -73,7 +73,7 @@
     "lodash": "~4.17.14",
     "merge-graphql-schemas": "^1.7.0",
     "metascraper": "^4.10.3",
-    "metascraper-audio": "^5.6.5",
+    "metascraper-audio": "^5.7.4",
     "metascraper-author": "^5.6.5",
     "metascraper-clearbit-logo": "^5.3.0",
     "metascraper-date": "^5.7.4",
diff --git a/backend/yarn.lock b/backend/yarn.lock
index ff33ff04d..a16c33e88 100644
--- a/backend/yarn.lock
+++ b/backend/yarn.lock
@@ -5859,12 +5859,12 @@ merge-stream@^2.0.0:
   resolved "https://registry.yarnpkg.com/merge-stream/-/merge-stream-2.0.0.tgz#52823629a14dd00c9770fb6ad47dc6310f2c1f60"
   integrity sha512-abv/qOcuPfk3URPfDzmZU1LKmuw8kT+0nIHvKrKgFrwifol/doWcdA4ZqsWQ8ENrFKkd67Mfpo/LovbIUsbt3w==
 
-metascraper-audio@^5.6.5:
-  version "5.6.6"
-  resolved "https://registry.yarnpkg.com/metascraper-audio/-/metascraper-audio-5.6.6.tgz#1de5673e18fd9154fb0ead93a184d228514eaa26"
-  integrity sha512-wlpfJkZ2Bgc25Kf+XMFVSh9EwWKyJVUTfJ4nIkQ9XCYoUpEC2uwN2aHfF1TCZehCJKLioU6++zeuXEaq5APk9g==
+metascraper-audio@^5.7.4:
+  version "5.7.4"
+  resolved "https://registry.yarnpkg.com/metascraper-audio/-/metascraper-audio-5.7.4.tgz#a476ed484b2642060208243843dc7ef5c9eb7a3e"
+  integrity sha512-5M+C+tirJlR71PXymAkBnEXu8KG0+fkX3G0Dm2UO6jDEchIo+DhW2aGSgB8w9kQN80Ni8jaLjNH3+Mtwbsbbkw==
   dependencies:
-    "@metascraper/helpers" "^5.6.6"
+    "@metascraper/helpers" "^5.7.4"
 
 metascraper-author@^5.6.5:
   version "5.6.6"

From a189b388d9127063e36e05f2ca5e72147c5ac1d3 Mon Sep 17 00:00:00 2001
From: "dependabot-preview[bot]"
 <27856297+dependabot-preview[bot]@users.noreply.github.com>
Date: Tue, 17 Sep 2019 04:22:13 +0000
Subject: [PATCH 11/22] Bump date-fns from 2.1.0 to 2.2.1 in /backend

Bumps [date-fns](https://github.com/date-fns/date-fns) from 2.1.0 to 2.2.1.
- [Release notes](https://github.com/date-fns/date-fns/releases)
- [Changelog](https://github.com/date-fns/date-fns/blob/master/CHANGELOG.md)
- [Commits](https://github.com/date-fns/date-fns/compare/v2.1.0...v2.2.1)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
---
 backend/package.json | 2 +-
 backend/yarn.lock    | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/backend/package.json b/backend/package.json
index 3806f9b8f..1e654e848 100644
--- a/backend/package.json
+++ b/backend/package.json
@@ -55,7 +55,7 @@
     "cheerio": "~1.0.0-rc.3",
     "cors": "~2.8.5",
     "cross-env": "~5.2.1",
-    "date-fns": "2.1.0",
+    "date-fns": "2.2.1",
     "debug": "~4.1.1",
     "dotenv": "~8.1.0",
     "express": "^4.17.1",
diff --git a/backend/yarn.lock b/backend/yarn.lock
index ff33ff04d..784c652ab 100644
--- a/backend/yarn.lock
+++ b/backend/yarn.lock
@@ -2859,10 +2859,10 @@ data-urls@^1.0.0:
     whatwg-mimetype "^2.2.0"
     whatwg-url "^7.0.0"
 
-date-fns@2.1.0:
-  version "2.1.0"
-  resolved "https://registry.yarnpkg.com/date-fns/-/date-fns-2.1.0.tgz#0d7e806c3cefe14a943532dbf968995ccfd46bd9"
-  integrity sha512-eKeLk3sLCnxB/0PN4t1+zqDtSs4jb4mXRSTZ2okmx/myfWyDqeO4r5nnmA5LClJiCwpuTMeK2v5UQPuE4uMaxA==
+date-fns@2.2.1:
+  version "2.2.1"
+  resolved "https://registry.yarnpkg.com/date-fns/-/date-fns-2.2.1.tgz#b3f79cf56760af106050c686f4c72586a3383ee9"
+  integrity sha512-4V1i5CnTinjBvJpXTq7sDHD4NY6JPcl15112IeSNNLUWQOQ+kIuCvRGOFZMQZNvkadw8F9QTyZxz59rIRU6K+w==
 
 debug@2.6.9, debug@^2.2.0, debug@^2.3.3, debug@^2.6.8, debug@^2.6.9:
   version "2.6.9"

From 9f4d1be37e160c29b09eed03cb72ee0cd82e2456 Mon Sep 17 00:00:00 2001
From: "dependabot-preview[bot]"
 <27856297+dependabot-preview[bot]@users.noreply.github.com>
Date: Tue, 17 Sep 2019 04:22:52 +0000
Subject: [PATCH 12/22] Bump metascraper-publisher from 5.6.6 to 5.7.4 in
 /backend

Bumps [metascraper-publisher](https://github.com/microlinkhq/metascraper) from 5.6.6 to 5.7.4.
- [Release notes](https://github.com/microlinkhq/metascraper/releases)
- [Changelog](https://github.com/microlinkhq/metascraper/blob/master/CHANGELOG.md)
- [Commits](https://github.com/microlinkhq/metascraper/compare/v5.6.6...v5.7.4)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
---
 backend/package.json |  2 +-
 backend/yarn.lock    | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/backend/package.json b/backend/package.json
index 3806f9b8f..7a334b76c 100644
--- a/backend/package.json
+++ b/backend/package.json
@@ -82,7 +82,7 @@
     "metascraper-lang": "^5.7.4",
     "metascraper-lang-detector": "^4.8.5",
     "metascraper-logo": "^5.7.4",
-    "metascraper-publisher": "^5.6.5",
+    "metascraper-publisher": "^5.7.4",
     "metascraper-soundcloud": "^5.7.4",
     "metascraper-title": "^5.7.0",
     "metascraper-url": "^5.7.4",
diff --git a/backend/yarn.lock b/backend/yarn.lock
index ff33ff04d..42dae932a 100644
--- a/backend/yarn.lock
+++ b/backend/yarn.lock
@@ -5925,12 +5925,12 @@ metascraper-logo@^5.7.4:
   dependencies:
     "@metascraper/helpers" "^5.7.4"
 
-metascraper-publisher@^5.6.5:
-  version "5.6.6"
-  resolved "https://registry.yarnpkg.com/metascraper-publisher/-/metascraper-publisher-5.6.6.tgz#855515689e7d16870333e44af49ccb954bec45b3"
-  integrity sha512-micUEltrytzwKb1iJjnclJ/l5970xs0PWwoY/RFcIDviBVQ/EQNCW+DieK9P6gFJq3dSLPTJ9cv2QPHkDj+ORw==
+metascraper-publisher@^5.7.4:
+  version "5.7.4"
+  resolved "https://registry.yarnpkg.com/metascraper-publisher/-/metascraper-publisher-5.7.4.tgz#5f69ad838636ef1fff015c45a66f683fcc2d3d37"
+  integrity sha512-l2FI63BC7cSQCvPD5OMKY4yRYpcxhhrrpsIrC0sIViKs6XrYRphb745NcNgFvKgi/PO0yw0bIEyhAroACaJKOA==
   dependencies:
-    "@metascraper/helpers" "^5.6.6"
+    "@metascraper/helpers" "^5.7.4"
 
 metascraper-soundcloud@^5.7.4:
   version "5.7.4"

From e89ae1f8d5bd13edca26e1822bcb653ee77fda2a Mon Sep 17 00:00:00 2001
From: "dependabot-preview[bot]"
 <27856297+dependabot-preview[bot]@users.noreply.github.com>
Date: Tue, 17 Sep 2019 04:22:55 +0000
Subject: [PATCH 13/22] Bump @nuxtjs/apollo from 4.0.0-rc12 to 4.0.0-rc13 in
 /webapp

Bumps [@nuxtjs/apollo](https://github.com/nuxt-community/apollo-module) from 4.0.0-rc12 to 4.0.0-rc13.
- [Release notes](https://github.com/nuxt-community/apollo-module/releases)
- [Commits](https://github.com/nuxt-community/apollo-module/compare/v4.0.0-rc.12...v4.0.0-rc.13)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
---
 webapp/package.json |  2 +-
 webapp/yarn.lock    | 18 +++++++++---------
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/webapp/package.json b/webapp/package.json
index 21a6ec866..386fdfe61 100644
--- a/webapp/package.json
+++ b/webapp/package.json
@@ -52,7 +52,7 @@
   },
   "dependencies": {
     "@human-connection/styleguide": "0.5.21",
-    "@nuxtjs/apollo": "^4.0.0-rc12",
+    "@nuxtjs/apollo": "^4.0.0-rc13",
     "@nuxtjs/axios": "~5.6.0",
     "@nuxtjs/dotenv": "~1.4.1",
     "@nuxtjs/sentry": "^3.0.0",
diff --git a/webapp/yarn.lock b/webapp/yarn.lock
index b6ed88d73..d4a9592ae 100644
--- a/webapp/yarn.lock
+++ b/webapp/yarn.lock
@@ -1458,14 +1458,14 @@
     webpack-node-externals "^1.7.2"
     webpackbar "^4.0.0"
 
-"@nuxtjs/apollo@^4.0.0-rc12":
-  version "4.0.0-rc12"
-  resolved "https://registry.yarnpkg.com/@nuxtjs/apollo/-/apollo-4.0.0-rc12.tgz#4008c31a76b689b513292b39b9e4a6a04ef12edf"
-  integrity sha512-qHlDsvJoWYJAGt7ucWcFgPpFG89STyby8OoX07+mYCRV52tVaCdrLO95dFZx7k705hSYPzU8gBsMvJte3lEjjQ==
+"@nuxtjs/apollo@^4.0.0-rc13":
+  version "4.0.0-rc13"
+  resolved "https://registry.yarnpkg.com/@nuxtjs/apollo/-/apollo-4.0.0-rc13.tgz#b18a5db3c9f1e5dac4be4848a469b84ae1833b62"
+  integrity sha512-JoIoexBz0AGkrWl3vkPN7+2hHSY0EJJaI04lfMhc5MQy4PjmYTtpOUFgxLHWSB/HUPeioQwyEdClzPTJrM4yxw==
   dependencies:
     cross-fetch "^3.0.4"
     universal-cookie "^4.0.2"
-    vue-apollo "^3.0.0-rc.2"
+    vue-apollo "^3.0.0-rc.5"
     vue-cli-plugin-apollo "^0.21.0"
     webpack-node-externals "^1.7.2"
 
@@ -15110,10 +15110,10 @@ vscode-uri@^1.0.6:
   resolved "https://registry.yarnpkg.com/vscode-uri/-/vscode-uri-1.0.8.tgz#9769aaececae4026fb6e22359cb38946580ded59"
   integrity sha512-obtSWTlbJ+a+TFRYGaUumtVwb+InIUVI0Lu0VBUAPmj2cU5JutEXg3xUE0c2J5Tcy7h2DEKVJBFi+Y9ZSFzzPQ==
 
-vue-apollo@^3.0.0-rc.2:
-  version "3.0.0-rc.2"
-  resolved "https://registry.yarnpkg.com/vue-apollo/-/vue-apollo-3.0.0-rc.2.tgz#3b59a93084cb37c19be46b9f18cd63214a782718"
-  integrity sha512-bYgC3sK77rBlLEHi4XFFAm9NTTB10/onAUzUIhioKM8BKnnFOagjykqBtA9xFRVmFvOcgZBNNbgJhzScBeTn4Q==
+vue-apollo@^3.0.0-rc.5:
+  version "3.0.0-rc.5"
+  resolved "https://registry.yarnpkg.com/vue-apollo/-/vue-apollo-3.0.0-rc.5.tgz#0280c0855318ca89439014c24f3a693a301fa25d"
+  integrity sha512-FuVP93Zq0cglj/S7xRJtmeuGa47BuE7PVEuEbmpGObhEu6sV8TzUMVI6UUTiOHMXYS02NvCAazyy4GAh8Duz8A==
   dependencies:
     chalk "^2.4.2"
     serialize-javascript "^1.7.0"

From 541cd371ace4d86d33579081de6df019deb914b8 Mon Sep 17 00:00:00 2001
From: "dependabot-preview[bot]"
 <27856297+dependabot-preview[bot]@users.noreply.github.com>
Date: Tue, 17 Sep 2019 04:23:37 +0000
Subject: [PATCH 14/22] Bump eslint from 6.3.0 to 6.4.0 in /backend

Bumps [eslint](https://github.com/eslint/eslint) from 6.3.0 to 6.4.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/master/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v6.3.0...v6.4.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
---
 backend/package.json | 2 +-
 backend/yarn.lock    | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/backend/package.json b/backend/package.json
index 3806f9b8f..2aec0377e 100644
--- a/backend/package.json
+++ b/backend/package.json
@@ -116,7 +116,7 @@
     "babel-jest": "~24.9.0",
     "chai": "~4.2.0",
     "cucumber": "~5.1.0",
-    "eslint": "~6.3.0",
+    "eslint": "~6.4.0",
     "eslint-config-prettier": "~6.3.0",
     "eslint-config-standard": "~14.1.0",
     "eslint-plugin-import": "~2.18.2",
diff --git a/backend/yarn.lock b/backend/yarn.lock
index ff33ff04d..728d8a4e0 100644
--- a/backend/yarn.lock
+++ b/backend/yarn.lock
@@ -3420,10 +3420,10 @@ eslint-visitor-keys@^1.0.0, eslint-visitor-keys@^1.1.0:
   resolved "https://registry.yarnpkg.com/eslint-visitor-keys/-/eslint-visitor-keys-1.1.0.tgz#e2a82cea84ff246ad6fb57f9bde5b46621459ec2"
   integrity sha512-8y9YjtM1JBJU/A9Kc+SbaOV4y29sSWckBwMHa+FGtVj5gN/sbnKDf6xJUl+8g7FAij9LVaP8C24DUiH/f/2Z9A==
 
-eslint@~6.3.0:
-  version "6.3.0"
-  resolved "https://registry.yarnpkg.com/eslint/-/eslint-6.3.0.tgz#1f1a902f67bfd4c354e7288b81e40654d927eb6a"
-  integrity sha512-ZvZTKaqDue+N8Y9g0kp6UPZtS4FSY3qARxBs7p4f0H0iof381XHduqVerFWtK8DPtKmemqbqCFENWSQgPR/Gow==
+eslint@~6.4.0:
+  version "6.4.0"
+  resolved "https://registry.yarnpkg.com/eslint/-/eslint-6.4.0.tgz#5aa9227c3fbe921982b2eda94ba0d7fae858611a"
+  integrity sha512-WTVEzK3lSFoXUovDHEbkJqCVPEPwbhCq4trDktNI6ygs7aO41d4cDT0JFAT5MivzZeVLWlg7vHL+bgrQv/t3vA==
   dependencies:
     "@babel/code-frame" "^7.0.0"
     ajv "^6.10.0"

From 2d430ee72ca79704a073d95d8fb4d926875080d0 Mon Sep 17 00:00:00 2001
From: "dependabot-preview[bot]"
 <27856297+dependabot-preview[bot]@users.noreply.github.com>
Date: Tue, 17 Sep 2019 04:25:24 +0000
Subject: [PATCH 15/22] Bump graphql from 14.5.4 to 14.5.6 in /backend

Bumps [graphql](https://github.com/graphql/graphql-js) from 14.5.4 to 14.5.6.
- [Release notes](https://github.com/graphql/graphql-js/releases)
- [Commits](https://github.com/graphql/graphql-js/compare/v14.5.4...v14.5.6)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
---
 backend/package.json | 2 +-
 backend/yarn.lock    | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/backend/package.json b/backend/package.json
index 3806f9b8f..19c6511c3 100644
--- a/backend/package.json
+++ b/backend/package.json
@@ -60,7 +60,7 @@
     "dotenv": "~8.1.0",
     "express": "^4.17.1",
     "faker": "Marak/faker.js#master",
-    "graphql": "^14.5.4",
+    "graphql": "^14.5.6",
     "graphql-custom-directives": "~0.2.14",
     "graphql-iso-date": "~3.6.1",
     "graphql-middleware": "~3.0.5",
diff --git a/backend/yarn.lock b/backend/yarn.lock
index ff33ff04d..2d88ff107 100644
--- a/backend/yarn.lock
+++ b/backend/yarn.lock
@@ -4200,10 +4200,10 @@ graphql-upload@^8.0.2:
     http-errors "^1.7.2"
     object-path "^0.11.4"
 
-graphql@^14.2.1, graphql@^14.5.4:
-  version "14.5.4"
-  resolved "https://registry.yarnpkg.com/graphql/-/graphql-14.5.4.tgz#b33fe957854e90c10d4c07c7d26b6c8e9f159a13"
-  integrity sha512-dPLvHoxy5m9FrkqWczPPRnH0X80CyvRE6e7Fa5AWEqEAzg9LpxHvKh24po/482E6VWHigOkAmb4xCp6P9yT9gw==
+graphql@^14.2.1, graphql@^14.5.6:
+  version "14.5.6"
+  resolved "https://registry.yarnpkg.com/graphql/-/graphql-14.5.6.tgz#3fa12173b50e6ccdef953c31c82f37c50ef58bec"
+  integrity sha512-zJ6Oz8P1yptV4O4DYXdArSwvmirPetDOBnGFRBl0zQEC68vNW3Ny8qo8VzMgfr+iC8PKiRYJ+f2wub41oDCoQg==
   dependencies:
     iterall "^1.2.2"
 

From 7926cb39ba58561533833a332c81750b5a137133 Mon Sep 17 00:00:00 2001
From: mattwr18 <mattwr18@gmail.com>
Date: Tue, 17 Sep 2019 08:50:22 +0200
Subject: [PATCH 16/22] Improve English descriptions

---
 .../src/middleware/hashtags/extractHashtags.spec.js  |  4 ++--
 backend/src/seed/seed-db.js                          | 12 ++++++------
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/backend/src/middleware/hashtags/extractHashtags.spec.js b/backend/src/middleware/hashtags/extractHashtags.spec.js
index 0a129682a..739c7de54 100644
--- a/backend/src/middleware/hashtags/extractHashtags.spec.js
+++ b/backend/src/middleware/hashtags/extractHashtags.spec.js
@@ -8,7 +8,7 @@ describe('extractHashtags', () => {
   })
 
   describe('searches through links', () => {
-    it('not `class="hashtag"` but `data-hashtag-id="something"` makes a link a hashtag link', () => {
+    it('without `class="hashtag"` but `data-hashtag-id="something"`, and extracts the Hashtag to make a Hashtag link', () => {
       const content = `
         <p>
           <a
@@ -35,7 +35,7 @@ describe('extractHashtags', () => {
       expect(extractHashtags(content)).toEqual([])
     })
 
-    it('ignores hashtag links with not allowed character combinations', () => {
+    it('ignores hashtag links with unsupported character combinations', () => {
       // Allowed are all unicode letters '\pL' and all digits '0-9'. There haveto be at least one letter in it.
       const content = `
       <p>
diff --git a/backend/src/seed/seed-db.js b/backend/src/seed/seed-db.js
index 17a20a87d..8c87a3214 100644
--- a/backend/src/seed/seed-db.js
+++ b/backend/src/seed/seed-db.js
@@ -413,7 +413,7 @@ import { gql } from '../jest/helpers'
     const mention2 =
       'Hey <a class="mention" data-mention-id="u3" href="/profile/u3">@jenny-rostock</a>, here is another notification for you!'
     const hashtag1 =
-      'See <a class="hashtag" data-hashtag-id="NaturphilosophieYoga" href="/?hashtag=NaturphilosophieYoga">#NaturphilosophieYoga</a> can really help you!'
+      'See <a class="hashtag" data-hashtag-id="NaturphilosophieYoga" href="/?hashtag=NaturphilosophieYoga">#NaturphilosophieYoga</a>, it can really help you!'
     const hashtagAndMention1 =
       'The new physics of <a class="hashtag" data-hashtag-id="QuantenFlussTheorie" href="/?hashtag=QuantenFlussTheorie">#QuantenFlussTheorie</a> can explain <a class="hashtag" data-hashtag-id="QuantumGravity" href="/?hashtag=QuantumGravity">#QuantumGravity</a>! <a class="mention" data-mention-id="u1" href="/profile/u1">@peter-lustig</a> got that already. ;-)'
     const createPostMutation = gql`
@@ -470,9 +470,9 @@ import { gql } from '../jest/helpers'
 
     authenticatedUser = await dewey.toJson()
     const mentionInComment1 =
-      'I heard <a class="mention" data-mention-id="u3" href="/profile/u3">@jenny-rostock</a>, practice it since 3 years now.'
+      'I heard <a class="mention" data-mention-id="u3" href="/profile/u3">@jenny-rostock</a> has practiced it for 3 years now.'
     const mentionInComment2 =
-      'Did <a class="mention" data-mention-id="u1" href="/profile/u1">@peter-lustig</a> told you?'
+      'Did <a class="mention" data-mention-id="u1" href="/profile/u1">@peter-lustig</a> tell you?'
     const createCommentMutation = gql`
       mutation($id: ID, $postId: ID!, $content: String!) {
         CreateComment(id: $id, postId: $postId, content: $content) {
@@ -661,21 +661,21 @@ import { gql } from '../jest/helpers'
       mutate({
         mutation: reportMutation,
         variables: {
-          description: "I don't like this comment",
+          description: 'This comment is bigoted',
           id: 'c1',
         },
       }),
       mutate({
         mutation: reportMutation,
         variables: {
-          description: "I don't like this post",
+          description: 'This post is bigoted',
           id: 'p1',
         },
       }),
       mutate({
         mutation: reportMutation,
         variables: {
-          description: "I don't like this user",
+          description: 'This user is harassing me with bigoted remarks',
           id: 'u1',
         },
       }),

From b06b353f6aa6665f3421f441f37fb5eeaa758877 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Wolfgang=20Hu=C3=9F?= <wolle.huss@pjannto.com>
Date: Tue, 17 Sep 2019 09:58:35 +0200
Subject: [PATCH 17/22] Corrected comment to unicode letter(s)

---
 backend/src/middleware/hashtags/extractHashtags.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/backend/src/middleware/hashtags/extractHashtags.js b/backend/src/middleware/hashtags/extractHashtags.js
index ee90102dc..9a903e4fa 100644
--- a/backend/src/middleware/hashtags/extractHashtags.js
+++ b/backend/src/middleware/hashtags/extractHashtags.js
@@ -4,8 +4,8 @@ import { exec, build } from 'xregexp/xregexp-all.js'
 //   https://en.wikipedia.org/w/index.php?title=Hashtag&oldid=905141980#Style
 // here:
 //    0. Search for whole string.
-//    1. Hashtag has only all unicode characters and '0-9'.
-//    2. If it starts with a digit '0-9' than a unicode character has to follow.
+//    1. Hashtag has only all unicode letters and '0-9'.
+//    2. If it starts with a digit '0-9' than a unicode letter has to follow.
 const regX = build('^((\\pL+[\\pL0-9]*)|([0-9]+\\pL+[\\pL0-9]*))$')
 
 export default function(content) {

From 02c6bf70f32eecffb1f70018a5e93a00d5dbcd52 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Wolfgang=20Hu=C3=9F?= <wolle.huss@pjannto.com>
Date: Tue, 17 Sep 2019 10:16:12 +0200
Subject: [PATCH 18/22] Change the dummy domain to
 `https://human-connection.org`

---
 webapp/components/Editor/nodes/Hashtag.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/webapp/components/Editor/nodes/Hashtag.js b/webapp/components/Editor/nodes/Hashtag.js
index 495a1532f..96a57e935 100644
--- a/webapp/components/Editor/nodes/Hashtag.js
+++ b/webapp/components/Editor/nodes/Hashtag.js
@@ -22,7 +22,7 @@ export default class Hashtag extends TipTapMention {
       ...super.schema,
       toDOM: node => {
         // use a dummy domain because URL cannot handle relative urls
-        const url = new URL('/', 'http://example.org')
+        const url = new URL('/', 'https://human-connection.org')
         url.searchParams.append('hashtag', node.attrs.id)
 
         return [

From 2f90a45da7200ebda95dbe2825bf7b46a6c24b72 Mon Sep 17 00:00:00 2001
From: roschaefer <git@roschaefer.de>
Date: Tue, 17 Sep 2019 11:05:45 +0200
Subject: [PATCH 19/22] Follow @Tirokk's review and fix a bug

The bug happened because the hashtag link won't get parsed by the
extension. This is desired for mentions because you don't want to
re-notify a user if you haven't updated the text in which you notify
somebody. For hashtags this is undesired and would lead to transforming
the hashtag link into a normal link on the next edit of a post.
---
 webapp/components/Editor/ContentViewer.vue |  8 +++++++-
 webapp/components/Editor/Editor.vue        |  4 +++-
 webapp/components/Editor/nodes/Hashtag.js  | 10 ++++++++--
 webapp/components/Editor/nodes/Link.js     |  3 ++-
 4 files changed, 20 insertions(+), 5 deletions(-)

diff --git a/webapp/components/Editor/ContentViewer.vue b/webapp/components/Editor/ContentViewer.vue
index 993cf32b9..ab07d11d6 100644
--- a/webapp/components/Editor/ContentViewer.vue
+++ b/webapp/components/Editor/ContentViewer.vue
@@ -4,6 +4,7 @@
 
 <script>
 import defaultExtensions from './defaultExtensions.js'
+import Hashtag from './nodes/Hashtag.js'
 import { Editor, EditorContent } from 'tiptap'
 
 export default {
@@ -21,7 +22,12 @@ export default {
         doc: this.doc,
         content: this.content,
         editable: false,
-        extensions: defaultExtensions(this),
+        extensions: [
+          // Hashtags must come first, see
+          // https://github.com/scrumpy/tiptap/issues/421#issuecomment-523037460
+          new Hashtag(),
+          ...defaultExtensions(this),
+        ],
       }),
     }
   },
diff --git a/webapp/components/Editor/Editor.vue b/webapp/components/Editor/Editor.vue
index af98f785a..8d3ce281b 100644
--- a/webapp/components/Editor/Editor.vue
+++ b/webapp/components/Editor/Editor.vue
@@ -134,10 +134,12 @@ export default {
       content: this.value || '',
       doc: this.doc,
       extensions: [
+        // Hashtags must come first, see
+        // https://github.com/scrumpy/tiptap/issues/421#issuecomment-523037460
+        ...this.optionalExtensions,
         ...defaultExtensions(this),
         new EventHandler(),
         new History(),
-        ...this.optionalExtensions,
       ],
       onUpdate: e => {
         clearTimeout(throttleInputEvent)
diff --git a/webapp/components/Editor/nodes/Hashtag.js b/webapp/components/Editor/nodes/Hashtag.js
index 96a57e935..0a06946aa 100644
--- a/webapp/components/Editor/nodes/Hashtag.js
+++ b/webapp/components/Editor/nodes/Hashtag.js
@@ -37,8 +37,14 @@ export default class Hashtag extends TipTapMention {
         ]
       },
       parseDOM: [
-        // simply don't parse mentions from html
-        // just treat them as normal links
+        {
+          tag: 'a[data-hashtag-id]',
+          getAttrs: dom => {
+            const id = dom.getAttribute('data-hashtag-id')
+            const label = dom.innerText.split(this.options.matcher.char).join('')
+            return { id, label }
+          },
+        },
       ],
     }
   }
diff --git a/webapp/components/Editor/nodes/Link.js b/webapp/components/Editor/nodes/Link.js
index a2a032ba3..6c015c030 100644
--- a/webapp/components/Editor/nodes/Link.js
+++ b/webapp/components/Editor/nodes/Link.js
@@ -15,7 +15,8 @@ export default class Link extends TipTapLink {
       inclusive: false,
       parseDOM: [
         {
-          tag: 'a[href]:not(.embed)', // do not trigger on embed links
+          // if this is an embed link or a hashtag, ignore
+          tag: 'a[href]:not(.embed):not([data-hashtag-id])',
           getAttrs: dom => ({
             href: dom.getAttribute('href'),
           }),

From 471f94799e1945405032e2e5eefafd5d06643434 Mon Sep 17 00:00:00 2001
From: "dependabot-preview[bot]"
 <27856297+dependabot-preview[bot]@users.noreply.github.com>
Date: Tue, 17 Sep 2019 14:42:44 +0000
Subject: [PATCH 20/22] Bump metascraper-title from 5.7.0 to 5.7.4 in /backend

Bumps [metascraper-title](https://github.com/microlinkhq/metascraper) from 5.7.0 to 5.7.4.
- [Release notes](https://github.com/microlinkhq/metascraper/releases)
- [Changelog](https://github.com/microlinkhq/metascraper/blob/master/CHANGELOG.md)
- [Commits](https://github.com/microlinkhq/metascraper/compare/v5.7.0...v5.7.4)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
---
 backend/package.json |  2 +-
 backend/yarn.lock    | 12 ++++++------
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/backend/package.json b/backend/package.json
index 1410c646f..142a71101 100644
--- a/backend/package.json
+++ b/backend/package.json
@@ -84,7 +84,7 @@
     "metascraper-logo": "^5.7.4",
     "metascraper-publisher": "^5.7.4",
     "metascraper-soundcloud": "^5.7.4",
-    "metascraper-title": "^5.7.0",
+    "metascraper-title": "^5.7.4",
     "metascraper-url": "^5.7.4",
     "metascraper-video": "^5.7.4",
     "metascraper-youtube": "^5.7.4",
diff --git a/backend/yarn.lock b/backend/yarn.lock
index dcecf074c..f430e9190 100644
--- a/backend/yarn.lock
+++ b/backend/yarn.lock
@@ -971,7 +971,7 @@
     url-regex "~4.1.1"
     video-extensions "~1.1.0"
 
-"@metascraper/helpers@^5.6.6", "@metascraper/helpers@^5.7.0", "@metascraper/helpers@^5.7.4":
+"@metascraper/helpers@^5.6.6", "@metascraper/helpers@^5.7.4":
   version "5.7.4"
   resolved "https://registry.yarnpkg.com/@metascraper/helpers/-/helpers-5.7.4.tgz#c91c1b11ce585fa973a544a9d24c5d88d50a9354"
   integrity sha512-GMLFu8j7e65n04w+dfOVF8RWOqNHCqimITtTHYSa1XdLR8vSqE2PjvSOhGoS5ELU5fRlRQKy9EOrKDeRV3/K0w==
@@ -5941,12 +5941,12 @@ metascraper-soundcloud@^5.7.4:
     memoize-one "~5.1.1"
     tldts "~5.4.0"
 
-metascraper-title@^5.7.0:
-  version "5.7.0"
-  resolved "https://registry.yarnpkg.com/metascraper-title/-/metascraper-title-5.7.0.tgz#4e37ec7cb914b70b60c9867fc05b14779d2199dd"
-  integrity sha512-+GwhBfw7P+S44DRak6H2oe/ESbYMfYpmFzBny2vR6a3vc8KnRivVkK8vF6PLYuTj2bteEcpvZbbPZ2w/H32CMQ==
+metascraper-title@^5.7.4:
+  version "5.7.4"
+  resolved "https://registry.yarnpkg.com/metascraper-title/-/metascraper-title-5.7.4.tgz#1f9f05032c2abab2db9a6634b9f6abec5489c116"
+  integrity sha512-qrOw5uRmGVfqiaZxPF6dfXYM79RY13E+nITukPZsktiGMNIknRJmEVI/GSW+6Ek/+GxlW0gByvE+yqFOrgjCTw==
   dependencies:
-    "@metascraper/helpers" "^5.7.0"
+    "@metascraper/helpers" "^5.7.4"
     lodash "~4.17.15"
 
 metascraper-url@^5.7.4:

From a8dded2263019b6ce1410869643ac420532d5e1e Mon Sep 17 00:00:00 2001
From: roschaefer <git@roschaefer.de>
Date: Tue, 17 Sep 2019 17:35:56 +0200
Subject: [PATCH 21/22] Fix #1616

---
 backend/src/schema/resolvers/registration.js  | 46 ++++++++++-----
 .../src/schema/resolvers/registration.spec.js | 59 +++++++++++++++++--
 backend/src/seed/factories/users.js           | 10 +++-
 3 files changed, 95 insertions(+), 20 deletions(-)

diff --git a/backend/src/schema/resolvers/registration.js b/backend/src/schema/resolvers/registration.js
index fa7262f43..72e499038 100644
--- a/backend/src/schema/resolvers/registration.js
+++ b/backend/src/schema/resolvers/registration.js
@@ -6,14 +6,30 @@ import encryptPassword from '../../helpers/encryptPassword'
 
 const instance = neode()
 
-/*
- * TODO: remove this function as soon type `User` has no `email` property
- * anymore
- */
-const checkEmailDoesNotExist = async ({ email }) => {
+const alreadyExistingMail = async (_parent, args, context) => {
+  let { email } = args
   email = email.toLowerCase()
-  const emails = await instance.all('EmailAddress', { email })
-  if (emails.length > 0) throw new UserInputError('User account with this email already exists.')
+  const cypher = `
+    MATCH (email:EmailAddress {email: $email})
+    OPTIONAL MATCH (email)-[:PRIMARY_EMAIL]-(user)
+    RETURN email, user
+  `
+  let transactionRes
+  const session = context.driver.session()
+  try {
+    transactionRes = await session.run(cypher, { email })
+  } finally {
+    session.close()
+  }
+  const [result] = transactionRes.records.map(record => {
+    return {
+      alreadyExistingEmail: record.get('email').properties,
+      user: record.get('user') && record.get('user').properties,
+    }
+  })
+  const { alreadyExistingEmail, user } = result || {}
+  if (user) throw new UserInputError('User account with this email already exists.')
+  return alreadyExistingEmail
 }
 
 export default {
@@ -37,22 +53,24 @@ export default {
       }
       return response
     },
-    Signup: async (_parent, args, _context, _resolveInfo) => {
+    Signup: async (_parent, args, context) => {
       const nonce = uuid().substring(0, 6)
       args.nonce = nonce
-      await checkEmailDoesNotExist({ email: args.email })
+      let emailAddress = await alreadyExistingMail(_parent, args, context)
+      if (emailAddress) return emailAddress
       try {
-        const emailAddress = await instance.create('EmailAddress', args)
+        emailAddress = await instance.create('EmailAddress', args)
         return emailAddress.toJson()
       } catch (e) {
         throw new UserInputError(e.message)
       }
     },
-    SignupByInvitation: async (_parent, args, _context, _resolveInfo) => {
+    SignupByInvitation: async (_parent, args, context) => {
       const { token } = args
       const nonce = uuid().substring(0, 6)
       args.nonce = nonce
-      await checkEmailDoesNotExist({ email: args.email })
+      let emailAddress = await alreadyExistingMail(_parent, args, context)
+      if (emailAddress) return emailAddress
       try {
         const result = await instance.cypher(
           `
@@ -69,14 +87,14 @@ export default {
         )
         if (!validInvitationCode)
           throw new UserInputError('Invitation code already used or does not exist.')
-        const emailAddress = await instance.create('EmailAddress', args)
+        emailAddress = await instance.create('EmailAddress', args)
         await validInvitationCode.relateTo(emailAddress, 'activated')
         return emailAddress.toJson()
       } catch (e) {
         throw new UserInputError(e)
       }
     },
-    SignupVerification: async (_parent, args, _context, _resolveInfo) => {
+    SignupVerification: async (_parent, args) => {
       const { termsAndConditionsAgreedVersion } = args
       const regEx = new RegExp(/^[0-9]+\.[0-9]+\.[0-9]+$/g)
       if (!regEx.test(termsAndConditionsAgreedVersion)) {
diff --git a/backend/src/schema/resolvers/registration.spec.js b/backend/src/schema/resolvers/registration.spec.js
index ca19f03c4..531eabea1 100644
--- a/backend/src/schema/resolvers/registration.spec.js
+++ b/backend/src/schema/resolvers/registration.spec.js
@@ -310,11 +310,60 @@ describe('Signup', () => {
         })
       })
 
-      it('creates a Signup with a cryptographic `nonce`', async () => {
-        await mutate({ mutation, variables })
-        let emailAddress = await neode.first('EmailAddress', { email: 'someuser@example.org' })
-        emailAddress = await emailAddress.toJson()
-        expect(emailAddress.nonce).toEqual(expect.any(String))
+      describe('creates a EmailAddress node', () => {
+        it('with `createdAt` attribute', async () => {
+          await mutate({ mutation, variables })
+          let emailAddress = await neode.first('EmailAddress', { email: 'someuser@example.org' })
+          emailAddress = await emailAddress.toJson()
+          expect(emailAddress.createdAt).toBeTruthy()
+          expect(Date.parse(emailAddress.createdAt)).toEqual(expect.any(Number))
+        })
+
+        it('with a cryptographic `nonce`', async () => {
+          await mutate({ mutation, variables })
+          let emailAddress = await neode.first('EmailAddress', { email: 'someuser@example.org' })
+          emailAddress = await emailAddress.toJson()
+          expect(emailAddress.nonce).toEqual(expect.any(String))
+        })
+
+        describe('if the email already exists', () => {
+          let email
+          beforeEach(async () => {
+            email = await factory.create('EmailAddress', {
+              email: 'someuser@example.org',
+              verifiedAt: null,
+            })
+          })
+
+          describe('and the user has registered already', () => {
+            beforeEach(async () => {
+              await factory.create('User', { email })
+            })
+
+            it('throws UserInputError error because of unique constraint violation', async () => {
+              await expect(mutate({ mutation, variables })).resolves.toMatchObject({
+                errors: [{ message: 'User account with this email already exists.' }],
+              })
+            })
+          })
+
+          describe('but the user has not yet registered', () => {
+            it('resolves with the already existing email', async () => {
+              await expect(mutate({ mutation, variables })).resolves.toMatchObject({
+                data: { Signup: { email: 'someuser@example.org' } },
+              })
+            })
+
+            it('creates no additional `EmailAddress` node', async () => {
+              // admin account and the already existing user
+              await expect(neode.all('EmailAddress')).resolves.toHaveLength(2)
+              await expect(mutate({ mutation, variables })).resolves.toMatchObject({
+                data: { Signup: { email: 'someuser@example.org' } },
+              })
+              await expect(neode.all('EmailAddress')).resolves.toHaveLength(2)
+            })
+          })
+        })
       })
     })
   })
diff --git a/backend/src/seed/factories/users.js b/backend/src/seed/factories/users.js
index e0ec04fc0..962f92781 100644
--- a/backend/src/seed/factories/users.js
+++ b/backend/src/seed/factories/users.js
@@ -24,7 +24,15 @@ export default function create() {
       }
       args = await encryptPassword(args)
       const user = await neodeInstance.create('User', args)
-      const email = await factoryInstance.create('EmailAddress', { email: args.email })
+
+      let email
+      if (typeof args.email === 'object') {
+        // probably a neode node
+        email = args.email
+      } else {
+        email = await factoryInstance.create('EmailAddress', { email: args.email })
+      }
+
       await user.relateTo(email, 'primaryEmail')
       await email.relateTo(user, 'belongsTo')
       return user

From af3bdaef520b76e03cbd4d7e62d787f54507abd8 Mon Sep 17 00:00:00 2001
From: roschaefer <git@roschaefer.de>
Date: Tue, 17 Sep 2019 18:01:15 +0200
Subject: [PATCH 22/22] Don't create accounts for unverified users

---
 .../maintenance-worker/migration/mongo/export.sh                | 2 +-
 .../maintenance-worker/migration/neo4j/import.sh                | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/deployment/legacy-migration/maintenance-worker/migration/mongo/export.sh b/deployment/legacy-migration/maintenance-worker/migration/mongo/export.sh
index f9334ccd2..b56ace87a 100755
--- a/deployment/legacy-migration/maintenance-worker/migration/mongo/export.sh
+++ b/deployment/legacy-migration/maintenance-worker/migration/mongo/export.sh
@@ -44,7 +44,7 @@ export_collection_query "follows" '{"foreignService": "users"}' "users"
 # export_collection "settings"
 export_collection "shouts"
 # export_collection "status"
-export_collection "users"
+export_collection_query "users" '{"isVerified": true }' "verified"
 # export_collection "userscandos"
 # export_collection "usersettings"
 
diff --git a/deployment/legacy-migration/maintenance-worker/migration/neo4j/import.sh b/deployment/legacy-migration/maintenance-worker/migration/neo4j/import.sh
index cef2846a7..ccb22dafb 100755
--- a/deployment/legacy-migration/maintenance-worker/migration/neo4j/import.sh
+++ b/deployment/legacy-migration/maintenance-worker/migration/neo4j/import.sh
@@ -78,7 +78,7 @@ echo "DONE"
 echo "Start Importing Data"
 import_collection "badges" "badges/badges.cql"
 import_collection "categories" "categories/categories.cql"
-import_collection "users" "users/users.cql"
+import_collection "users_verified" "users/users.cql"
 import_collection "follows_users" "follows/follows.cql"
 #import_collection "follows_organizations" "follows/follows.cql"
 import_collection "contributions_post" "contributions/contributions.cql"