@maestro-js/password 1.0.0-alpha.23 → 1.0.0-alpha.4

package/dist/index.d.ts

@@ -40,13 +40,12 @@ declare namespace Password {
             password: string;
         }> {
             verifyCredentials(credentials: Credentials): Promise<Password.Authenticatable<Id> | null>;
-            createPasswordResetToken: (authenticatableId: Id, options: {
-                expirationMinutes: number;
-            }) => Promise<string>;
+            createPasswordResetToken: (authenticatableId: Id) => Promise<string>;
             resetPassword: (options: {
+                authenticatableId: Id;
                 token: string;
                 newPassword: string;
-            }) => Promise<Id>;
+            }) => Promise<void>;
         }
         interface Config<Id, Credentials extends {
             password: string;
@@ -77,6 +76,8 @@ declare namespace Password {
         getBySelector(selector: string): Promise<Password.ResetTokenRecord<Id> | null>;
         getByAuthenticatableId(authenticatableId: Id): Promise<Password.ResetTokenRecord<Id> | null>;
         deleteByAuthenticatableId(authenticatableId: Id): Promise<void>;
+        /** Token lifetime in minutes. Default: 60 */
+        tokenExpirationMinutes?: number;
         /** Minimum seconds between createToken calls for the same authenticatable. Default: 60 */
         throttleSeconds?: number;
     }

package/dist/index.js

@@ -6,13 +6,11 @@ import { instantFns } from "iso-fns2";
 function create(config) {
   const hashService = config.hash;
   const passwordResetOptions = config.passwordResetOptions;
-  let dummyHash;
   async function verifyCredentials(credentials) {
     const { password, ...input } = credentials;
     const authenticatable = await config.getAuthenticatableByCredentials(input);
     if (!authenticatable) {
-      dummyHash ??= await hashService.hash("password");
-      await hashService.verify({ plaintext: password, hash: dummyHash });
+      await hashService.verify({ hash: await hashService.hash("password"), plaintext: "password" });
       return null;
     }
     const isValid = await hashService.verify({ plaintext: password, hash: authenticatable.passwordHash });
@@ -26,7 +24,7 @@ function create(config) {
     }
     return { id: authenticatable.id, credentialsInvalidBefore: authenticatable.credentialsInvalidBefore };
   }
-  async function createPasswordResetToken(authenticatableId, options) {
+  async function createPasswordResetToken(authenticatableId) {
     if (!passwordResetOptions) {
       throw new Error("Password reset is not configured. Provide `passwordResetOptions` when creating the password service.");
     }
@@ -41,7 +39,7 @@ function create(config) {
     const verifier = crypto.randomBytes(32).toString("base64url");
     const verifierHash = await config.hash.hash(verifier);
     const now = instantFns.now();
-    const expirationDate = instantFns.add(now, { minutes: options.expirationMinutes });
+    const expirationDate = instantFns.add(now, { minutes: passwordResetOptions.tokenExpirationMinutes ?? 60 });
     await passwordResetOptions.create({
       authenticatableId,
       selector,
@@ -51,7 +49,11 @@ function create(config) {
     });
     return `${selector}|${verifier}`;
   }
-  async function resetPassword({ token, newPassword }) {
+  async function resetPassword({
+    authenticatableId,
+    token,
+    newPassword
+  }) {
     if (!passwordResetOptions) {
       throw new Error("Password reset is not configured. Provide `passwordResetOptions` when creating the password service.");
     }
@@ -70,11 +72,13 @@ function create(config) {
     if (record.expirationDate < instantFns.now()) {
       throw new PasswordResetExpiredTokenError();
     }
+    if (record.authenticatableId !== authenticatableId) {
+      throw new PasswordResetInvalidTokenError();
+    }
     const passwordHash = await config.hash.hash(newPassword);
-    await config.updatePasswordHash(record.authenticatableId, passwordHash);
-    await config.updateCredentialsInvalidBefore(record.authenticatableId, instantFns.now());
-    await passwordResetOptions.deleteByAuthenticatableId(record.authenticatableId);
-    return record.authenticatableId;
+    await config.updatePasswordHash(authenticatableId, passwordHash);
+    await config.updateCredentialsInvalidBefore(authenticatableId, instantFns.now());
+    await passwordResetOptions.deleteByAuthenticatableId(authenticatableId);
   }
   return {
     verifyCredentials,

package/package.json

@@ -7,7 +7,7 @@
       "default": "./dist/index.js"
     }
   },
-  "version": "1.0.0-alpha.23",
+  "version": "1.0.0-alpha.4",
   "publishConfig": {
     "access": "restricted"
   },
@@ -16,15 +16,15 @@
   ],
   "dependencies": {
     "iso-fns2": "npm:iso-fns@2.0.0-alpha.26",
-    "@maestro-js/custom-errors": "1.0.0-alpha.23",
-    "@maestro-js/service-registry": "1.0.0-alpha.23"
+    "@maestro-js/service-registry": "1.0.0-alpha.4",
+    "@maestro-js/custom-errors": "1.0.0-alpha.4"
   },
   "peerDependencies": {
-    "@maestro-js/hash": "1.0.0-alpha.23"
+    "@maestro-js/hash": "1.0.0-alpha.4"
   },
   "devDependencies": {
     "@types/node": "^22.19.11",
-    "@maestro-js/hash": "1.0.0-alpha.23"
+    "@maestro-js/hash": "1.0.0-alpha.4"
   },
   "license": "UNLICENSED",
   "engines": {