@lenne.tech/nest-server 11.38.0 → 11.39.0

package/src/server/modules/user/user.service.ts

@@ -91,21 +91,40 @@ export class UserService extends CoreUserService<User, UserInput, UserCreateInpu
    * Better-Auth makes on the IAM path.
    */
   async sendPasswordResetMail(email: string, serviceOptions?: ServiceOptions): Promise<null | User> {
-    // Set password reset token
-    const user = await super.setPasswordResetTokenForEmail(email, serviceOptions);
+    // `createPasswordResetToken`, not `setPasswordResetTokenForEmail`: the latter returns the user
+    // through `process()`, where the security interceptor strips `passwordResetToken`. Reading the
+    // token off that object is what mailed the word `undefined` to a real recipient.
+    const created = await this.createPasswordResetToken(email, serviceOptions);
 
-    if (!user) {
+    if (!created) {
       // Unknown address, enumeration protection on. Answer exactly as for a known one.
       return null;
     }
 
+    // `buildPasswordResetLink`, not string concatenation: `email.passwordResetLink` has no default,
+    // and this config file does not set one, so concatenating produced `undefined/<token>`.
+    const link = this.buildPasswordResetLink(created.token);
+    if (!link) {
+      // Sending a mail whose link cannot work is worse than sending none. The recipient has no
+      // second way in, and a dead link gives them nothing to act on — while no mail at least reads
+      // as "try again". The address is still answered exactly as a known one.
+      this.userServiceLogger.error(
+        'Password reset mail not sent: no reset link could be built. Set `email.passwordResetLink` or `appUrl`.',
+      );
+      return created.user;
+    }
+
     // Deliberately NOT awaited — see the note above.
     void this.emailService
-      .sendMail(user.email, 'Password reset', {
+      .sendMail(created.user.email, 'Password reset', {
         htmlTemplate: 'password-reset',
         templateData: {
-          link: `${this.configService.configFastButReadOnly.email.passwordResetLink}/${user.passwordResetToken}`,
-          name: user.username,
+          link,
+          // The mail is the only place the recipient can learn there IS a deadline. Without it an
+          // expired link is indistinguishable from a broken one — the same experience this whole
+          // area was repaired for.
+          linkExpiresInMinutes: this.passwordResetTokenExpiryMinutes(),
+          name: created.user.username,
         },
       })
       .catch((error: unknown) => {
@@ -115,7 +134,7 @@ export class UserService extends CoreUserService<User, UserInput, UserCreateInpu
       });
 
     // Return user
-    return user;
+    return created.user;
   }
 
   /**

package/src/templates/password-reset-de.ejs

@@ -50,6 +50,18 @@
                 Falls die Schaltfläche nicht funktioniert, kopiere diesen Link in deinen Browser:<br>
                 <a href="<%= link %>" style="color:#1d4ed8; word-break:break-all; overflow-wrap:break-word;"><%= link %></a>
               </p>
+              <%
+                /* Optional, like `appName`: a caller that omits it must not turn a password-reset
+                   mail into a 500. Rendered only for a real, positive value — a deployment that
+                   switched the expiry off (`0`) has no deadline to announce. */
+                const expiryMinutes = (typeof linkExpiresInMinutes !== 'undefined' && Number(linkExpiresInMinutes) > 0)
+                  ? Number(linkExpiresInMinutes) : 0;
+              -%>
+              <% if (expiryMinutes) { %>
+              <p style="margin:16px 0 0 0; font-size:13px; line-height:20px; color:#737373;">
+                Der Link ist <%= expiryMinutes %> Minuten lang gültig. Danach kannst du einfach einen neuen anfordern.
+              </p>
+              <% } %>
             </td>
           </tr>
           <tr>

package/src/templates/password-reset-en.ejs

@@ -50,6 +50,18 @@
                 If the button doesn't work, copy and paste this link into your browser:<br>
                 <a href="<%= link %>" style="color:#1d4ed8; word-break:break-all; overflow-wrap:break-word;"><%= link %></a>
               </p>
+              <%
+                /* Optional, like `appName`: a caller that omits it must not turn a password-reset
+                   mail into a 500. Rendered only for a real, positive value — a deployment that
+                   switched the expiry off (`0`) has no deadline to announce. */
+                const expiryMinutes = (typeof linkExpiresInMinutes !== 'undefined' && Number(linkExpiresInMinutes) > 0)
+                  ? Number(linkExpiresInMinutes) : 0;
+              -%>
+              <% if (expiryMinutes) { %>
+              <p style="margin:16px 0 0 0; font-size:13px; line-height:20px; color:#737373;">
+                This link is valid for <%= expiryMinutes %> minutes. After that, just request a new one.
+              </p>
+              <% } %>
             </td>
           </tr>
           <tr>

package/src/templates/password-reset.ejs

@@ -1,3 +1,4 @@
 <h1>Hello <%= name %>,</h1>
 <p>you requested a link for setting a new password. Here it is.</p><br />
 <a href="<%= link %>">Reset password</a>
+<% if (typeof linkExpiresInMinutes !== 'undefined' && Number(linkExpiresInMinutes) > 0) { %><br /><p>This link is valid for <%= Number(linkExpiresInMinutes) %> minutes. After that, just request a new one.</p><% } %>