@lenne.tech/nest-server 11.37.0 → 11.39.0

package/src/server/modules/user/user.service.ts

@@ -74,22 +74,67 @@ export class UserService extends CoreUserService<User, UserInput, UserCreateInpu
 
   /**
    * Request password reset mail
+   *
+   * REFERENCE IMPLEMENTATION — the two details below are the ones that matter, and a project
+   * copying this method needs both. Either one alone leaves the endpoint an account oracle.
+   *
+   * 1. An unknown address yields `null` (since 11.38.0, unless
+   *    `auth.passwordReset.preventUserEnumeration` is off) and this method returns quietly, so the
+   *    caller answers the same way it would for a known one.
+   * 2. The mail send is NOT awaited. This is the half that actually closes the channel: the send
+   *    is a network round trip to SMTP or Brevo, orders of magnitude above everything else in the
+   *    request. Awaiting it would make the known path visibly slower whatever the status code says
+   *    — you would have given up the "unknown address" hint in the UI and kept the oracle.
+   *
+   * A failed send must still be reported rather than crash the process, which is why it carries
+   * its own `catch`. The user is told the mail is on its way either way; that is the same trade
+   * Better-Auth makes on the IAM path.
    */
-  async sendPasswordResetMail(email: string, serviceOptions?: ServiceOptions): Promise<User> {
-    // Set password reset token
-    const user = await super.setPasswordResetTokenForEmail(email, serviceOptions);
-
-    // Send email
-    await this.emailService.sendMail(user.email, 'Password reset', {
-      htmlTemplate: 'password-reset',
-      templateData: {
-        link: `${this.configService.configFastButReadOnly.email.passwordResetLink}/${user.passwordResetToken}`,
-        name: user.username,
-      },
-    });
+  async sendPasswordResetMail(email: string, serviceOptions?: ServiceOptions): Promise<null | User> {
+    // `createPasswordResetToken`, not `setPasswordResetTokenForEmail`: the latter returns the user
+    // through `process()`, where the security interceptor strips `passwordResetToken`. Reading the
+    // token off that object is what mailed the word `undefined` to a real recipient.
+    const created = await this.createPasswordResetToken(email, serviceOptions);
+
+    if (!created) {
+      // Unknown address, enumeration protection on. Answer exactly as for a known one.
+      return null;
+    }
+
+    // `buildPasswordResetLink`, not string concatenation: `email.passwordResetLink` has no default,
+    // and this config file does not set one, so concatenating produced `undefined/<token>`.
+    const link = this.buildPasswordResetLink(created.token);
+    if (!link) {
+      // Sending a mail whose link cannot work is worse than sending none. The recipient has no
+      // second way in, and a dead link gives them nothing to act on — while no mail at least reads
+      // as "try again". The address is still answered exactly as a known one.
+      this.userServiceLogger.error(
+        'Password reset mail not sent: no reset link could be built. Set `email.passwordResetLink` or `appUrl`.',
+      );
+      return created.user;
+    }
+
+    // Deliberately NOT awaited — see the note above.
+    void this.emailService
+      .sendMail(created.user.email, 'Password reset', {
+        htmlTemplate: 'password-reset',
+        templateData: {
+          link,
+          // The mail is the only place the recipient can learn there IS a deadline. Without it an
+          // expired link is indistinguishable from a broken one — the same experience this whole
+          // area was repaired for.
+          linkExpiresInMinutes: this.passwordResetTokenExpiryMinutes(),
+          name: created.user.username,
+        },
+      })
+      .catch((error: unknown) => {
+        this.userServiceLogger.error(
+          `Failed to send the password-reset mail: ${error instanceof Error ? error.message : String(error)}`,
+        );
+      });
 
     // Return user
-    return user;
+    return created.user;
   }
 
   /**

package/src/templates/password-reset-de.ejs

@@ -50,6 +50,18 @@
                 Falls die Schaltfläche nicht funktioniert, kopiere diesen Link in deinen Browser:<br>
                 <a href="<%= link %>" style="color:#1d4ed8; word-break:break-all; overflow-wrap:break-word;"><%= link %></a>
               </p>
+              <%
+                /* Optional, like `appName`: a caller that omits it must not turn a password-reset
+                   mail into a 500. Rendered only for a real, positive value — a deployment that
+                   switched the expiry off (`0`) has no deadline to announce. */
+                const expiryMinutes = (typeof linkExpiresInMinutes !== 'undefined' && Number(linkExpiresInMinutes) > 0)
+                  ? Number(linkExpiresInMinutes) : 0;
+              -%>
+              <% if (expiryMinutes) { %>
+              <p style="margin:16px 0 0 0; font-size:13px; line-height:20px; color:#737373;">
+                Der Link ist <%= expiryMinutes %> Minuten lang gültig. Danach kannst du einfach einen neuen anfordern.
+              </p>
+              <% } %>
             </td>
           </tr>
           <tr>

package/src/templates/password-reset-en.ejs

@@ -50,6 +50,18 @@
                 If the button doesn't work, copy and paste this link into your browser:<br>
                 <a href="<%= link %>" style="color:#1d4ed8; word-break:break-all; overflow-wrap:break-word;"><%= link %></a>
               </p>
+              <%
+                /* Optional, like `appName`: a caller that omits it must not turn a password-reset
+                   mail into a 500. Rendered only for a real, positive value — a deployment that
+                   switched the expiry off (`0`) has no deadline to announce. */
+                const expiryMinutes = (typeof linkExpiresInMinutes !== 'undefined' && Number(linkExpiresInMinutes) > 0)
+                  ? Number(linkExpiresInMinutes) : 0;
+              -%>
+              <% if (expiryMinutes) { %>
+              <p style="margin:16px 0 0 0; font-size:13px; line-height:20px; color:#737373;">
+                This link is valid for <%= expiryMinutes %> minutes. After that, just request a new one.
+              </p>
+              <% } %>
             </td>
           </tr>
           <tr>

package/src/templates/password-reset.ejs

@@ -1,3 +1,4 @@
 <h1>Hello <%= name %>,</h1>
 <p>you requested a link for setting a new password. Here it is.</p><br />
 <a href="<%= link %>">Reset password</a>
+<% if (typeof linkExpiresInMinutes !== 'undefined' && Number(linkExpiresInMinutes) > 0) { %><br /><p>This link is valid for <%= Number(linkExpiresInMinutes) %> minutes. After that, just request a new one.</p><% } %>