@delopay/sdk 0.3.0 → 0.3.2

package/dist/index.cjs

@@ -2069,8 +2069,22 @@ var Users = class {
   async forgotPassword(params) {
     return this.request("POST", "/user/forgot_password", { body: params });
   }
+  /**
+   * Reset a user's password using the single-purpose JWT delivered by the
+   * forgot-password email.
+   *
+   * The backend validates the token **twice**: first by the
+   * `SinglePurposeJWTAuth` middleware (reads `Authorization: Bearer …`),
+   * then by the handler itself (decodes `body.token` as an `EmailToken` and
+   * looks up the user by the embedded email — see
+   * `crates/router/src/core/user.rs:687`). The same JWT satisfies both, so
+   * the SDK sends it in both places. Callers still pass `{ password, token }`.
+   */
   async resetPassword(params) {
-    return this.request("POST", "/user/reset_password", { body: params });
+    return this.request("POST", "/user/reset_password", {
+      body: params,
+      headers: { Authorization: `Bearer ${params.token}` }
+    });
   }
   async verifyEmail(params) {
     return this.request("POST", "/user/verify_email", { body: params });