@proteinjs/user-server 1.20.2 → 1.21.1

package/dist/src/authentication/PasswordResetToken.js

@@ -0,0 +1,138 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PasswordResetToken = void 0;
+var crypto_1 = require("crypto");
+var moment_1 = __importDefault(require("moment"));
+var db_1 = require("@proteinjs/db");
+var user_1 = require("@proteinjs/user");
+/**
+ * The password-reset token's one owner: its shape, its mint, the lookup that maps a presented
+ * value back to the user it was issued to, and its single-use redemption.
+ *
+ * A token is 32 bytes from the platform CSPRNG, hex-encoded (64 lowercase hex characters),
+ * stored on the user row beside its expiry until it is redeemed or expires.
+ *
+ * Resolution refuses anything that is not a value of that shape BEFORE any lookup. A query
+ * filter built from a request value that is not a token does not compare the way a token does:
+ * `null` renders as `IS NULL` and would match every account with no pending reset, an empty
+ * string matches an emptied column, and other types reach the driver. The row the lookup
+ * returns is then re-checked in code — its stored token must be a string equal to the presented
+ * one (compared in constant time) and its expiry a real timestamp still in the future — so the
+ * outcome never rests on how the storage compares.
+ */
+var PasswordResetToken = /** @class */ (function () {
+    function PasswordResetToken() {
+    }
+    PasswordResetToken.prototype.mint = function () {
+        return (0, crypto_1.randomBytes)(32).toString('hex');
+    };
+    PasswordResetToken.prototype.resolve = function (presented) {
+        return __awaiter(this, void 0, void 0, function () {
+            var token, user;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        token = this.parse(presented);
+                        if (token === undefined) {
+                            return [2 /*return*/, { status: 'malformed' }];
+                        }
+                        return [4 /*yield*/, (0, db_1.getDbAsSystem)().get(user_1.tables.User, { passwordResetToken: token })];
+                    case 1:
+                        user = _a.sent();
+                        if (!user || !this.matches(user.passwordResetToken, token)) {
+                            return [2 /*return*/, { status: 'unknown' }];
+                        }
+                        if (!this.isLive(user.passwordResetTokenExpiration)) {
+                            return [2 /*return*/, { status: 'expired', user: user }];
+                        }
+                        return [2 /*return*/, { status: 'live', user: user, token: token }];
+                }
+            });
+        });
+    };
+    /**
+     * Write the new credential and clear the token in one conditional update: the row must still
+     * carry this token at write time, so two presentations of the same token cannot both succeed.
+     * Resolves false when the token was already redeemed.
+     */
+    PasswordResetToken.prototype.redeem = function (user, token, hashedPassword) {
+        return __awaiter(this, void 0, void 0, function () {
+            var updated;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().update(user_1.tables.User, { password: hashedPassword, passwordResetToken: null, passwordResetTokenExpiration: null }, { id: user.id, passwordResetToken: token })];
+                    case 1:
+                        updated = _a.sent();
+                        return [2 /*return*/, updated === 1];
+                }
+            });
+        });
+    };
+    /** A log-safe reference to a presented token: a short digest of a well-formed one, never the value itself. */
+    PasswordResetToken.prototype.fingerprint = function (presented) {
+        var token = this.parse(presented);
+        if (token === undefined) {
+            return undefined;
+        }
+        return (0, crypto_1.createHash)('sha256').update(token).digest('hex').slice(0, 12);
+    };
+    PasswordResetToken.prototype.parse = function (presented) {
+        return typeof presented === 'string' && PasswordResetToken.SHAPE.test(presented) ? presented : undefined;
+    };
+    PasswordResetToken.prototype.matches = function (stored, presented) {
+        if (typeof stored !== 'string' || stored.length !== presented.length) {
+            return false;
+        }
+        return (0, crypto_1.timingSafeEqual)(Buffer.from(stored), Buffer.from(presented));
+    };
+    PasswordResetToken.prototype.isLive = function (expiration) {
+        if (!expiration) {
+            return false;
+        }
+        var expiresAt = (0, moment_1.default)(expiration);
+        return expiresAt.isValid() && (0, moment_1.default)().isBefore(expiresAt);
+    };
+    PasswordResetToken.SHAPE = /^[0-9a-f]{64}$/;
+    return PasswordResetToken;
+}());
+exports.PasswordResetToken = PasswordResetToken;
+//# sourceMappingURL=PasswordResetToken.js.map

package/dist/src/authentication/PasswordResetToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordResetToken.js","sourceRoot":"","sources":["../../../src/authentication/PasswordResetToken.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iCAAkE;AAClE,kDAAwC;AACxC,oCAA8C;AAC9C,wCAA+C;AAQ/C;;;;;;;;;;;;;;GAcG;AACH;IAAA;IAqEA,CAAC;IAlEC,iCAAI,GAAJ;QACE,OAAO,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAEK,oCAAO,GAAb,UAAc,SAAkB;;;;;;wBACxB,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;wBACpC,IAAI,KAAK,KAAK,SAAS,EAAE;4BACvB,sBAAO,EAAE,MAAM,EAAE,WAAW,EAAE,EAAC;yBAChC;wBAEY,qBAAM,IAAA,kBAAa,GAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAA;;wBAA5E,IAAI,GAAG,SAAqE;wBAClF,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,CAAC,EAAE;4BAC1D,sBAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAC;yBAC9B;wBAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,EAAE;4BACnD,sBAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,MAAA,EAAE,EAAC;yBACpC;wBAED,sBAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,MAAA,EAAE,KAAK,OAAA,EAAE,EAAC;;;;KACxC;IAED;;;;OAIG;IACG,mCAAM,GAAZ,UAAa,IAAU,EAAE,KAAa,EAAE,cAAsB;;;;;4BAC5C,qBAAM,IAAA,kBAAa,GAAE,CAAC,MAAM,CAC1C,aAAM,CAAC,IAAI,EACX,EAAE,QAAQ,EAAE,cAAc,EAAE,kBAAkB,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,EAC1F,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAC3C,EAAA;;wBAJK,OAAO,GAAG,SAIf;wBACD,sBAAO,OAAO,KAAK,CAAC,EAAC;;;;KACtB;IAED,8GAA8G;IAC9G,wCAAW,GAAX,UAAY,SAAkB;QAC5B,IAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS,EAAE;YACvB,OAAO,SAAS,CAAC;SAClB;QAED,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IAEO,kCAAK,GAAb,UAAc,SAAkB;QAC9B,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3G,CAAC;IAEO,oCAAO,GAAf,UAAgB,MAAiC,EAAE,SAAiB;QAClE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,EAAE;YACpE,OAAO,KAAK,CAAC;SACd;QAED,OAAO,IAAA,wBAAe,EAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACtE,CAAC;IAEO,mCAAM,GAAd,UAAe,UAAqC;QAClD,IAAI,CAAC,UAAU,EAAE;YACf,OAAO,KAAK,CAAC;SACd;QAED,IAAM,SAAS,GAAG,IAAA,gBAAM,EAAC,UAAU,CAAC,CAAC;QACrC,OAAO,SAAS,CAAC,OAAO,EAAE,IAAI,IAAA,gBAAM,GAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC7D,CAAC;IAnEuB,wBAAK,GAAG,gBAAgB,CAAC;IAoEnD,yBAAC;CAAA,AArED,IAqEC;AArEY,gDAAkB"}

package/dist/src/routes/executePasswordReset.d.ts

@@ -2,13 +2,13 @@ import { Route } from '@proteinjs/server-api';
 /**
  * Route handler for executing a password reset.
  *
- * This function handles the process of resetting a user's password using a provided reset token.
- * It verifies the token, checks its expiration, and updates the user's password if everything is valid.
+ * Resolves the presented token through `PasswordResetToken` — which refuses anything but a
+ * well-formed token before any lookup — checks its expiry, and redeems it: the new password is
+ * written and the token cleared in one conditional update, so a token resets a password once.
+ * The token itself never reaches the log.
  *
  * @bodyParam {string} token - The password reset token.
  * @bodyParam {string} newPassword - The new password for the user.
- *
- * @throws {Error} If there's an issue with the database operations or if the token is invalid or expired.
  */
 export declare const executePasswordReset: Route;
 //# sourceMappingURL=executePasswordReset.d.ts.map

package/dist/src/routes/executePasswordReset.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"executePasswordReset.d.ts","sourceRoot":"","sources":["../../../src/routes/executePasswordReset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAO9C;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,EAAE,KAqClC,CAAC"}
+{"version":3,"file":"executePasswordReset.d.ts","sourceRoot":"","sources":["../../../src/routes/executePasswordReset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAM9C;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,EAAE,KAuClC,CAAC"}

package/dist/src/routes/executePasswordReset.js

@@ -35,64 +35,65 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
         if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
     }
 };
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.executePasswordReset = void 0;
-var db_1 = require("@proteinjs/db");
 var user_1 = require("@proteinjs/user");
 var logger_1 = require("@proteinjs/logger");
-var moment_1 = __importDefault(require("moment"));
 var PasswordHasher_1 = require("../authentication/PasswordHasher");
+var PasswordResetToken_1 = require("../authentication/PasswordResetToken");
 /**
  * Route handler for executing a password reset.
  *
- * This function handles the process of resetting a user's password using a provided reset token.
- * It verifies the token, checks its expiration, and updates the user's password if everything is valid.
+ * Resolves the presented token through `PasswordResetToken` — which refuses anything but a
+ * well-formed token before any lookup — checks its expiry, and redeems it: the new password is
+ * written and the token cleared in one conditional update, so a token resets a password once.
+ * The token itself never reaches the log.
  *
  * @bodyParam {string} token - The password reset token.
  * @bodyParam {string} newPassword - The new password for the user.
- *
- * @throws {Error} If there's an issue with the database operations or if the token is invalid or expired.
  */
 exports.executePasswordReset = {
     path: user_1.routes.executePasswordReset.path,
     method: user_1.routes.executePasswordReset.method,
     onRequest: function (request, response) { return __awaiter(void 0, void 0, void 0, function () {
-        var logger, _a, token, newPassword, db, user, currentTime, tokenExpiration, hashedPassword;
+        var logger, _a, token, newPassword, resetToken, resolution, user, hashedPassword;
         return __generator(this, function (_b) {
             switch (_b.label) {
                 case 0:
                     logger = new logger_1.Logger({ name: 'executePasswordReset' });
                     _a = request.body, token = _a.token, newPassword = _a.newPassword;
-                    db = (0, db_1.getDbAsSystem)();
-                    return [4 /*yield*/, db.get(user_1.tables.User, { passwordResetToken: token })];
+                    if (typeof newPassword !== 'string' || newPassword.length === 0) {
+                        response.status(400).send({ error: 'New password cannot be blank' });
+                        return [2 /*return*/];
+                    }
+                    resetToken = new PasswordResetToken_1.PasswordResetToken();
+                    return [4 /*yield*/, resetToken.resolve(token)];
                 case 1:
-                    user = _b.sent();
-                    if (!user) {
-                        logger.info({ message: "Invalid reset token used", obj: { token: token } });
+                    resolution = _b.sent();
+                    if (resolution.status === 'malformed' || resolution.status === 'unknown') {
+                        logger.info({
+                            message: "Invalid reset token used",
+                            obj: { reason: resolution.status, token: resetToken.fingerprint(token) },
+                        });
                         response.status(400).send({ error: 'Invalid or expired reset token' });
                         return [2 /*return*/];
                     }
-                    currentTime = (0, moment_1.default)();
-                    tokenExpiration = (0, moment_1.default)(user.passwordResetTokenExpiration);
-                    if (currentTime.isAfter(tokenExpiration)) {
-                        logger.info({ message: "Expired reset token used", obj: { email: user.email } });
+                    if (resolution.status === 'expired') {
+                        logger.info({ message: "Expired reset token used", obj: { email: resolution.user.email } });
                         response.status(400).send({ error: 'Reset token has expired' });
                         return [2 /*return*/];
                     }
+                    user = resolution.user;
                     return [4 /*yield*/, new PasswordHasher_1.PasswordHasher().hash(newPassword)];
                 case 2:
                     hashedPassword = _b.sent();
-                    return [4 /*yield*/, db.update(user_1.tables.User, {
-                            id: user.id,
-                            password: hashedPassword,
-                            passwordResetToken: null,
-                            passwordResetTokenExpiration: null,
-                        })];
+                    return [4 /*yield*/, resetToken.redeem(user, resolution.token, hashedPassword)];
                 case 3:
-                    _b.sent();
+                    if (!(_b.sent())) {
+                        logger.info({ message: "Reset token already redeemed", obj: { email: user.email } });
+                        response.status(400).send({ error: 'Invalid or expired reset token' });
+                        return [2 /*return*/];
+                    }
                     logger.info({ message: "Password successfully reset", obj: { email: user.email } });
                     response.send({ message: 'Password has been successfully reset' });
                     return [2 /*return*/];

package/dist/src/routes/executePasswordReset.js.map

@@ -1 +1 @@
-{"version":3,"file":"executePasswordReset.js","sourceRoot":"","sources":["../../../src/routes/executePasswordReset.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,oCAA8C;AAC9C,wCAAiD;AACjD,4CAA2C;AAC3C,kDAA4B;AAC5B,mEAAkE;AAElE;;;;;;;;;;GAUG;AACU,QAAA,oBAAoB,GAAU;IACzC,IAAI,EAAE,aAAM,CAAC,oBAAoB,CAAC,IAAI;IACtC,MAAM,EAAE,aAAM,CAAC,oBAAoB,CAAC,MAAM;IAC1C,SAAS,EAAE,UAAO,OAAO,EAAE,QAAQ;;;;;oBAC3B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;oBACtD,KAAyB,OAAO,CAAC,IAAI,EAAnC,KAAK,WAAA,EAAE,WAAW,iBAAA,CAAkB;oBACtC,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;oBAGd,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAA;;oBAA/D,IAAI,GAAG,SAAwD;oBACrE,IAAI,CAAC,IAAI,EAAE;wBACT,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;wBACrE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;wBACvE,sBAAO;qBACR;oBAGK,WAAW,GAAG,IAAA,gBAAM,GAAE,CAAC;oBACvB,eAAe,GAAG,IAAA,gBAAM,EAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;oBAClE,IAAI,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE;wBACxC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;wBACjF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;wBAChE,sBAAO;qBACR;oBAGsB,qBAAM,IAAI,+BAAc,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAAA;;oBAA7D,cAAc,GAAG,SAA4C;oBACnE,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE;4BAC3B,EAAE,EAAE,IAAI,CAAC,EAAE;4BACX,QAAQ,EAAE,cAAc;4BACxB,kBAAkB,EAAE,IAAI;4BACxB,4BAA4B,EAAE,IAAI;yBACnC,CAAC,EAAA;;oBALF,SAKE,CAAC;oBAEH,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACpF,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC;;;;SACpE;CACF,CAAC"}
+{"version":3,"file":"executePasswordReset.js","sourceRoot":"","sources":["../../../src/routes/executePasswordReset.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,wCAAyC;AACzC,4CAA2C;AAC3C,mEAAkE;AAClE,2EAA0E;AAE1E;;;;;;;;;;GAUG;AACU,QAAA,oBAAoB,GAAU;IACzC,IAAI,EAAE,aAAM,CAAC,oBAAoB,CAAC,IAAI;IACtC,MAAM,EAAE,aAAM,CAAC,oBAAoB,CAAC,MAAM;IAC1C,SAAS,EAAE,UAAO,OAAO,EAAE,QAAQ;;;;;oBAC3B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;oBACtD,KAAyB,OAAO,CAAC,IAAI,EAAnC,KAAK,WAAA,EAAE,WAAW,iBAAA,CAAkB;oBAC5C,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE;wBAC/D,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;wBACrE,sBAAO;qBACR;oBAEK,UAAU,GAAG,IAAI,uCAAkB,EAAE,CAAC;oBACzB,qBAAM,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,EAAA;;oBAA5C,UAAU,GAAG,SAA+B;oBAClD,IAAI,UAAU,CAAC,MAAM,KAAK,WAAW,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE;wBACxE,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,0BAA0B;4BACnC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE;yBACzE,CAAC,CAAC;wBACH,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;wBACvE,sBAAO;qBACR;oBAED,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE;wBACnC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;wBAC5F,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;wBAChE,sBAAO;qBACR;oBAEO,IAAI,GAAK,UAAU,KAAf,CAAgB;oBACL,qBAAM,IAAI,+BAAc,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAAA;;oBAA7D,cAAc,GAAG,SAA4C;oBAC7D,qBAAM,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,KAAK,EAAE,cAAc,CAAC,EAAA;;oBAArE,IAAI,CAAC,CAAC,SAA+D,CAAC,EAAE;wBACtE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;wBACrF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;wBACvE,sBAAO;qBACR;oBAED,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACpF,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC;;;;SACpE;CACF,CAAC"}

package/dist/src/routes/initiatePasswordReset.js

@@ -56,7 +56,7 @@ var user_1 = require("@proteinjs/user");
 var logger_1 = require("@proteinjs/logger");
 var moment_1 = __importDefault(require("moment"));
 var email_server_1 = require("@proteinjs/email-server");
-var crypto_js_1 = require("crypto-js");
+var PasswordResetToken_1 = require("../authentication/PasswordResetToken");
 /**
  * Route for initiating a password reset process.
  *
@@ -108,7 +108,7 @@ exports.initiatePasswordReset = {
                     if (!defaultConfigFactory) {
                         throw new Error("Unable to find a @proteinjs/email-server/DefaultPasswordResetEmailConfigFactory implementation when initiating password reset.");
                     }
-                    passwordResetToken = crypto_js_1.lib.WordArray.random(32).toString();
+                    passwordResetToken = new PasswordResetToken_1.PasswordResetToken().mint();
                     passwordResetTokenExpiration = (0, moment_1.default)().add(1, 'hour');
                     _d.label = 2;
                 case 2:

package/dist/src/routes/initiatePasswordReset.js.map

@@ -1 +1 @@
-{"version":3,"file":"initiatePasswordReset.js","sourceRoot":"","sources":["../../../src/routes/initiatePasswordReset.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,oCAA8C;AAC9C,wCAA2D;AAC3D,4CAA2C;AAC3C,kDAA4B;AAC5B,wDAGiC;AACjC,uCAAgC;AAEhC;;;;;;;;;;;;GAYG;AACU,QAAA,qBAAqB,GAAU;IAC1C,IAAI,EAAE,aAAM,CAAC,qBAAqB,CAAC,IAAI;IACvC,MAAM,EAAE,aAAM,CAAC,qBAAqB,CAAC,MAAM;IAC3C,SAAS,EAAE,UAAO,OAAO,EAAE,QAAQ;;;;;;oBAC3B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;oBACvD,KAAK,GAAG,MAAA,OAAO,CAAC,IAAI,CAAC,KAAK,0CAAE,WAAW,EAAE,CAAC;oBAC1C,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;oBAErB,eAAe,GAAG,EAAE,OAAO,EAAE,2EAA2E,EAAE,CAAC;oBAEpG,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;;oBAA3C,IAAI,GAAG,SAAoC;oBACjD,IAAI,CAAC,IAAI,EAAE;wBACT,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,gDAAgD,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;wBAC3F,2CAA2C;wBAC3C,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;wBAC/B,sBAAO;qBACR;oBAED,sEAAsE;oBACtE,IAAI,IAAI,CAAC,kBAAkB,IAAI,IAAI,CAAC,4BAA4B,EAAE;wBAC1D,WAAW,GAAG,IAAA,gBAAM,GAAE,CAAC;wBACvB,iBAAiB,GAAG,IAAA,gBAAM,EAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;wBAClF,cAAc,GAAG,WAAW,CAAC,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;wBACtE,IAAI,cAAc,GAAG,CAAC,EAAE;4BACtB,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;4BACvF,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;4BAC/B,sBAAO;yBACR;qBACF;oBAEK,WAAW,GAAG,IAAI,0BAAW,EAAE,CAAC;oBAEhC,oBAAoB,GAAG,IAAA,wDAAuB,GAAE,CAAC;oBACvD,IAAI,CAAC,oBAAoB,EAAE;wBACzB,MAAM,IAAI,KAAK,CACb,gIAAgI,CACjI,CAAC;qBACH;oBAGK,kBAAkB,GAAG,eAAG,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;oBACzD,4BAA4B,GAAG,IAAA,gBAAM,GAAE,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;;;;oBAGrD,MAAM,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC;oBAC1C,KAAiB,MAAM,CAAC,eAAe,CAAC,UAAG,eAAQ,CAAC,IAAI,CAAC,aAAa,oBAAU,kBAAkB,CAAE,CAAC,EAAnG,IAAI,UAAA,EAAE,IAAI,UAAA,CAA0F;oBAE5G,qCAAqC;oBACrC,qBAAM,WAAW,CAAC,SAAS,YACzB,EAAE,EAAE,IAAI,CAAC,KAAK,EACd,OAAO,EAAE,CAAA,MAAA,MAAM,CAAC,OAAO,0CAAE,OAAO,KAAI,gBAAgB,EACpD,IAAI,MAAA,EACJ,IAAI,MAAA,IACD,MAAM,CAAC,OAAO,EACjB,EAAA;;oBAPF,qCAAqC;oBACrC,SAME,CAAC;oBAEH,iEAAiE;oBACjE,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,kBAAkB,oBAAA,EAAE,4BAA4B,8BAAA,EAAE,CAAC,EAAA;;oBAD/F,iEAAiE;oBACjE,SAA+F,CAAC;oBAChG,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;;;;oBAE/B,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,KAAK,SAAA,EAAE,CAAC,CAAC;oBACxF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8DAA8D,EAAE,CAAC,CAAC;;;;;SAExG;CACF,CAAC"}
+{"version":3,"file":"initiatePasswordReset.js","sourceRoot":"","sources":["../../../src/routes/initiatePasswordReset.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,oCAA8C;AAC9C,wCAA2D;AAC3D,4CAA2C;AAC3C,kDAA4B;AAC5B,wDAGiC;AACjC,2EAA0E;AAE1E;;;;;;;;;;;;GAYG;AACU,QAAA,qBAAqB,GAAU;IAC1C,IAAI,EAAE,aAAM,CAAC,qBAAqB,CAAC,IAAI;IACvC,MAAM,EAAE,aAAM,CAAC,qBAAqB,CAAC,MAAM;IAC3C,SAAS,EAAE,UAAO,OAAO,EAAE,QAAQ;;;;;;oBAC3B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;oBACvD,KAAK,GAAG,MAAA,OAAO,CAAC,IAAI,CAAC,KAAK,0CAAE,WAAW,EAAE,CAAC;oBAC1C,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;oBAErB,eAAe,GAAG,EAAE,OAAO,EAAE,2EAA2E,EAAE,CAAC;oBAEpG,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;;oBAA3C,IAAI,GAAG,SAAoC;oBACjD,IAAI,CAAC,IAAI,EAAE;wBACT,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,gDAAgD,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;wBAC3F,2CAA2C;wBAC3C,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;wBAC/B,sBAAO;qBACR;oBAED,sEAAsE;oBACtE,IAAI,IAAI,CAAC,kBAAkB,IAAI,IAAI,CAAC,4BAA4B,EAAE;wBAC1D,WAAW,GAAG,IAAA,gBAAM,GAAE,CAAC;wBACvB,iBAAiB,GAAG,IAAA,gBAAM,EAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;wBAClF,cAAc,GAAG,WAAW,CAAC,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;wBACtE,IAAI,cAAc,GAAG,CAAC,EAAE;4BACtB,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;4BACvF,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;4BAC/B,sBAAO;yBACR;qBACF;oBAEK,WAAW,GAAG,IAAI,0BAAW,EAAE,CAAC;oBAEhC,oBAAoB,GAAG,IAAA,wDAAuB,GAAE,CAAC;oBACvD,IAAI,CAAC,oBAAoB,EAAE;wBACzB,MAAM,IAAI,KAAK,CACb,gIAAgI,CACjI,CAAC;qBACH;oBAGK,kBAAkB,GAAG,IAAI,uCAAkB,EAAE,CAAC,IAAI,EAAE,CAAC;oBACrD,4BAA4B,GAAG,IAAA,gBAAM,GAAE,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;;;;oBAGrD,MAAM,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC;oBAC1C,KAAiB,MAAM,CAAC,eAAe,CAAC,UAAG,eAAQ,CAAC,IAAI,CAAC,aAAa,oBAAU,kBAAkB,CAAE,CAAC,EAAnG,IAAI,UAAA,EAAE,IAAI,UAAA,CAA0F;oBAE5G,qCAAqC;oBACrC,qBAAM,WAAW,CAAC,SAAS,YACzB,EAAE,EAAE,IAAI,CAAC,KAAK,EACd,OAAO,EAAE,CAAA,MAAA,MAAM,CAAC,OAAO,0CAAE,OAAO,KAAI,gBAAgB,EACpD,IAAI,MAAA,EACJ,IAAI,MAAA,IACD,MAAM,CAAC,OAAO,EACjB,EAAA;;oBAPF,qCAAqC;oBACrC,SAME,CAAC;oBAEH,iEAAiE;oBACjE,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,kBAAkB,oBAAA,EAAE,4BAA4B,8BAAA,EAAE,CAAC,EAAA;;oBAD/F,iEAAiE;oBACjE,SAA+F,CAAC;oBAChG,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;;;;oBAE/B,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,KAAK,SAAA,EAAE,CAAC,CAAC;oBACxF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8DAA8D,EAAE,CAAC,CAAC;;;;;SAExG;CACF,CAAC"}

package/dist/src/routes/validateResetPasswordToken.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validateResetPasswordToken.d.ts","sourceRoot":"","sources":["../../../src/routes/validateResetPasswordToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAM9C,eAAO,MAAM,0BAA0B,EAAE,KAoCxC,CAAC"}
+{"version":3,"file":"validateResetPasswordToken.d.ts","sourceRoot":"","sources":["../../../src/routes/validateResetPasswordToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAK9C,eAAO,MAAM,0BAA0B,EAAE,KAkCxC,CAAC"}

package/dist/src/routes/validateResetPasswordToken.js

@@ -35,42 +35,39 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
         if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
     }
 };
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.validateResetPasswordToken = void 0;
-var db_1 = require("@proteinjs/db");
 var user_1 = require("@proteinjs/user");
 var logger_1 = require("@proteinjs/logger");
-var moment_1 = __importDefault(require("moment"));
+var PasswordResetToken_1 = require("../authentication/PasswordResetToken");
 exports.validateResetPasswordToken = {
     path: user_1.routes.validateResetToken.path,
     method: user_1.routes.validateResetToken.method,
     onRequest: function (request, response) { return __awaiter(void 0, void 0, void 0, function () {
-        var logger, token, db, user, currentTime, tokenExpiration;
+        var logger, token, resetToken, resolution;
         return __generator(this, function (_a) {
             switch (_a.label) {
                 case 0:
                     logger = new logger_1.Logger({ name: 'validateResetToken' });
                     token = request.query.token;
-                    db = (0, db_1.getDbAsSystem)();
                     if (!token) {
                         response.status(400).send({ isValid: false, message: 'No token provided' });
                         return [2 /*return*/];
                     }
-                    return [4 /*yield*/, db.get(user_1.tables.User, { passwordResetToken: token })];
+                    resetToken = new PasswordResetToken_1.PasswordResetToken();
+                    return [4 /*yield*/, resetToken.resolve(token)];
                 case 1:
-                    user = _a.sent();
-                    if (!user) {
-                        logger.info({ message: "Invalid reset token used", obj: { token: token } });
+                    resolution = _a.sent();
+                    if (resolution.status === 'malformed' || resolution.status === 'unknown') {
+                        logger.info({
+                            message: "Invalid reset token used",
+                            obj: { reason: resolution.status, token: resetToken.fingerprint(token) },
+                        });
                         response.status(200).send({ isValid: false, message: 'Invalid token' });
                         return [2 /*return*/];
                     }
-                    currentTime = (0, moment_1.default)();
-                    tokenExpiration = (0, moment_1.default)(user.passwordResetTokenExpiration);
-                    if (currentTime.isAfter(tokenExpiration)) {
-                        logger.info({ message: "Expired reset token used", obj: { email: user.email } });
+                    if (resolution.status === 'expired') {
+                        logger.info({ message: "Expired reset token used", obj: { email: resolution.user.email } });
                         response.status(200).send({ isValid: false, message: 'Token has expired' });
                         return [2 /*return*/];
                     }
@@ -78,7 +75,7 @@ exports.validateResetPasswordToken = {
                     // read-only `autocomplete="username"` field so password managers associate the updated
                     // password with the stored credential. The token was delivered to this very inbox, so a
                     // valid-token holder learns nothing new; invalid/expired verdicts stay email-free.
-                    response.status(200).send({ isValid: true, email: user.email });
+                    response.status(200).send({ isValid: true, email: resolution.user.email });
                     return [2 /*return*/];
             }
         });

package/dist/src/routes/validateResetPasswordToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"validateResetPasswordToken.js","sourceRoot":"","sources":["../../../src/routes/validateResetPasswordToken.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,oCAA8C;AAC9C,wCAAiD;AACjD,4CAA2C;AAC3C,kDAA4B;AAEf,QAAA,0BAA0B,GAAU;IAC/C,IAAI,EAAE,aAAM,CAAC,kBAAkB,CAAC,IAAI;IACpC,MAAM,EAAE,aAAM,CAAC,kBAAkB,CAAC,MAAM;IACxC,SAAS,EAAE,UAAO,OAAO,EAAE,QAAQ;;;;;oBAC3B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;oBAClD,KAAK,GAAK,OAAO,CAAC,KAAK,MAAlB,CAAmB;oBAC1B,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;oBAE3B,IAAI,CAAC,KAAK,EAAE;wBACV,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;wBAC5E,sBAAO;qBACR;oBAGY,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAA;;oBAA/D,IAAI,GAAG,SAAwD;oBACrE,IAAI,CAAC,IAAI,EAAE;wBACT,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;wBACrE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;wBACxE,sBAAO;qBACR;oBAGK,WAAW,GAAG,IAAA,gBAAM,GAAE,CAAC;oBACvB,eAAe,GAAG,IAAA,gBAAM,EAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;oBAClE,IAAI,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE;wBACxC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;wBACjF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;wBAC5E,sBAAO;qBACR;oBAED,oFAAoF;oBACpF,uFAAuF;oBACvF,wFAAwF;oBACxF,mFAAmF;oBACnF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;;;;SACjE;CACF,CAAC"}
+{"version":3,"file":"validateResetPasswordToken.js","sourceRoot":"","sources":["../../../src/routes/validateResetPasswordToken.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,wCAAyC;AACzC,4CAA2C;AAC3C,2EAA0E;AAE7D,QAAA,0BAA0B,GAAU;IAC/C,IAAI,EAAE,aAAM,CAAC,kBAAkB,CAAC,IAAI;IACpC,MAAM,EAAE,aAAM,CAAC,kBAAkB,CAAC,MAAM;IACxC,SAAS,EAAE,UAAO,OAAO,EAAE,QAAQ;;;;;oBAC3B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;oBAClD,KAAK,GAAK,OAAO,CAAC,KAAK,MAAlB,CAAmB;oBAChC,IAAI,CAAC,KAAK,EAAE;wBACV,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;wBAC5E,sBAAO;qBACR;oBAEK,UAAU,GAAG,IAAI,uCAAkB,EAAE,CAAC;oBACzB,qBAAM,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,EAAA;;oBAA5C,UAAU,GAAG,SAA+B;oBAClD,IAAI,UAAU,CAAC,MAAM,KAAK,WAAW,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE;wBACxE,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,0BAA0B;4BACnC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE;yBACzE,CAAC,CAAC;wBACH,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;wBACxE,sBAAO;qBACR;oBAED,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE;wBACnC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;wBAC5F,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;wBAC5E,sBAAO;qBACR;oBAED,oFAAoF;oBACpF,uFAAuF;oBACvF,wFAAwF;oBACxF,mFAAmF;oBACnF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;;;;SAC5E;CACF,CAAC"}

package/dist/src/services/Signup.d.ts

@@ -50,6 +50,14 @@ export declare class Signup implements SignupService {
      */
     createUser(user: UserSignup, token?: string): Promise<CreateUserResult>;
     sendInvite(email: string): Promise<SendInviteResponse>;
+    /**
+     * Re-sends a standing invite: the token in the earlier email stops working, a fresh token with
+     * a fresh expiry takes its place on the same row (never a second row), and the invite email goes
+     * out again through the same config. Refused when no invite stands for the address — there is
+     * nothing to re-send — and when the address already has an account (the invite was used).
+     * The inviter stays whoever sent it first.
+     */
+    resendInvite(email: string): Promise<SendInviteResponse>;
     revokeInvite(email: string): Promise<void>;
     /**
      * Initializes signup process, validating invite configuration and token if provided.
@@ -73,5 +81,11 @@ export declare class Signup implements SignupService {
     }): Promise<'created' | 'exists'>;
     /** Resolves an invite token, distinguishing "expired" from "never existed / already revoked". */
     private lookupInvite;
+    /** The invite email content factory the consumer registers; its absence is a misconfiguration, said aloud. */
+    private inviteEmailConfig;
+    /** A fresh redeemable token with its expiry from the TTL knob — the one minting path for send and re-send. */
+    private mintInviteToken;
+    /** The invite email itself — the signup link carrying `token`, rendered by the consumer's config. */
+    private emailInvite;
 }
 //# sourceMappingURL=Signup.d.ts.map

package/dist/src/services/Signup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Signup.d.ts","sourceRoot":"","sources":["../../../src/services/Signup.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,EAIlB,aAAa,EACb,wBAAwB,EAExB,MAAM,EACN,IAAI,EACJ,UAAU,EAEX,MAAM,iBAAiB,CAAC;AASzB,OAAO,EAAE,QAAQ,EAAoB,MAAM,uBAAuB,CAAC;AAGnE;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,CAAC;AAEhH,MAAM,WAAW,0BAA2B,SAAQ,QAAQ;IAC1D,SAAS,IAAI,YAAY,CAAC;CAC3B;AAED,eAAO,MAAM,6BAA6B,QAAO,0BAShD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC9B,0FAA0F;IAC1F,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,qBAAa,MAAO,YAAW,aAAa;IACnC,eAAe;;oCAEM,MAAM,QAAQ,GAAG,EAAE;;MAY7C;IAEF;;;;;OAKG;IACG,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA2DvE,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA0DtD,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWhD;;;OAGG;IACG,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAoD1F;;;;;;;OAOG;IACG,aAAa,CAAC,OAAO,EAAE;QAC3B,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,aAAa,EAAE,OAAO,CAAC;QACvB,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;KAC9B,GAAG,OAAO,CAAC,SAAS,GAAG,QAAQ,CAAC;IAmBjC,iGAAiG;YACnF,YAAY;CAc3B"}
+{"version":3,"file":"Signup.d.ts","sourceRoot":"","sources":["../../../src/services/Signup.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,EAIlB,aAAa,EACb,wBAAwB,EAExB,MAAM,EACN,IAAI,EACJ,UAAU,EAEX,MAAM,iBAAiB,CAAC;AAUzB,OAAO,EAAE,QAAQ,EAAoB,MAAM,uBAAuB,CAAC;AAGnE;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,CAAC;AAEhH,MAAM,WAAW,0BAA2B,SAAQ,QAAQ;IAC1D,SAAS,IAAI,YAAY,CAAC;CAC3B;AAED,eAAO,MAAM,6BAA6B,QAAO,0BAShD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC9B,0FAA0F;IAC1F,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,qBAAa,MAAO,YAAW,aAAa;IACnC,eAAe;;oCAEM,MAAM,QAAQ,GAAG,EAAE;;MAY7C;IAEF;;;;;OAKG;IACG,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA2DvE,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAyC5D;;;;;;OAMG;IACG,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA4BxD,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWhD;;;OAGG;IACG,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAoD1F;;;;;;;OAOG;IACG,aAAa,CAAC,OAAO,EAAE;QAC3B,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,aAAa,EAAE,OAAO,CAAC;QACvB,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;KAC9B,GAAG,OAAO,CAAC,SAAS,GAAG,QAAQ,CAAC;IAmBjC,iGAAiG;YACnF,YAAY;IAe1B,8GAA8G;IAC9G,OAAO,CAAC,iBAAiB;IAUzB,8GAA8G;IAC9G,OAAO,CAAC,eAAe;IAOvB,qGAAqG;YACvF,WAAW;CAU1B"}

package/dist/src/services/Signup.js

@@ -82,7 +82,7 @@ var Signup = /** @class */ (function () {
                     // previously evaluated the check WITHOUT returning it, which made sendInvite/revokeInvite
                     // effectively public — any caller (even logged out) could mint themselves a valid signup
                     // token and bypass invite-only signup.
-                    if (methodName === 'sendInvite' || methodName === 'revokeInvite') {
+                    if (methodName === 'sendInvite' || methodName === 'resendInvite' || methodName === 'revokeInvite') {
                         return user_1.UserAuth.hasPermission(user_1.USER_PERMISSIONS.users);
                     }
                     return true;
@@ -155,40 +155,33 @@ var Signup = /** @class */ (function () {
         });
     };
     Signup.prototype.sendInvite = function (email) {
-        var _a;
         return __awaiter(this, void 0, void 0, function () {
-            var logger, caseInsensitiveEmail, db, userRecord, emailSender, defaultConfigFactory, config, token, tokenExpiresAt, invite, userId, _b, text, html, error_1;
-            return __generator(this, function (_c) {
-                switch (_c.label) {
+            var logger, caseInsensitiveEmail, db, userRecord, config, _a, token, tokenExpiresAt, invite, userId, error_1;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
                     case 0:
                         logger = new logger_1.Logger({ name: 'Signup.sendInvite' });
                         caseInsensitiveEmail = email.toLowerCase();
-                        _c.label = 1;
+                        _b.label = 1;
                     case 1:
-                        _c.trys.push([1, 9, , 10]);
+                        _b.trys.push([1, 9, , 10]);
                         db = (0, db_1.getDbAsSystem)();
                         return [4 /*yield*/, db.get(user_1.tables.User, { email: caseInsensitiveEmail })];
                     case 2:
-                        userRecord = _c.sent();
+                        userRecord = _b.sent();
                         if (userRecord) {
                             return [2 /*return*/, { sent: false, error: 'User already exists with that email.' }];
                         }
-                        emailSender = new email_server_1.EmailSender();
-                        defaultConfigFactory = (0, email_server_1.getDefaultInviteEmailConfigFactory)();
-                        if (!defaultConfigFactory) {
-                            throw new Error("Unable to find a @proteinjs/email-server/DefaultInviteEmailConfigFactory implementation when sending invite.");
-                        }
-                        config = defaultConfigFactory.getConfig();
-                        token = crypto_js_1.lib.WordArray.random(32).toString();
-                        tokenExpiresAt = (0, moment_1.default)().add(exports.INVITE_TOKEN_TTL_DAYS, 'days');
+                        config = this.inviteEmailConfig();
+                        _a = this.mintInviteToken(), token = _a.token, tokenExpiresAt = _a.tokenExpiresAt;
                         return [4 /*yield*/, db.get(user_1.tables.Invite, { email: caseInsensitiveEmail })];
                     case 3:
-                        invite = _c.sent();
+                        invite = _b.sent();
                         if (!invite) return [3 /*break*/, 5];
                         invite = __assign(__assign({}, invite), { token: token, tokenExpiresAt: tokenExpiresAt });
                         return [4 /*yield*/, db.update(user_1.tables.Invite, invite)];
                     case 4:
-                        _c.sent();
+                        _b.sent();
                         return [3 /*break*/, 7];
                     case 5:
                         userId = new user_1.UserRepo().getUser().id;
@@ -199,16 +192,14 @@ var Signup = /** @class */ (function () {
                                 invitedBy: new db_1.Reference(user_1.tables.User.name, userId),
                             })];
                     case 6:
-                        invite = _c.sent();
-                        _c.label = 7;
-                    case 7:
-                        _b = config.getEmailContent("".concat(user_1.uiRoutes.auth.signup, "?token=").concat(token)), text = _b.text, html = _b.html;
-                        return [4 /*yield*/, emailSender.sendEmail(__assign({ to: caseInsensitiveEmail, subject: ((_a = config.options) === null || _a === void 0 ? void 0 : _a.subject) || "You're Invited", text: text, html: html }, config.options))];
+                        invite = _b.sent();
+                        _b.label = 7;
+                    case 7: return [4 /*yield*/, this.emailInvite(caseInsensitiveEmail, token, config)];
                     case 8:
-                        _c.sent();
+                        _b.sent();
                         return [2 /*return*/, { sent: true }];
                     case 9:
-                        error_1 = _c.sent();
+                        error_1 = _b.sent();
                         logger.error({ message: 'Error sending invite', obj: { email: caseInsensitiveEmail }, error: error_1 });
                         return [2 /*return*/, {
                                 sent: false,
@@ -219,6 +210,58 @@ var Signup = /** @class */ (function () {
             });
         });
     };
+    /**
+     * Re-sends a standing invite: the token in the earlier email stops working, a fresh token with
+     * a fresh expiry takes its place on the same row (never a second row), and the invite email goes
+     * out again through the same config. Refused when no invite stands for the address — there is
+     * nothing to re-send — and when the address already has an account (the invite was used).
+     * The inviter stays whoever sent it first.
+     */
+    Signup.prototype.resendInvite = function (email) {
+        return __awaiter(this, void 0, void 0, function () {
+            var logger, caseInsensitiveEmail, db, userRecord, invite, config, _a, token, tokenExpiresAt, error_2;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        logger = new logger_1.Logger({ name: 'Signup.resendInvite' });
+                        caseInsensitiveEmail = email.toLowerCase();
+                        _b.label = 1;
+                    case 1:
+                        _b.trys.push([1, 6, , 7]);
+                        db = (0, db_1.getDbAsSystem)();
+                        return [4 /*yield*/, db.get(user_1.tables.User, { email: caseInsensitiveEmail })];
+                    case 2:
+                        userRecord = _b.sent();
+                        if (userRecord) {
+                            return [2 /*return*/, { sent: false, error: 'User already exists with that email.' }];
+                        }
+                        return [4 /*yield*/, db.get(user_1.tables.Invite, { email: caseInsensitiveEmail })];
+                    case 3:
+                        invite = _b.sent();
+                        if (!invite) {
+                            return [2 /*return*/, { sent: false, error: 'No invite exists for that email.' }];
+                        }
+                        config = this.inviteEmailConfig();
+                        _a = this.mintInviteToken(), token = _a.token, tokenExpiresAt = _a.tokenExpiresAt;
+                        return [4 /*yield*/, db.update(user_1.tables.Invite, __assign(__assign({}, invite), { token: token, tokenExpiresAt: tokenExpiresAt }))];
+                    case 4:
+                        _b.sent();
+                        return [4 /*yield*/, this.emailInvite(caseInsensitiveEmail, token, config)];
+                    case 5:
+                        _b.sent();
+                        return [2 /*return*/, { sent: true }];
+                    case 6:
+                        error_2 = _b.sent();
+                        logger.error({ message: 'Error re-sending invite', obj: { email: caseInsensitiveEmail }, error: error_2 });
+                        return [2 /*return*/, {
+                                sent: false,
+                                error: 'Error occurred.',
+                            }];
+                    case 7: return [2 /*return*/];
+                }
+            });
+        });
+    };
     Signup.prototype.revokeInvite = function (email) {
         return __awaiter(this, void 0, void 0, function () {
             var db;
@@ -243,7 +286,7 @@ var Signup = /** @class */ (function () {
      */
     Signup.prototype.initializeSignup = function (inviteToken) {
         return __awaiter(this, void 0, void 0, function () {
-            var config, isInviteOnly, lookup, error_2;
+            var config, isInviteOnly, lookup, error_3;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
@@ -286,7 +329,7 @@ var Signup = /** @class */ (function () {
                                 isInviteOnly: isInviteOnly,
                             }];
                     case 3:
-                        error_2 = _a.sent();
+                        error_3 = _a.sent();
                         return [2 /*return*/, {
                                 isReady: false,
                                 error: 'Initializing sign up failed.',
@@ -360,6 +403,38 @@ var Signup = /** @class */ (function () {
             });
         });
     };
+    /** The invite email content factory the consumer registers; its absence is a misconfiguration, said aloud. */
+    Signup.prototype.inviteEmailConfig = function () {
+        var defaultConfigFactory = (0, email_server_1.getDefaultInviteEmailConfigFactory)();
+        if (!defaultConfigFactory) {
+            throw new Error("Unable to find a @proteinjs/email-server/DefaultInviteEmailConfigFactory implementation when sending invite.");
+        }
+        return defaultConfigFactory.getConfig();
+    };
+    /** A fresh redeemable token with its expiry from the TTL knob — the one minting path for send and re-send. */
+    Signup.prototype.mintInviteToken = function () {
+        return {
+            token: crypto_js_1.lib.WordArray.random(32).toString(),
+            tokenExpiresAt: (0, moment_1.default)().add(exports.INVITE_TOKEN_TTL_DAYS, 'days'),
+        };
+    };
+    /** The invite email itself — the signup link carrying `token`, rendered by the consumer's config. */
+    Signup.prototype.emailInvite = function (email, token, config) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function () {
+            var _b, text, html;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
+                    case 0:
+                        _b = config.getEmailContent("".concat(user_1.uiRoutes.auth.signup, "?token=").concat(token)), text = _b.text, html = _b.html;
+                        return [4 /*yield*/, new email_server_1.EmailSender().sendEmail(__assign({ to: email, subject: ((_a = config.options) === null || _a === void 0 ? void 0 : _a.subject) || "You're Invited", text: text, html: html }, config.options))];
+                    case 1:
+                        _c.sent();
+                        return [2 /*return*/];
+                }
+            });
+        });
+    };
     return Signup;
 }());
 exports.Signup = Signup;