@flink-app/generic-auth-plugin 1.0.0 → 2.0.0-alpha.100

package/dist/src/coreFunctions.js

@@ -1,54 +1,44 @@
 "use strict";
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+function _export(target, all) {
+    for(var name in all)Object.defineProperty(target, name, {
+        enumerable: true,
+        get: Object.getOwnPropertyDescriptor(all, name).get
     });
-};
-var __generator = (this && this.__generator) || function (thisArg, body) {
-    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
-    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
-    function verb(n) { return function (v) { return step([n, v]); }; }
-    function step(op) {
-        if (f) throw new TypeError("Generator is already executing.");
-        while (g && (g = 0, op[0] && (_ = 0)), _) try {
-            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
-            if (y = 0, t) op = [op[0] & 2, t.value];
-            switch (op[0]) {
-                case 0: case 1: t = op; break;
-                case 4: _.label++; return { value: op[1], done: false };
-                case 5: _.label++; y = op[1]; op = [0]; continue;
-                case 7: op = _.ops.pop(); _.trys.pop(); continue;
-                default:
-                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
-                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
-                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
-                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
-                    if (t[2]) _.ops.pop();
-                    _.trys.pop(); continue;
-            }
-            op = body.call(thisArg, _);
-        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
-        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
-    }
-};
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.getJtwTokenPlugin = getJtwTokenPlugin;
-exports.createUser = createUser;
-exports.loginByToken = loginByToken;
-exports.loginUser = loginUser;
-exports.changePassword = changePassword;
-exports.passwordResetStart = passwordResetStart;
-exports.passwordResetComplete = passwordResetComplete;
-var flink_1 = require("@flink-app/flink");
-var jwt_auth_plugin_1 = require("@flink-app/jwt-auth-plugin");
-var jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+}
+_export(exports, {
+    get changePassword () {
+        return changePassword;
+    },
+    get createUser () {
+        return createUser;
+    },
+    get getJtwTokenPlugin () {
+        return getJtwTokenPlugin;
+    },
+    get loginByToken () {
+        return loginByToken;
+    },
+    get loginUser () {
+        return loginUser;
+    },
+    get passwordResetComplete () {
+        return passwordResetComplete;
+    },
+    get passwordResetStart () {
+        return passwordResetStart;
+    }
+});
+const _flink = require("@flink-app/flink");
+const _jwtauthplugin = require("@flink-app/jwt-auth-plugin");
+const _jsonwebtoken = /*#__PURE__*/ _interop_require_default(require("jsonwebtoken"));
+function _interop_require_default(obj) {
+    return obj && obj.__esModule ? obj : {
+        default: obj
+    };
+}
 function getJtwTokenPlugin(secret, rolePermissions, passwordPolicy, tokenTTL) {
     if (passwordPolicy == undefined) {
         passwordPolicy = /.{1,}$/;
@@ -59,383 +49,337 @@ function getJtwTokenPlugin(secret, rolePermissions, passwordPolicy, tokenTTL) {
     if (rolePermissions["user"] == null) {
         rolePermissions["user"] = [];
     }
-    if (!rolePermissions["user"].includes("authenticated"))
-        rolePermissions["user"].push("authenticated");
-    return (0, jwt_auth_plugin_1.jwtAuthPlugin)({
-        secret: secret,
-        getUser: function (tokenData) {
-            return new Promise(function (res) {
+    if (!rolePermissions["user"].includes("authenticated")) rolePermissions["user"].push("authenticated");
+    return (0, _jwtauthplugin.jwtAuthPlugin)({
+        secret,
+        getUser: (tokenData)=>{
+            return new Promise((res)=>{
                 res({
                     username: tokenData.username,
-                    _id: tokenData._id,
+                    _id: tokenData._id
                 });
             });
         },
-        passwordPolicy: passwordPolicy,
-        rolePermissions: rolePermissions,
-        tokenTTL: tokenTTL,
+        passwordPolicy,
+        rolePermissions,
+        tokenTTL
     });
 }
-function createUser(repo, auth, username, password, authentificationMethod, roles, profile, createPasswordHashAndSaltMethod, onUserCreated, personalNumber) {
-    return __awaiter(this, void 0, void 0, function () {
-        var existingUser, userData, passwordAndSalt, user, token;
-        return __generator(this, function (_a) {
-            switch (_a.label) {
-                case 0:
-                    if (!roles.includes("user"))
-                        roles.push("user");
-                    return [4 /*yield*/, repo.getOne({ username: username.toLowerCase() })];
-                case 1:
-                    existingUser = _a.sent();
-                    if (existingUser != null) {
-                        return [2 /*return*/, {
-                                status: "userExists",
-                            }];
-                    }
-                    userData = {
-                        username: username.toLowerCase(),
-                        roles: roles,
-                        profile: profile,
-                        authentificationMethod: authentificationMethod,
-                        pushNotificationTokens: [],
-                    };
-                    if (personalNumber) {
-                        userData.personalNumber = personalNumber;
-                    }
-                    if (authentificationMethod == "bankid") {
-                        if (!personalNumber) {
-                            flink_1.log.warn("BankID login requested but no personal number found for user");
-                            return [2 /*return*/, { status: "error" }];
-                        }
-                    }
-                    if (!(authentificationMethod == "password")) return [3 /*break*/, 6];
-                    passwordAndSalt = null;
-                    if (!(createPasswordHashAndSaltMethod != null)) return [3 /*break*/, 3];
-                    return [4 /*yield*/, createPasswordHashAndSaltMethod(password)];
-                case 2:
-                    passwordAndSalt = _a.sent();
-                    return [3 /*break*/, 5];
-                case 3: return [4 /*yield*/, auth.createPasswordHashAndSalt(password)];
-                case 4:
-                    passwordAndSalt = _a.sent();
-                    _a.label = 5;
-                case 5:
-                    if (passwordAndSalt == null) {
-                        return [2 /*return*/, {
-                                status: "passwordError",
-                            }];
-                    }
-                    userData.password = passwordAndSalt.hash;
-                    userData.salt = passwordAndSalt.salt;
-                    _a.label = 6;
-                case 6: return [4 /*yield*/, repo.create(userData)];
-                case 7:
-                    user = _a.sent();
-                    if (!onUserCreated) return [3 /*break*/, 9];
-                    return [4 /*yield*/, onUserCreated(user)];
-                case 8:
-                    _a.sent();
-                    _a.label = 9;
-                case 9: return [4 /*yield*/, auth.createToken({ username: username.toLowerCase(), _id: user._id }, roles)];
-                case 10:
-                    token = _a.sent();
-                    if (user.authentificationMethod == "sms") {
-                        return [2 /*return*/, {
-                                status: "success",
-                            }];
-                    }
-                    return [2 /*return*/, {
-                            status: "success",
-                            user: {
-                                _id: user._id,
-                                token: token,
-                                username: username.toLowerCase(),
-                            },
-                        }];
-            }
-        });
+async function createUser(repo, auth, username, password, authentificationMethod, roles, profile, createPasswordHashAndSaltMethod, onUserCreated, personalNumber) {
+    if (!roles.includes("user")) roles.push("user");
+    const existingUser = await repo.getOne({
+        username: username.toLowerCase()
     });
+    if (existingUser != null) {
+        return {
+            status: "userExists"
+        };
+    }
+    let userData = {
+        username: username.toLowerCase(),
+        roles,
+        profile,
+        authentificationMethod,
+        pushNotificationTokens: []
+    };
+    if (personalNumber) {
+        userData.personalNumber = personalNumber;
+    }
+    if (authentificationMethod == "bankid") {
+        if (!personalNumber) {
+            _flink.log.warn("BankID login requested but no personal number found for user");
+            return {
+                status: "error"
+            };
+        }
+    }
+    if (authentificationMethod == "password") {
+        let passwordAndSalt = null;
+        if (createPasswordHashAndSaltMethod != null) {
+            passwordAndSalt = await createPasswordHashAndSaltMethod(password);
+        } else {
+            passwordAndSalt = await auth.createPasswordHashAndSalt(password);
+        }
+        if (passwordAndSalt == null) {
+            return {
+                status: "passwordError"
+            };
+        }
+        userData.password = passwordAndSalt.hash;
+        userData.salt = passwordAndSalt.salt;
+    }
+    const user = await repo.create(userData);
+    if (onUserCreated) {
+        await onUserCreated(user);
+    }
+    const token = await auth.createToken({
+        username: username.toLowerCase(),
+        _id: user._id
+    }, roles);
+    if (user.authentificationMethod == "sms") {
+        return {
+            status: "success"
+        };
+    }
+    return {
+        status: "success",
+        user: {
+            _id: user._id,
+            token: token,
+            username: username.toLowerCase()
+        }
+    };
 }
-function loginByToken(repo, auth, token, code, jwtSecret) {
-    return __awaiter(this, void 0, void 0, function () {
-        var payload, user, authToken;
-        return __generator(this, function (_a) {
-            switch (_a.label) {
-                case 0:
-                    try {
-                        payload = jsonwebtoken_1.default.verify(token, jwtSecret + ":" + code);
-                    }
-                    catch (ex) {
-                        return [2 /*return*/, { status: "failed" }];
-                    }
-                    if (payload.type != "smsLogin") {
-                        return [2 /*return*/, { status: "failed" }];
-                    }
-                    return [4 /*yield*/, repo.getById(payload.userId)];
-                case 1:
-                    user = _a.sent();
-                    if (user == null) {
-                        return [2 /*return*/, { status: "failed" }];
-                    }
-                    return [4 /*yield*/, auth.createToken({ username: user.username.toLowerCase(), _id: user._id }, user.roles)];
-                case 2:
-                    authToken = _a.sent();
-                    return [2 /*return*/, {
-                            status: "success",
-                            user: {
-                                _id: user._id,
-                                username: user.username,
-                                token: authToken,
-                                profile: user.profile,
-                            },
-                        }];
-            }
-        });
-    });
+async function loginByToken(repo, auth, token, code, jwtSecret) {
+    let payload;
+    try {
+        payload = _jsonwebtoken.default.verify(token, jwtSecret + ":" + code);
+    } catch (ex) {
+        return {
+            status: "failed"
+        };
+    }
+    if (payload.type != "smsLogin") {
+        return {
+            status: "failed"
+        };
+    }
+    const user = await repo.getById(payload.userId);
+    if (user == null) {
+        return {
+            status: "failed"
+        };
+    }
+    const authToken = await auth.createToken({
+        username: user.username.toLowerCase(),
+        _id: user._id
+    }, user.roles);
+    return {
+        status: "success",
+        user: {
+            _id: user._id,
+            username: user.username,
+            token: authToken,
+            profile: user.profile
+        }
+    };
 }
-function loginUser(repo, auth, username, password, validatePasswordMethod, smsOptions, onSuccessfulLogin, req) {
-    return __awaiter(this, void 0, void 0, function () {
-        var user, valid, ex_1, code, payload, secret, options, token, token;
-        return __generator(this, function (_a) {
-            switch (_a.label) {
-                case 0: return [4 /*yield*/, repo.getOne({ username: username.toLowerCase() })];
-                case 1:
-                    user = _a.sent();
-                    if (user == null) {
-                        return [2 /*return*/, { status: "failed" }];
-                    }
-                    valid = false;
-                    if (!(user.authentificationMethod == "password")) return [3 /*break*/, 9];
-                    if (password == null)
-                        password = "";
-                    if (!validatePasswordMethod) return [3 /*break*/, 7];
-                    return [4 /*yield*/, validatePasswordMethod(password, user.password, user.salt)];
-                case 2:
-                    valid = _a.sent();
-                    if (!!valid) return [3 /*break*/, 6];
-                    _a.label = 3;
-                case 3:
-                    _a.trys.push([3, 5, , 6]);
-                    return [4 /*yield*/, auth.validatePassword(password, user.password, user.salt)];
-                case 4:
-                    valid = _a.sent();
-                    return [3 /*break*/, 6];
-                case 5:
-                    ex_1 = _a.sent();
-                    return [3 /*break*/, 6];
-                case 6: return [3 /*break*/, 9];
-                case 7: return [4 /*yield*/, auth.validatePassword(password, user.password, user.salt)];
-                case 8:
-                    valid = _a.sent();
-                    _a.label = 9;
-                case 9:
-                    if (user.authentificationMethod == "sms") {
-                        if (!smsOptions)
-                            throw "SMS options must be specified to use SMS login";
-                        code = smsOptions.codeType == "numeric" ? generate(smsOptions.codeLength) : generateString(smsOptions.codeLength);
-                        smsOptions.smsClient.send({
-                            to: [user.username],
-                            from: smsOptions.smsFrom,
-                            message: smsOptions.smsMessage.replace("{{code}}", code),
-                        });
-                        payload = {
-                            type: "smsLogin",
-                            userId: user._id,
-                        };
-                        secret = smsOptions.jwtToken + ":" + code;
-                        options = {
-                            expiresIn: "1h",
-                        };
-                        token = jsonwebtoken_1.default.sign(payload, secret, options);
-                        return [2 /*return*/, {
-                                status: "success",
-                                validationToken: token,
-                            }];
-                    }
-                    if (user.authentificationMethod == "bankid") {
-                        if (!user.personalNumber) {
-                            flink_1.log.warn("BankID login requested but no personal number found for user");
-                            return [2 /*return*/, { status: "failed" }];
-                        }
-                        flink_1.log.warn("BankID login required to be handled in other way, i.e. using flink bankid plugin");
-                        return [2 /*return*/, { status: "failed" }];
-                    }
-                    if (!valid) return [3 /*break*/, 13];
-                    return [4 /*yield*/, auth.createToken({ username: username.toLowerCase(), _id: user._id }, user.roles)];
-                case 10:
-                    token = _a.sent();
-                    if (!onSuccessfulLogin) return [3 /*break*/, 12];
-                    return [4 /*yield*/, onSuccessfulLogin(user, req)];
-                case 11:
-                    _a.sent();
-                    _a.label = 12;
-                case 12: return [2 /*return*/, {
-                        status: "success",
-                        user: {
-                            _id: user._id,
-                            username: user.username,
-                            token: token,
-                            profile: user.profile,
-                        },
-                    }];
-                case 13: return [2 /*return*/, { status: "failed" }];
-            }
-        });
+async function loginUser(repo, auth, username, password, validatePasswordMethod, smsOptions, onSuccessfulLogin, req) {
+    const user = await repo.getOne({
+        username: username.toLowerCase()
     });
-}
-function changePassword(repo, auth, userId, newPassword, createPasswordHashAndSaltMethod) {
-    return __awaiter(this, void 0, void 0, function () {
-        var user, passwordAndSalt;
-        return __generator(this, function (_a) {
-            switch (_a.label) {
-                case 0: return [4 /*yield*/, repo.getById(userId)];
-                case 1:
-                    user = _a.sent();
-                    if (user == null) {
-                        return [2 /*return*/, { status: "failed" }];
-                    }
-                    if (user.authentificationMethod != "password") {
-                        return [2 /*return*/, { status: "failed" }];
-                    }
-                    passwordAndSalt = null;
-                    if (!(createPasswordHashAndSaltMethod == null)) return [3 /*break*/, 3];
-                    return [4 /*yield*/, auth.createPasswordHashAndSalt(newPassword)];
-                case 2:
-                    passwordAndSalt = _a.sent();
-                    return [3 /*break*/, 5];
-                case 3: return [4 /*yield*/, createPasswordHashAndSaltMethod(newPassword)];
-                case 4:
-                    passwordAndSalt = _a.sent();
-                    _a.label = 5;
-                case 5:
-                    if (passwordAndSalt == null) {
-                        return [2 /*return*/, {
-                                status: "passwordError",
-                            }];
-                    }
-                    return [4 /*yield*/, repo.updateOne(userId, {
-                            password: passwordAndSalt.hash,
-                            salt: passwordAndSalt.salt,
-                        })];
-                case 6:
-                    _a.sent();
-                    return [2 /*return*/, { status: "success" }];
+    if (user == null) {
+        return {
+            status: "failed"
+        };
+    }
+    let valid = false;
+    if (user.authentificationMethod == "password") {
+        if (password == null) password = "";
+        if (validatePasswordMethod) {
+            valid = await validatePasswordMethod(password, user.password, user.salt);
+            //If not valid, try to use default auth
+            if (!valid) {
+                try {
+                    valid = await auth.validatePassword(password, user.password, user.salt);
+                } catch (ex) {}
             }
+        } else {
+            valid = await auth.validatePassword(password, user.password, user.salt);
+        }
+    }
+    if (user.authentificationMethod == "sms") {
+        if (!smsOptions) throw "SMS options must be specified to use SMS login";
+        let code = smsOptions.codeType == "numeric" ? generate(smsOptions.codeLength) : generateString(smsOptions.codeLength);
+        smsOptions.smsClient.send({
+            to: [
+                user.username
+            ],
+            from: smsOptions.smsFrom,
+            message: smsOptions.smsMessage.replace("{{code}}", code)
         });
-    });
-}
-function passwordResetStart(repo_1, auth_1, jwtSecret_1, username_1, numberOfDigits_1, lifeTime_1) {
-    return __awaiter(this, arguments, void 0, function (repo, auth, jwtSecret, username, numberOfDigits, lifeTime, passwordResetReusableTokens) {
-        var user, fakepayload, fakeToken, payload, code, pwdResetStartedAt, secret, options, token;
-        if (passwordResetReusableTokens === void 0) { passwordResetReusableTokens = true; }
-        return __generator(this, function (_a) {
-            switch (_a.label) {
-                case 0: return [4 /*yield*/, repo.getOne({ username: username.toLowerCase() })];
-                case 1:
-                    user = _a.sent();
-                    fakepayload = {
-                        type: "passwordReset",
-                        username: username.toLocaleLowerCase(),
-                    };
-                    fakeToken = jsonwebtoken_1.default.sign(fakepayload, "fake_payload", { expiresIn: lifeTime });
-                    if (user == null) {
-                        return [2 /*return*/, { status: "userNotFound", passwordResetToken: fakeToken }];
-                    }
-                    if (user.authentificationMethod != "password") {
-                        return [2 /*return*/, { status: "userNotFound", passwordResetToken: fakeToken }];
-                    }
-                    if (numberOfDigits == null)
-                        numberOfDigits = 6;
-                    if (lifeTime == null)
-                        lifeTime = "1h";
-                    payload = {
-                        type: "passwordReset",
-                        username: username.toLocaleLowerCase(),
-                    };
-                    code = generate(numberOfDigits);
-                    pwdResetStartedAt = new Date().toISOString();
-                    if (!passwordResetReusableTokens) return [3 /*break*/, 2];
-                    secret = jwtSecret + ":" + code;
-                    return [3 /*break*/, 4];
-                case 2:
-                    secret = jwtSecret + ":" + code + ":" + pwdResetStartedAt;
-                    return [4 /*yield*/, repo.updateOne(user._id, { pwdResetStartedAt: pwdResetStartedAt })];
-                case 3:
-                    _a.sent();
-                    _a.label = 4;
-                case 4:
-                    options = {
-                        expiresIn: lifeTime,
-                    };
-                    token = jsonwebtoken_1.default.sign(payload, secret, options);
-                    return [2 /*return*/, {
-                            status: "success",
-                            passwordResetToken: token,
-                            code: code,
-                            profile: user.profile,
-                        }];
+        const payload = {
+            type: "smsLogin",
+            userId: user._id
+        };
+        const secret = smsOptions.jwtToken + ":" + code;
+        const options = {
+            expiresIn: "1h"
+        };
+        const token = _jsonwebtoken.default.sign(payload, secret, options);
+        return {
+            status: "success",
+            validationToken: token
+        };
+    }
+    if (user.authentificationMethod == "bankid") {
+        if (!user.personalNumber) {
+            _flink.log.warn("BankID login requested but no personal number found for user");
+            return {
+                status: "failed"
+            };
+        }
+        _flink.log.warn("BankID login required to be handled in other way, i.e. using flink bankid plugin");
+        return {
+            status: "failed"
+        };
+    }
+    if (valid) {
+        const token = await auth.createToken({
+            username: username.toLowerCase(),
+            _id: user._id
+        }, user.roles);
+        if (onSuccessfulLogin) {
+            await onSuccessfulLogin(user, req);
+        }
+        return {
+            status: "success",
+            user: {
+                _id: user._id,
+                username: user.username,
+                token,
+                profile: user.profile
             }
-        });
+        };
+    } else {
+        return {
+            status: "failed"
+        };
+    }
+}
+async function changePassword(repo, auth, userId, newPassword, createPasswordHashAndSaltMethod) {
+    const user = await repo.getById(userId);
+    if (user == null) {
+        return {
+            status: "failed"
+        };
+    }
+    if (user.authentificationMethod != "password") {
+        return {
+            status: "failed"
+        };
+    }
+    let passwordAndSalt = null;
+    if (createPasswordHashAndSaltMethod == null) {
+        passwordAndSalt = await auth.createPasswordHashAndSalt(newPassword);
+    } else {
+        passwordAndSalt = await createPasswordHashAndSaltMethod(newPassword);
+    }
+    if (passwordAndSalt == null) {
+        return {
+            status: "passwordError"
+        };
+    }
+    await repo.updateById(userId, {
+        password: passwordAndSalt.hash,
+        salt: passwordAndSalt.salt
     });
+    return {
+        status: "success"
+    };
 }
-function passwordResetComplete(repo_1, auth_1, jwtSecret_1, passwordResetToken_1, code_1, newPassword_1, createPasswordHashAndSaltMethod_1) {
-    return __awaiter(this, arguments, void 0, function (repo, auth, jwtSecret, passwordResetToken, code, newPassword, createPasswordHashAndSaltMethod, passwordResetReusableTokens) {
-        var payload, user, secret, passwordAndSalt;
-        if (passwordResetReusableTokens === void 0) { passwordResetReusableTokens = true; }
-        return __generator(this, function (_a) {
-            switch (_a.label) {
-                case 0:
-                    payload = jsonwebtoken_1.default.decode(passwordResetToken);
-                    if (!payload || !payload.username)
-                        return [2 /*return*/, { status: "invalidCode" }];
-                    return [4 /*yield*/, repo.getOne({ username: payload.username })];
-                case 1:
-                    user = _a.sent();
-                    if (!user || user == null || user.authentificationMethod != "password") {
-                        return [2 /*return*/, { status: "userNotFound" }];
-                    }
-                    if (passwordResetReusableTokens === true) {
-                        secret = jwtSecret + ":" + code;
-                    }
-                    else {
-                        if (!user.pwdResetStartedAt || user.pwdResetStartedAt === null) {
-                            return [2 /*return*/, { status: "userNotFound" }];
-                        }
-                        secret = jwtSecret + ":" + code + ":" + user.pwdResetStartedAt;
-                    }
-                    try {
-                        jsonwebtoken_1.default.verify(passwordResetToken, secret);
-                    }
-                    catch (ex) {
-                        return [2 /*return*/, { status: "invalidCode" }];
-                    }
-                    passwordAndSalt = null;
-                    if (!(createPasswordHashAndSaltMethod == null)) return [3 /*break*/, 3];
-                    return [4 /*yield*/, auth.createPasswordHashAndSalt(newPassword)];
-                case 2:
-                    passwordAndSalt = _a.sent();
-                    return [3 /*break*/, 5];
-                case 3: return [4 /*yield*/, createPasswordHashAndSaltMethod(newPassword)];
-                case 4:
-                    passwordAndSalt = _a.sent();
-                    _a.label = 5;
-                case 5:
-                    if (passwordAndSalt == null) {
-                        return [2 /*return*/, {
-                                status: "passwordError",
-                            }];
-                    }
-                    return [4 /*yield*/, repo.updateOne(user._id, {
-                            password: passwordAndSalt.hash,
-                            salt: passwordAndSalt.salt,
-                            pwdResetStartedAt: null,
-                        })];
-                case 6:
-                    _a.sent();
-                    return [2 /*return*/, { status: "success", user: user }];
-            }
+async function passwordResetStart(repo, auth, jwtSecret, username, numberOfDigits, lifeTime, passwordResetReusableTokens = true) {
+    const user = await repo.getOne({
+        username: username.toLowerCase()
+    });
+    const fakepayload = {
+        type: "passwordReset",
+        username: username.toLocaleLowerCase()
+    };
+    const fakeToken = _jsonwebtoken.default.sign(fakepayload, "fake_payload", {
+        expiresIn: lifeTime
+    });
+    if (user == null) {
+        return {
+            status: "userNotFound",
+            passwordResetToken: fakeToken
+        };
+    }
+    if (user.authentificationMethod != "password") {
+        return {
+            status: "userNotFound",
+            passwordResetToken: fakeToken
+        };
+    }
+    if (numberOfDigits == null) numberOfDigits = 6;
+    if (lifeTime == null) lifeTime = "1h";
+    const payload = {
+        type: "passwordReset",
+        username: username.toLocaleLowerCase()
+    };
+    const code = generate(numberOfDigits);
+    const pwdResetStartedAt = new Date().toISOString();
+    let secret;
+    if (passwordResetReusableTokens) {
+        secret = jwtSecret + ":" + code;
+    } else {
+        secret = jwtSecret + ":" + code + ":" + pwdResetStartedAt;
+        await repo.updateById(user._id, {
+            pwdResetStartedAt
         });
+    }
+    const options = {
+        expiresIn: lifeTime
+    };
+    const token = _jsonwebtoken.default.sign(payload, secret, options);
+    return {
+        status: "success",
+        passwordResetToken: token,
+        code,
+        profile: user.profile
+    };
+}
+async function passwordResetComplete(repo, auth, jwtSecret, passwordResetToken, code, newPassword, createPasswordHashAndSaltMethod, passwordResetReusableTokens = true) {
+    const payload = _jsonwebtoken.default.decode(passwordResetToken);
+    if (!payload || !payload.username) return {
+        status: "invalidCode"
+    };
+    const user = await repo.getOne({
+        username: payload.username
+    });
+    if (!user || user == null || user.authentificationMethod != "password") {
+        return {
+            status: "userNotFound"
+        };
+    }
+    let secret;
+    if (passwordResetReusableTokens === true) {
+        secret = jwtSecret + ":" + code;
+    } else {
+        if (!user.pwdResetStartedAt || user.pwdResetStartedAt === null) {
+            return {
+                status: "userNotFound"
+            };
+        }
+        secret = jwtSecret + ":" + code + ":" + user.pwdResetStartedAt;
+    }
+    try {
+        _jsonwebtoken.default.verify(passwordResetToken, secret);
+    } catch (ex) {
+        return {
+            status: "invalidCode"
+        };
+    }
+    let passwordAndSalt = null;
+    if (createPasswordHashAndSaltMethod == null) {
+        passwordAndSalt = await auth.createPasswordHashAndSalt(newPassword);
+    } else {
+        passwordAndSalt = await createPasswordHashAndSaltMethod(newPassword);
+    }
+    if (passwordAndSalt == null) {
+        return {
+            status: "passwordError"
+        };
+    }
+    await repo.updateById(user._id, {
+        password: passwordAndSalt.hash,
+        salt: passwordAndSalt.salt,
+        pwdResetStartedAt: null
     });
+    return {
+        status: "success",
+        user
+    };
 }
 function generate(n) {
     var add = 1, max = 12 - add;
@@ -448,10 +392,10 @@ function generate(n) {
     return ("" + number).substring(add);
 }
 function generateString(length) {
-    var characters = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
-    var result = " ";
-    var charactersLength = characters.length;
-    for (var i = 0; i < length; i++) {
+    const characters = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
+    let result = " ";
+    const charactersLength = characters.length;
+    for(let i = 0; i < length; i++){
         result += characters.charAt(Math.floor(Math.random() * charactersLength));
     }
     return result;