ddd7c0c03b
- Create packages/utils/src/generate-base58-token.ts with typed prefix support
- Function returns `${TPrefix}${string}` for type-safe prefixed tokens
- Add isBase58() validator and parseBase58Token() helper
- Add comprehensive tests (13 test cases)
- Update login request tokens to use "login_" prefix
- Fix login-password.ts to not replace token (cookie/DB mismatch bug)
- Migrate all token generation from generateSecureToken (hex) to
generateSecureBase58Token (base58)
- Remove duplicate token generation from api-server/utils/crypto.ts
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
62 lines
1.7 KiB
TypeScript
62 lines
1.7 KiB
TypeScript
/**
|
|
* Forgot password handler
|
|
* Public procedure (no authentication required)
|
|
*
|
|
* Anti-enumeration: Always returns success even if user doesn't exist
|
|
* This prevents attackers from determining which emails are registered
|
|
*/
|
|
|
|
import { TOKEN_DURATIONS } from "../../utils/cookies.js";
|
|
import {
|
|
generateExpiry,
|
|
generateSecureBase58Token,
|
|
} from "../../utils/crypto.js";
|
|
import { sendPasswordResetEmail } from "../../utils/email.js";
|
|
import { os } from "../base.js";
|
|
|
|
export const forgotPassword = os.auth.forgotPassword.handler(
|
|
async ({ input, context }) => {
|
|
const { email } = input;
|
|
|
|
// Normalize email to lowercase
|
|
const normalizedEmail = email.toLowerCase();
|
|
|
|
// Look up user by email
|
|
const user = await context.db
|
|
.selectFrom("users")
|
|
.select(["id", "email"])
|
|
.where("email", "=", normalizedEmail)
|
|
.executeTakeFirst();
|
|
|
|
// If user exists, create password reset token and send email
|
|
if (user) {
|
|
// Delete any existing password reset tokens for this user (security measure)
|
|
await context.db
|
|
.deleteFrom("password_resets")
|
|
.where("user_id", "=", user.id)
|
|
.execute();
|
|
|
|
// Generate secure base58 token
|
|
const token = generateSecureBase58Token();
|
|
|
|
// Create password reset record with 1 hour expiry
|
|
const expiresAt = generateExpiry(TOKEN_DURATIONS.PASSWORD_RESET);
|
|
|
|
await context.db
|
|
.insertInto("password_resets")
|
|
.values({
|
|
user_id: user.id,
|
|
token,
|
|
expires_at: expiresAt,
|
|
})
|
|
.execute();
|
|
|
|
// Send password reset email (stubbed)
|
|
await sendPasswordResetEmail(user.email, token);
|
|
}
|
|
|
|
// Always return success (anti-enumeration)
|
|
// Don't reveal whether the email exists or not
|
|
},
|
|
);
|