@baseplate-dev/plugin-auth 1.0.5 → 1.0.7

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/email-verification.service.ts

@@ -0,0 +1,140 @@
+// @ts-nocheck
+
+import type { RequestServiceContext } from '%requestServiceContextImports';
+
+import { EMAIL_VERIFICATION_TOKEN_EXPIRY_SEC } from '$constantsPassword';
+import {
+  createAuthVerification,
+  validateAuthVerification,
+} from '%authModuleImports';
+import { config } from '%configServiceImports';
+import { sendEmail } from '%emailModuleImports';
+import { BadRequestError } from '%errorHandlerServiceImports';
+import { prisma } from '%prismaImports';
+import { memoizeRateLimiter } from '%rateLimitImports';
+
+const EMAIL_VERIFY_TYPE = 'email-verify';
+
+/**
+ * Rate limiters for email verification operations.
+ */
+
+// Per-user rate limit: 3 requests per 20 minutes
+const getRequestEmailVerificationUserLimiter = memoizeRateLimiter(
+  'request-email-verification-user',
+  {
+    points: 3,
+    duration: 60 * 20, // 20 minutes
+  },
+);
+
+// Per-IP rate limit: 10 requests/hour
+const getRequestEmailVerificationIpLimiter = memoizeRateLimiter(
+  'request-email-verification-ip',
+  {
+    points: 10,
+    duration: 60 * 60, // 1 hour
+  },
+);
+
+// Per-IP rate limit for verify endpoint: 10 requests/hour
+const getVerifyEmailIpLimiter = memoizeRateLimiter('verify-email-ip', {
+  points: 10,
+  duration: 60 * 60, // 1 hour
+});
+
+/**
+ * Request an email verification for the authenticated user.
+ * Sends a verification email with a link to verify.
+ */
+export async function requestEmailVerification({
+  userId,
+  context,
+}: {
+  userId: string;
+  context: RequestServiceContext;
+}): Promise<{ success: true }> {
+  await Promise.all([
+    getRequestEmailVerificationIpLimiter().consumeOrThrow(
+      context.reqInfo.ip,
+      'Too many verification attempts. Please try again later.',
+      'too-many-requests',
+    ),
+    getRequestEmailVerificationUserLimiter().consumeOrThrow(
+      userId,
+      'Too many verification attempts. Please try again later.',
+      'too-many-requests',
+    ),
+  ]);
+
+  const user = await prisma.user.findUnique({
+    where: { id: userId },
+    select: { id: true, email: true, emailVerified: true },
+  });
+
+  if (!user?.email) {
+    throw new BadRequestError('No email address on account', 'no-email');
+  }
+
+  if (user.emailVerified) {
+    return { success: true };
+  }
+
+  const { token } = await createAuthVerification({
+    type: EMAIL_VERIFY_TYPE,
+    userId: user.id,
+    expiresInSec: EMAIL_VERIFICATION_TOKEN_EXPIRY_SEC,
+  });
+
+  // Construct verification URL using configured domain
+  const verifyLink = `${config.AUTH_FRONTEND_URL}/auth/verify-email?token=${encodeURIComponent(token)}`;
+
+  await sendEmail(TPL_ACCOUNT_VERIFICATION_EMAIL, {
+    to: user.email,
+    data: { verifyLink },
+  });
+
+  return { success: true };
+}
+
+/**
+ * Verify a user's email using the token from the verification email.
+ * This is a public (anonymous) mutation — the token proves identity.
+ *
+ * @throws BadRequestError if token is invalid or expired
+ */
+export async function verifyEmail({
+  token,
+  context,
+}: {
+  token: string;
+  context: RequestServiceContext;
+}): Promise<{ success: true }> {
+  await getVerifyEmailIpLimiter().consumeOrThrow(
+    context.reqInfo.ip,
+    'Too many verification attempts. Please try again later.',
+    'too-many-requests',
+  );
+
+  const record = await validateAuthVerification({
+    type: EMAIL_VERIFY_TYPE,
+    token,
+  });
+
+  if (!record?.userId) {
+    throw new BadRequestError('Invalid or expired token', 'invalid-token');
+  }
+
+  // Delete this token + remaining email-verify tokens + update user in one transaction
+  await prisma.$transaction([
+    prisma.authVerification.deleteMany({
+      where: { type: EMAIL_VERIFY_TYPE, userId: record.userId },
+    }),
+    prisma.user.update({
+      where: { id: record.userId },
+      data: { emailVerified: true },
+    }),
+  ]);
+
+  return { success: true };
+}

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/password-reset.service.d.ts

@@ -0,0 +1,37 @@
+import type { RequestServiceContext } from '%requestServiceContextImports';
+/**
+ * Request a password reset for the given email.
+ */
+export declare function requestPasswordReset({ email: rawEmail, context, }: {
+    email: string;
+    context: RequestServiceContext;
+}): Promise<{
+    success: true;
+}>;
+/**
+ * Validates a password reset token without consuming it.
+ * Used by the frontend to verify the token is valid before showing the reset form.
+ *
+ * @throws BadRequestError with code 'invalid-token' if the token is invalid or expired
+ */
+export declare function validatePasswordResetToken({ token: rawToken, }: {
+    token: string;
+}): Promise<{
+    success: true;
+}>;
+/**
+ * Completes the password reset process by setting a new password.
+ *
+ * Security notes (OWASP Forgot Password Cheat Sheet):
+ * - Token is single-use (deleted after successful reset)
+ * - Does not auto-login the user
+ * - Always invalidates all existing sessions for security
+ * - All remaining password-reset tokens for this user are deleted
+ */
+export declare function completePasswordReset({ token: rawToken, newPassword: rawNewPassword, }: {
+    token: string;
+    newPassword: string;
+}): Promise<{
+    success: true;
+}>;
+//# sourceMappingURL=password-reset.service.d.ts.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/password-reset.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset.service.d.ts","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-email-password/templates/module/services/password-reset.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AA4D3E;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,KAAK,EAAE,QAAQ,EACf,OAAO,GACR,EAAE;IACD,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,qBAAqB,CAAC;CAChC,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,CAAC,CAgD7B;AAMD;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAAC,EAC/C,KAAK,EAAE,QAAQ,GAChB,EAAE;IACD,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,CAAC,CAe7B;AAOD;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CAAC,EAC1C,KAAK,EAAE,QAAQ,EACf,WAAW,EAAE,cAAc,GAC5B,EAAE;IACD,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,CAAC,CA8D7B"}

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/password-reset.service.js

@@ -0,0 +1,161 @@
+// @ts-nocheck
+import { PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, PASSWORD_RESET_TOKEN_EXPIRY_SEC, } from '$constantsPassword';
+import { createAuthVerification, validateAuthVerification, } from '%authModuleImports';
+import { config } from '%configServiceImports';
+import { sendEmail } from '%emailModuleImports';
+import { BadRequestError, handleZodRequestValidationError, } from '%errorHandlerServiceImports';
+import { createPasswordHash } from '%passwordHasherServiceImports';
+import { prisma } from '%prismaImports';
+import { memoizeRateLimiter } from '%rateLimitImports';
+import z from 'zod';
+const PROVIDER_ID = 'email-password';
+const PASSWORD_RESET_TYPE = 'password-reset';
+/**
+ * Rate limiters for password reset operations.
+ */
+// Per-email rate limit: 3 requests/hour
+const getPasswordResetEmailLimiter = memoizeRateLimiter('password-reset-email', {
+    points: 3,
+    duration: 60 * 60, // 1 hour
+});
+// Per-IP rate limit: 10 requests/hour (prevents email scanning)
+const getPasswordResetIpLimiter = memoizeRateLimiter('password-reset-ip', {
+    points: 10,
+    duration: 60 * 60, // 1 hour
+});
+// Global rate limit: 100 requests/hour (prevents overloading the email service)
+const getPasswordResetGlobalLimiter = memoizeRateLimiter('password-reset-global', {
+    points: 100,
+    duration: 60 * 60, // 1 hour
+});
+const requestPasswordResetSchema = z.object({
+    email: z
+        .email()
+        .max(PASSWORD_MAX_LENGTH)
+        .transform((value) => value.toLowerCase()),
+});
+/**
+ * Request a password reset for the given email.
+ */
+export async function requestPasswordReset({ email: rawEmail, context, }) {
+    const { email } = await requestPasswordResetSchema
+        .parseAsync({ email: rawEmail })
+        .catch(handleZodRequestValidationError);
+    await Promise.all([
+        getPasswordResetIpLimiter().consumeOrThrow(context.reqInfo.ip, 'Too many password reset attempts. Please try again later.', 'too-many-requests'),
+        getPasswordResetEmailLimiter().consumeOrThrow(email, 'Too many password reset attempts. Please try again later.', 'too-many-requests'),
+        getPasswordResetGlobalLimiter().consumeOrThrow('global', 'Too many password reset attempts. Please try again later.', 'too-many-requests'),
+    ]);
+    // Find user by email - silently handle non-existent users to prevent enumeration
+    const user = await prisma.user.findUnique({
+        where: { email },
+        select: { id: true, email: true },
+    });
+    if (user?.email) {
+        const { token } = await createAuthVerification({
+            type: PASSWORD_RESET_TYPE,
+            userId: user.id,
+            expiresInSec: PASSWORD_RESET_TOKEN_EXPIRY_SEC,
+        });
+        // Construct reset URL using configured domain
+        const resetLink = `${config.AUTH_FRONTEND_URL}/auth/reset-password?token=${encodeURIComponent(token)}`;
+        // Send email asynchronously (queue-based)
+        await sendEmail(TPL_PASSWORD_RESET_EMAIL, {
+            to: user.email,
+            data: { resetLink },
+        });
+    }
+    // Always return success to prevent user enumeration
+    return { success: true };
+}
+const validateTokenSchema = z.object({
+    token: z.string().min(1).max(PASSWORD_MAX_LENGTH),
+});
+/**
+ * Validates a password reset token without consuming it.
+ * Used by the frontend to verify the token is valid before showing the reset form.
+ *
+ * @throws BadRequestError with code 'invalid-token' if the token is invalid or expired
+ */
+export async function validatePasswordResetToken({ token: rawToken, }) {
+    const { token } = await validateTokenSchema
+        .parseAsync({ token: rawToken })
+        .catch(handleZodRequestValidationError);
+    const record = await validateAuthVerification({
+        type: PASSWORD_RESET_TYPE,
+        token,
+    });
+    if (!record) {
+        throw new BadRequestError('Invalid or expired token', 'invalid-token');
+    }
+    return { success: true };
+}
+const completePasswordResetSchema = z.object({
+    token: z.string().min(1).max(PASSWORD_MAX_LENGTH),
+    newPassword: z.string().min(PASSWORD_MIN_LENGTH).max(PASSWORD_MAX_LENGTH),
+});
+/**
+ * Completes the password reset process by setting a new password.
+ *
+ * Security notes (OWASP Forgot Password Cheat Sheet):
+ * - Token is single-use (deleted after successful reset)
+ * - Does not auto-login the user
+ * - Always invalidates all existing sessions for security
+ * - All remaining password-reset tokens for this user are deleted
+ */
+export async function completePasswordReset({ token: rawToken, newPassword: rawNewPassword, }) {
+    const { token, newPassword } = await completePasswordResetSchema
+        .parseAsync({
+        token: rawToken,
+        newPassword: rawNewPassword,
+    })
+        .catch(handleZodRequestValidationError);
+    const record = await validateAuthVerification({
+        type: PASSWORD_RESET_TYPE,
+        token,
+    });
+    if (!record?.userId) {
+        throw new BadRequestError('Invalid or expired token', 'invalid-token');
+    }
+    const user = await prisma.user.findUniqueOrThrow({
+        where: { id: record.userId },
+        select: { id: true, email: true },
+    });
+    if (!user.email) {
+        throw new BadRequestError('User has no email', 'user-has-no-email');
+    }
+    const passwordHash = await createPasswordHash(newPassword);
+    // Delete token + remaining reset tokens + update password + invalidate sessions
+    await prisma.$transaction([
+        prisma.authVerification.deleteMany({
+            where: { type: PASSWORD_RESET_TYPE, userId: user.id },
+        }),
+        prisma.userAccount.upsert({
+            where: {
+                accountId_providerId: {
+                    accountId: user.email,
+                    providerId: PROVIDER_ID,
+                },
+            },
+            create: {
+                userId: user.id,
+                accountId: user.email,
+                providerId: PROVIDER_ID,
+                password: passwordHash,
+            },
+            update: {
+                password: passwordHash,
+            },
+        }),
+        prisma.userSession.deleteMany({
+            where: { userId: user.id },
+        }),
+    ]);
+    // Send password changed confirmation email
+    await sendEmail(TPL_PASSWORD_CHANGED_EMAIL, {
+        to: user.email,
+        data: {},
+    });
+    return { success: true };
+}
+//# sourceMappingURL=password-reset.service.js.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/password-reset.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset.service.js","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-email-password/templates/module/services/password-reset.service.ts"],"names":[],"mappings":"AAAA,cAAc;AAId,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,+BAA+B,GAChC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EACL,eAAe,EACf,+BAA+B,GAChC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,CAAC,MAAM,KAAK,CAAC;AAEpB,MAAM,WAAW,GAAG,gBAAgB,CAAC;AACrC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAE7C;;GAEG;AAEH,wCAAwC;AACxC,MAAM,4BAA4B,GAAG,kBAAkB,CACrD,sBAAsB,EACtB;IACE,MAAM,EAAE,CAAC;IACT,QAAQ,EAAE,EAAE,GAAG,EAAE,EAAE,SAAS;CAC7B,CACF,CAAC;AAEF,gEAAgE;AAChE,MAAM,yBAAyB,GAAG,kBAAkB,CAAC,mBAAmB,EAAE;IACxE,MAAM,EAAE,EAAE;IACV,QAAQ,EAAE,EAAE,GAAG,EAAE,EAAE,SAAS;CAC7B,CAAC,CAAC;AAEH,gFAAgF;AAChF,MAAM,6BAA6B,GAAG,kBAAkB,CACtD,uBAAuB,EACvB;IACE,MAAM,EAAE,GAAG;IACX,QAAQ,EAAE,EAAE,GAAG,EAAE,EAAE,SAAS;CAC7B,CACF,CAAC;AAEF,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,KAAK,EAAE,CAAC;SACL,KAAK,EAAE;SACP,GAAG,CAAC,mBAAmB,CAAC;SACxB,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;CAC7C,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,KAAK,EAAE,QAAQ,EACf,OAAO,GAIR;IACC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,0BAA0B;SAC/C,UAAU,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;SAC/B,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAE1C,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,yBAAyB,EAAE,CAAC,cAAc,CACxC,OAAO,CAAC,OAAO,CAAC,EAAE,EAClB,2DAA2D,EAC3D,mBAAmB,CACpB;QACD,4BAA4B,EAAE,CAAC,cAAc,CAC3C,KAAK,EACL,2DAA2D,EAC3D,mBAAmB,CACpB;QACD,6BAA6B,EAAE,CAAC,cAAc,CAC5C,QAAQ,EACR,2DAA2D,EAC3D,mBAAmB,CACpB;KACF,CAAC,CAAC;IAEH,iFAAiF;IACjF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QACxC,KAAK,EAAE,EAAE,KAAK,EAAE;QAChB,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;KAClC,CAAC,CAAC;IAEH,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;QAChB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,sBAAsB,CAAC;YAC7C,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,YAAY,EAAE,+BAA+B;SAC9C,CAAC,CAAC;QAEH,8CAA8C;QAC9C,MAAM,SAAS,GAAG,GAAG,MAAM,CAAC,iBAAiB,8BAA8B,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QAEvG,0CAA0C;QAC1C,MAAM,SAAS,CAAC,wBAAwB,EAAE;YACxC,EAAE,EAAE,IAAI,CAAC,KAAK;YACd,IAAI,EAAE,EAAE,SAAS,EAAE;SACpB,CAAC,CAAC;IACL,CAAC;IAED,oDAAoD;IACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC;CAClD,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAC/C,KAAK,EAAE,QAAQ,GAGhB;IACC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,mBAAmB;SACxC,UAAU,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;SAC/B,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAE1C,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;QAC5C,IAAI,EAAE,mBAAmB;QACzB,KAAK;KACN,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,eAAe,CAAC,0BAA0B,EAAE,eAAe,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC;IACjD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC;CAC1E,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAC1C,KAAK,EAAE,QAAQ,EACf,WAAW,EAAE,cAAc,GAI5B;IACC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,MAAM,2BAA2B;SAC7D,UAAU,CAAC;QACV,KAAK,EAAE,QAAQ;QACf,WAAW,EAAE,cAAc;KAC5B,CAAC;SACD,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAE1C,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;QAC5C,IAAI,EAAE,mBAAmB;QACzB,KAAK;KACN,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,eAAe,CAAC,0BAA0B,EAAE,eAAe,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC;QAC/C,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE;QAC5B,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;KAClC,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAE3D,gFAAgF;IAChF,MAAM,MAAM,CAAC,YAAY,CAAC;QACxB,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC;YACjC,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;SACtD,CAAC;QACF,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC;YACxB,KAAK,EAAE;gBACL,oBAAoB,EAAE;oBACpB,SAAS,EAAE,IAAI,CAAC,KAAK;oBACrB,UAAU,EAAE,WAAW;iBACxB;aACF;YACD,MAAM,EAAE;gBACN,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,SAAS,EAAE,IAAI,CAAC,KAAK;gBACrB,UAAU,EAAE,WAAW;gBACvB,QAAQ,EAAE,YAAY;aACvB;YACD,MAAM,EAAE;gBACN,QAAQ,EAAE,YAAY;aACvB;SACF,CAAC;QACF,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC;YAC5B,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;SAC3B,CAAC;KACH,CAAC,CAAC;IAEH,2CAA2C;IAC3C,MAAM,SAAS,CAAC,0BAA0B,EAAE;QAC1C,EAAE,EAAE,IAAI,CAAC,KAAK;QACd,IAAI,EAAE,EAAE;KACT,CAAC,CAAC;IAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC"}

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/password-reset.service.ts

@@ -0,0 +1,235 @@
+// @ts-nocheck
+
+import type { RequestServiceContext } from '%requestServiceContextImports';
+
+import {
+  PASSWORD_MAX_LENGTH,
+  PASSWORD_MIN_LENGTH,
+  PASSWORD_RESET_TOKEN_EXPIRY_SEC,
+} from '$constantsPassword';
+import {
+  createAuthVerification,
+  validateAuthVerification,
+} from '%authModuleImports';
+import { config } from '%configServiceImports';
+import { sendEmail } from '%emailModuleImports';
+import {
+  BadRequestError,
+  handleZodRequestValidationError,
+} from '%errorHandlerServiceImports';
+import { createPasswordHash } from '%passwordHasherServiceImports';
+import { prisma } from '%prismaImports';
+import { memoizeRateLimiter } from '%rateLimitImports';
+import z from 'zod';
+
+const PROVIDER_ID = 'email-password';
+const PASSWORD_RESET_TYPE = 'password-reset';
+
+/**
+ * Rate limiters for password reset operations.
+ */
+
+// Per-email rate limit: 3 requests/hour
+const getPasswordResetEmailLimiter = memoizeRateLimiter(
+  'password-reset-email',
+  {
+    points: 3,
+    duration: 60 * 60, // 1 hour
+  },
+);
+
+// Per-IP rate limit: 10 requests/hour (prevents email scanning)
+const getPasswordResetIpLimiter = memoizeRateLimiter('password-reset-ip', {
+  points: 10,
+  duration: 60 * 60, // 1 hour
+});
+
+// Global rate limit: 100 requests/hour (prevents overloading the email service)
+const getPasswordResetGlobalLimiter = memoizeRateLimiter(
+  'password-reset-global',
+  {
+    points: 100,
+    duration: 60 * 60, // 1 hour
+  },
+);
+
+const requestPasswordResetSchema = z.object({
+  email: z
+    .email()
+    .max(PASSWORD_MAX_LENGTH)
+    .transform((value) => value.toLowerCase()),
+});
+
+/**
+ * Request a password reset for the given email.
+ */
+export async function requestPasswordReset({
+  email: rawEmail,
+  context,
+}: {
+  email: string;
+  context: RequestServiceContext;
+}): Promise<{ success: true }> {
+  const { email } = await requestPasswordResetSchema
+    .parseAsync({ email: rawEmail })
+    .catch(handleZodRequestValidationError);
+
+  await Promise.all([
+    getPasswordResetIpLimiter().consumeOrThrow(
+      context.reqInfo.ip,
+      'Too many password reset attempts. Please try again later.',
+      'too-many-requests',
+    ),
+    getPasswordResetEmailLimiter().consumeOrThrow(
+      email,
+      'Too many password reset attempts. Please try again later.',
+      'too-many-requests',
+    ),
+    getPasswordResetGlobalLimiter().consumeOrThrow(
+      'global',
+      'Too many password reset attempts. Please try again later.',
+      'too-many-requests',
+    ),
+  ]);
+
+  // Find user by email - silently handle non-existent users to prevent enumeration
+  const user = await prisma.user.findUnique({
+    where: { email },
+    select: { id: true, email: true },
+  });
+
+  if (user?.email) {
+    const { token } = await createAuthVerification({
+      type: PASSWORD_RESET_TYPE,
+      userId: user.id,
+      expiresInSec: PASSWORD_RESET_TOKEN_EXPIRY_SEC,
+    });
+
+    // Construct reset URL using configured domain
+    const resetLink = `${config.AUTH_FRONTEND_URL}/auth/reset-password?token=${encodeURIComponent(token)}`;
+
+    // Send email asynchronously (queue-based)
+    await sendEmail(TPL_PASSWORD_RESET_EMAIL, {
+      to: user.email,
+      data: { resetLink },
+    });
+  }
+
+  // Always return success to prevent user enumeration
+  return { success: true };
+}
+
+const validateTokenSchema = z.object({
+  token: z.string().min(1).max(PASSWORD_MAX_LENGTH),
+});
+
+/**
+ * Validates a password reset token without consuming it.
+ * Used by the frontend to verify the token is valid before showing the reset form.
+ *
+ * @throws BadRequestError with code 'invalid-token' if the token is invalid or expired
+ */
+export async function validatePasswordResetToken({
+  token: rawToken,
+}: {
+  token: string;
+}): Promise<{ success: true }> {
+  const { token } = await validateTokenSchema
+    .parseAsync({ token: rawToken })
+    .catch(handleZodRequestValidationError);
+
+  const record = await validateAuthVerification({
+    type: PASSWORD_RESET_TYPE,
+    token,
+  });
+
+  if (!record) {
+    throw new BadRequestError('Invalid or expired token', 'invalid-token');
+  }
+
+  return { success: true };
+}
+
+const completePasswordResetSchema = z.object({
+  token: z.string().min(1).max(PASSWORD_MAX_LENGTH),
+  newPassword: z.string().min(PASSWORD_MIN_LENGTH).max(PASSWORD_MAX_LENGTH),
+});
+
+/**
+ * Completes the password reset process by setting a new password.
+ *
+ * Security notes (OWASP Forgot Password Cheat Sheet):
+ * - Token is single-use (deleted after successful reset)
+ * - Does not auto-login the user
+ * - Always invalidates all existing sessions for security
+ * - All remaining password-reset tokens for this user are deleted
+ */
+export async function completePasswordReset({
+  token: rawToken,
+  newPassword: rawNewPassword,
+}: {
+  token: string;
+  newPassword: string;
+}): Promise<{ success: true }> {
+  const { token, newPassword } = await completePasswordResetSchema
+    .parseAsync({
+      token: rawToken,
+      newPassword: rawNewPassword,
+    })
+    .catch(handleZodRequestValidationError);
+
+  const record = await validateAuthVerification({
+    type: PASSWORD_RESET_TYPE,
+    token,
+  });
+
+  if (!record?.userId) {
+    throw new BadRequestError('Invalid or expired token', 'invalid-token');
+  }
+
+  const user = await prisma.user.findUniqueOrThrow({
+    where: { id: record.userId },
+    select: { id: true, email: true },
+  });
+
+  if (!user.email) {
+    throw new BadRequestError('User has no email', 'user-has-no-email');
+  }
+
+  const passwordHash = await createPasswordHash(newPassword);
+
+  // Delete token + remaining reset tokens + update password + invalidate sessions
+  await prisma.$transaction([
+    prisma.authVerification.deleteMany({
+      where: { type: PASSWORD_RESET_TYPE, userId: user.id },
+    }),
+    prisma.userAccount.upsert({
+      where: {
+        accountId_providerId: {
+          accountId: user.email,
+          providerId: PROVIDER_ID,
+        },
+      },
+      create: {
+        userId: user.id,
+        accountId: user.email,
+        providerId: PROVIDER_ID,
+        password: passwordHash,
+      },
+      update: {
+        password: passwordHash,
+      },
+    }),
+    prisma.userSession.deleteMany({
+      where: { userId: user.id },
+    }),
+  ]);
+
+  // Send password changed confirmation email
+  await sendEmail(TPL_PASSWORD_CHANGED_EMAIL, {
+    to: user.email,
+    data: {},
+  });
+
+  return { success: true };
+}

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/user-password.service.d.ts

@@ -0,0 +1,60 @@
+import type { User } from '%prismaGeneratedImports';
+import type { RequestServiceContext } from '%requestServiceContextImports';
+import type { UserSessionPayload } from '%userSessionTypesImports';
+export declare function createUserWithEmailAndPassword({ input, }: {
+    input: {
+        email: string;
+        password: string;
+    };
+}): Promise<User>;
+export declare function registerUserWithEmailAndPassword({ input, context, }: {
+    input: {
+        email: string;
+        password: string;
+    };
+    context: RequestServiceContext;
+}): Promise<{
+    session: UserSessionPayload;
+    user: User;
+}>;
+export declare function authenticateUserWithEmailAndPassword({ input, context, }: {
+    input: {
+        email: string;
+        password: string;
+    };
+    context: RequestServiceContext;
+}): Promise<{
+    session: UserSessionPayload;
+}>;
+/**
+ * Change a user's password after validating their current password.
+ * This is used when a user wants to change their own password.
+ *
+ * @param params - The parameters for changing password
+ * @param params.userId - The ID of the user changing their password
+ * @param params.input - The current and new password
+ * @returns The updated user
+ */
+export declare function changeUserPassword({ userId, input, }: {
+    userId: string;
+    input: {
+        currentPassword: string;
+        newPassword: string;
+    };
+}): Promise<User>;
+/**
+ * Reset a user's password without requiring the current password.
+ * This is used by administrators to reset any user's password.
+ *
+ * @param params - The parameters for resetting password
+ * @param params.userId - The ID of the user whose password is being reset
+ * @param params.input - The new password
+ * @returns The updated user
+ */
+export declare function resetUserPassword({ userId, input, }: {
+    userId: string;
+    input: {
+        newPassword: string;
+    };
+}): Promise<User>;
+//# sourceMappingURL=user-password.service.d.ts.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/user-password.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-password.service.d.ts","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-email-password/templates/module/services/user-password.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAuDnE,wBAAsB,8BAA8B,CAAC,EACnD,KAAK,GACN,EAAE;IACD,KAAK,EAAE;QACL,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH,GAAG,OAAO,CAAC,IAAI,CAAC,CAiChB;AAED,wBAAsB,gCAAgC,CAAC,EACrD,KAAK,EACL,OAAO,GACR,EAAE;IACD,KAAK,EAAE;QACL,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,OAAO,EAAE,qBAAqB,CAAC;CAChC,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,kBAAkB,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC,CAevD;AAED,wBAAsB,oCAAoC,CAAC,EACzD,KAAK,EACL,OAAO,GACR,EAAE;IACD,KAAK,EAAE;QACL,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,OAAO,EAAE,qBAAqB,CAAC;CAChC,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,kBAAkB,CAAA;CAAE,CAAC,CA6D3C;AAOD;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,MAAM,EACN,KAAK,GACN,EAAE;IACD,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE;QACL,eAAe,EAAE,MAAM,CAAC;QACxB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH,GAAG,OAAO,CAAC,IAAI,CAAC,CAyChB;AAMD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,MAAM,EACN,KAAK,GACN,EAAE;IACD,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE;QACL,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH,GAAG,OAAO,CAAC,IAAI,CAAC,CA2ChB"}