old_contents: 'use strict'
  
  // bcrypt docs: https://www.npmjs.com/package/bcrypt
  const bcrypt = require('bcryptjs')
      , {STRING, VIRTUAL} = require('sequelize')
  
  //Including some additional flexibility in case a user logged in with oAuth
  module.exports = db => db.define('users', {
    name: STRING,
    email: {
      type: STRING,
      validate: {
        isEmail: true,
        notEmpty: true,
      }
    },
  
    // We support oauth, so users may or may not have passwords.
    password_digest: STRING, // This column stores the hashed password in the DB, via the beforeCreate/beforeUpdate hooks
    password: VIRTUAL // Note that this is a virtual, and not actually stored in DB
  }, {
    indexes: [{fields: ['email'], unique: true}],
    hooks: {
      beforeCreate: setEmailAndPassword,
      beforeUpdate: setEmailAndPassword,
    },
    instanceMethods: {
      // This method is a Promisified bcrypt.compare
      authenticate(plaintext) {
        return new Promise((resolve, reject) =>
          bcrypt.compare(plaintext, this.password_digest,
            (err, result) =>
              err ? reject(err) : resolve(result))
          )
      }
    }
  })
  
  module.exports.associations = (User, {OAuth, Thing, Favorite}) => {
    User.hasOne(OAuth)
    User.belongsToMany(Thing, {as: 'favorites', through: Favorite})
  }
  
  function setEmailAndPassword(user) {
    user.email = user.email && user.email.toLowerCase()
    if (!user.password) return Promise.resolve(user)
  
    return new Promise((resolve, reject) =>
      bcrypt.hash(user.get('password'), 10, (err, hash) => {
        if (err) return reject(err)
        user.set('password_digest', hash)
        resolve(user)
      })
    )
  }
  
new_contents: 'use strict'
  
  // bcrypt docs: https://www.npmjs.com/package/bcrypt
  const bcrypt = require('bcryptjs')
      , {STRING, VIRTUAL} = require('sequelize')
  
  //Including some additional flexibility in case a user logged in with oAuth
  module.exports = db => db.define('users', {
    name: STRING,
    email: {
      type: STRING,
      validate: {
        isEmail: true,
        notEmpty: true,
      }
    },
  
    // We support oauth, so users may or may not have passwords.
    password_digest: STRING, // This column stores the hashed password in the DB, via the beforeCreate/beforeUpdate hooks
    password: VIRTUAL // Note that this is a virtual, and not actually stored in DB
  }, {
    indexes: [{fields: ['email'], unique: true}],
    hooks: {
      beforeCreate: setEmailAndPassword,
      beforeUpdate: setEmailAndPassword,
    },
    instanceMethods: {
      // This method is a Promisified bcrypt.compare
      authenticate(plaintext) {
        return new Promise((resolve, reject) =>
          bcrypt.compare(plaintext, this.password_digest,
            (err, result) =>
              err ? reject(err) : resolve(result))
          )
      }
    }
  })
  
  module.exports.associations = (User, {OAuth, Review, Order}) => {
  
    User.hasOne(OAuth)
    //do we need through tables here?
    User.hasMany(Review, {as: 'reviews', through: Review}),
    User.hasMany(Order, {as: 'orders', through: Order})
  }
  
  function setEmailAndPassword(user) {
    user.email = user.email && user.email.toLowerCase()
    if (!user.password) return Promise.resolve(user)
  
    return new Promise((resolve, reject) =>
      bcrypt.hash(user.get('password'), 10, (err, hash) => {
        if (err) return reject(err)
        user.set('password_digest', hash)
        resolve(user)
      })
    )
  }
  
subject: update user model