@proteinjs/user-server 1.21.0 → 1.22.0

package/dist/src/authentication/PasswordResetToken.js

@@ -0,0 +1,138 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PasswordResetToken = void 0;
+var crypto_1 = require("crypto");
+var moment_1 = __importDefault(require("moment"));
+var db_1 = require("@proteinjs/db");
+var user_1 = require("@proteinjs/user");
+/**
+ * The password-reset token's one owner: its shape, its mint, the lookup that maps a presented
+ * value back to the user it was issued to, and its single-use redemption.
+ *
+ * A token is 32 bytes from the platform CSPRNG, hex-encoded (64 lowercase hex characters),
+ * stored on the user row beside its expiry until it is redeemed or expires.
+ *
+ * Resolution refuses anything that is not a value of that shape BEFORE any lookup. A query
+ * filter built from a request value that is not a token does not compare the way a token does:
+ * `null` renders as `IS NULL` and would match every account with no pending reset, an empty
+ * string matches an emptied column, and other types reach the driver. The row the lookup
+ * returns is then re-checked in code — its stored token must be a string equal to the presented
+ * one (compared in constant time) and its expiry a real timestamp still in the future — so the
+ * outcome never rests on how the storage compares.
+ */
+var PasswordResetToken = /** @class */ (function () {
+    function PasswordResetToken() {
+    }
+    PasswordResetToken.prototype.mint = function () {
+        return (0, crypto_1.randomBytes)(32).toString('hex');
+    };
+    PasswordResetToken.prototype.resolve = function (presented) {
+        return __awaiter(this, void 0, void 0, function () {
+            var token, user;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        token = this.parse(presented);
+                        if (token === undefined) {
+                            return [2 /*return*/, { status: 'malformed' }];
+                        }
+                        return [4 /*yield*/, (0, db_1.getDbAsSystem)().get(user_1.tables.User, { passwordResetToken: token })];
+                    case 1:
+                        user = _a.sent();
+                        if (!user || !this.matches(user.passwordResetToken, token)) {
+                            return [2 /*return*/, { status: 'unknown' }];
+                        }
+                        if (!this.isLive(user.passwordResetTokenExpiration)) {
+                            return [2 /*return*/, { status: 'expired', user: user }];
+                        }
+                        return [2 /*return*/, { status: 'live', user: user, token: token }];
+                }
+            });
+        });
+    };
+    /**
+     * Write the new credential and clear the token in one conditional update: the row must still
+     * carry this token at write time, so two presentations of the same token cannot both succeed.
+     * Resolves false when the token was already redeemed.
+     */
+    PasswordResetToken.prototype.redeem = function (user, token, hashedPassword) {
+        return __awaiter(this, void 0, void 0, function () {
+            var updated;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().update(user_1.tables.User, { password: hashedPassword, passwordResetToken: null, passwordResetTokenExpiration: null }, { id: user.id, passwordResetToken: token })];
+                    case 1:
+                        updated = _a.sent();
+                        return [2 /*return*/, updated === 1];
+                }
+            });
+        });
+    };
+    /** A log-safe reference to a presented token: a short digest of a well-formed one, never the value itself. */
+    PasswordResetToken.prototype.fingerprint = function (presented) {
+        var token = this.parse(presented);
+        if (token === undefined) {
+            return undefined;
+        }
+        return (0, crypto_1.createHash)('sha256').update(token).digest('hex').slice(0, 12);
+    };
+    PasswordResetToken.prototype.parse = function (presented) {
+        return typeof presented === 'string' && PasswordResetToken.SHAPE.test(presented) ? presented : undefined;
+    };
+    PasswordResetToken.prototype.matches = function (stored, presented) {
+        if (typeof stored !== 'string' || stored.length !== presented.length) {
+            return false;
+        }
+        return (0, crypto_1.timingSafeEqual)(Buffer.from(stored), Buffer.from(presented));
+    };
+    PasswordResetToken.prototype.isLive = function (expiration) {
+        if (!expiration) {
+            return false;
+        }
+        var expiresAt = (0, moment_1.default)(expiration);
+        return expiresAt.isValid() && (0, moment_1.default)().isBefore(expiresAt);
+    };
+    PasswordResetToken.SHAPE = /^[0-9a-f]{64}$/;
+    return PasswordResetToken;
+}());
+exports.PasswordResetToken = PasswordResetToken;
+//# sourceMappingURL=PasswordResetToken.js.map

package/dist/src/authentication/PasswordResetToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordResetToken.js","sourceRoot":"","sources":["../../../src/authentication/PasswordResetToken.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iCAAkE;AAClE,kDAAwC;AACxC,oCAA8C;AAC9C,wCAA+C;AAQ/C;;;;;;;;;;;;;;GAcG;AACH;IAAA;IAqEA,CAAC;IAlEC,iCAAI,GAAJ;QACE,OAAO,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAEK,oCAAO,GAAb,UAAc,SAAkB;;;;;;wBACxB,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;wBACpC,IAAI,KAAK,KAAK,SAAS,EAAE;4BACvB,sBAAO,EAAE,MAAM,EAAE,WAAW,EAAE,EAAC;yBAChC;wBAEY,qBAAM,IAAA,kBAAa,GAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAA;;wBAA5E,IAAI,GAAG,SAAqE;wBAClF,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,CAAC,EAAE;4BAC1D,sBAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAC;yBAC9B;wBAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,EAAE;4BACnD,sBAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,MAAA,EAAE,EAAC;yBACpC;wBAED,sBAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,MAAA,EAAE,KAAK,OAAA,EAAE,EAAC;;;;KACxC;IAED;;;;OAIG;IACG,mCAAM,GAAZ,UAAa,IAAU,EAAE,KAAa,EAAE,cAAsB;;;;;4BAC5C,qBAAM,IAAA,kBAAa,GAAE,CAAC,MAAM,CAC1C,aAAM,CAAC,IAAI,EACX,EAAE,QAAQ,EAAE,cAAc,EAAE,kBAAkB,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,EAC1F,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAC3C,EAAA;;wBAJK,OAAO,GAAG,SAIf;wBACD,sBAAO,OAAO,KAAK,CAAC,EAAC;;;;KACtB;IAED,8GAA8G;IAC9G,wCAAW,GAAX,UAAY,SAAkB;QAC5B,IAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS,EAAE;YACvB,OAAO,SAAS,CAAC;SAClB;QAED,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IAEO,kCAAK,GAAb,UAAc,SAAkB;QAC9B,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3G,CAAC;IAEO,oCAAO,GAAf,UAAgB,MAAiC,EAAE,SAAiB;QAClE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,EAAE;YACpE,OAAO,KAAK,CAAC;SACd;QAED,OAAO,IAAA,wBAAe,EAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACtE,CAAC;IAEO,mCAAM,GAAd,UAAe,UAAqC;QAClD,IAAI,CAAC,UAAU,EAAE;YACf,OAAO,KAAK,CAAC;SACd;QAED,IAAM,SAAS,GAAG,IAAA,gBAAM,EAAC,UAAU,CAAC,CAAC;QACrC,OAAO,SAAS,CAAC,OAAO,EAAE,IAAI,IAAA,gBAAM,GAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC7D,CAAC;IAnEuB,wBAAK,GAAG,gBAAgB,CAAC;IAoEnD,yBAAC;CAAA,AArED,IAqEC;AArEY,gDAAkB"}

package/dist/src/routes/devMail.d.ts

@@ -0,0 +1,4 @@
+import { Route } from '@proteinjs/server-api';
+export declare const devMail: Route;
+export declare const devMailMessage: Route;
+//# sourceMappingURL=devMail.d.ts.map

package/dist/src/routes/devMail.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"devMail.d.ts","sourceRoot":"","sources":["../../../src/routes/devMail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAuB9C,eAAO,MAAM,OAAO,EAAE,KAwBrB,CAAC;AAEF,eAAO,MAAM,cAAc,EAAE,KAsB5B,CAAC"}

package/dist/src/routes/devMail.js

@@ -0,0 +1,119 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.devMailMessage = exports.devMail = void 0;
+var email_server_1 = require("@proteinjs/email-server");
+/**
+ * DEV-ONLY mail door: reads the process's mail sink (`@proteinjs/email-server` MailSink — the
+ * messages a development sender recorded instead of transporting), so automated dev-loop testing
+ * reads an invite or reset link from the sink instead of needing a real inbox, and nothing a dev
+ * server composes ever has to reach a real address to be verified.
+ *
+ *   GET /dev/mail[?n=<count>]  the last n messages (default 20, at most MailSink.CAPACITY), newest
+ *                              first: id, at, from, to, subject, the body's first link, refused, url
+ *   GET /dev/mail/<id>         the rendered message — its html part, or its text part as text/plain
+ *
+ * Double-gated exactly like `/dev/login` (devLogin.ts), acting only when BOTH hold; otherwise the
+ * paths answer 404 as if unregistered:
+ * 1. `process.env.DEVELOPMENT` — the dev-server switch, never set in prod images.
+ * 2. `DEV_AUTO_LOGIN_EMAIL` — the explicit per-launch dev opt-in.
+ */
+var DEFAULT_COUNT = 20;
+var gatesOpen = function () { var _a; return !!process.env.DEVELOPMENT && ((_a = process.env.DEV_AUTO_LOGIN_EMAIL) !== null && _a !== void 0 ? _a : '').trim().length > 0; };
+exports.devMail = {
+    path: '/dev/mail',
+    method: 'get',
+    onRequest: function (request, response) { return __awaiter(void 0, void 0, void 0, function () {
+        var requested, count, messages;
+        var _a;
+        return __generator(this, function (_b) {
+            if (!gatesOpen()) {
+                response.status(404).send();
+                return [2 /*return*/];
+            }
+            requested = Number((_a = request.query) === null || _a === void 0 ? void 0 : _a.n);
+            count = Number.isInteger(requested) && requested > 0 ? Math.min(requested, email_server_1.MailSink.CAPACITY) : DEFAULT_COUNT;
+            messages = email_server_1.MailSink.get()
+                .list(count)
+                .map(function (_a) {
+                var id = _a.id, at = _a.at, from = _a.from, to = _a.to, subject = _a.subject, link = _a.link, refused = _a.refused;
+                return ({
+                    id: id,
+                    at: at,
+                    from: from,
+                    to: to,
+                    subject: subject,
+                    link: link,
+                    refused: refused,
+                    url: "/dev/mail/".concat(id),
+                });
+            });
+            response.status(200).json({ messages: messages });
+            return [2 /*return*/];
+        });
+    }); },
+};
+exports.devMailMessage = {
+    path: '/dev/mail/:id',
+    method: 'get',
+    onRequest: function (request, response) { return __awaiter(void 0, void 0, void 0, function () {
+        var record;
+        var _a, _b, _c;
+        return __generator(this, function (_d) {
+            if (!gatesOpen()) {
+                response.status(404).send();
+                return [2 /*return*/];
+            }
+            record = email_server_1.MailSink.get().get(String((_b = (_a = request.params) === null || _a === void 0 ? void 0 : _a.id) !== null && _b !== void 0 ? _b : ''));
+            if (!record) {
+                response.status(404).send();
+                return [2 /*return*/];
+            }
+            if (record.html !== undefined) {
+                response.status(200).type('html').send(record.html);
+                return [2 /*return*/];
+            }
+            response
+                .status(200)
+                .type('text')
+                .send((_c = record.text) !== null && _c !== void 0 ? _c : '');
+            return [2 /*return*/];
+        });
+    }); },
+};
+//# sourceMappingURL=devMail.js.map

package/dist/src/routes/devMail.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"devMail.js","sourceRoot":"","sources":["../../../src/routes/devMail.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,wDAAmD;AAEnD;;;;;;;;;;;;;;GAcG;AACH,IAAM,aAAa,GAAG,EAAE,CAAC;AAEzB,IAAM,SAAS,GAAG,sBAChB,OAAA,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,oBAAoB,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAA,EAAA,CAAC;AAE7E,QAAA,OAAO,GAAU;IAC5B,IAAI,EAAE,WAAW;IACjB,MAAM,EAAE,KAAK;IACb,SAAS,EAAE,UAAO,OAAO,EAAE,QAAQ;;;;YACjC,IAAI,CAAC,SAAS,EAAE,EAAE;gBAChB,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC5B,sBAAO;aACR;YACK,SAAS,GAAG,MAAM,CAAC,MAAA,OAAO,CAAC,KAAK,0CAAE,CAAC,CAAC,CAAC;YACrC,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,uBAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YAC9G,QAAQ,GAAG,uBAAQ,CAAC,GAAG,EAAE;iBAC5B,IAAI,CAAC,KAAK,CAAC;iBACX,GAAG,CAAC,UAAC,EAA4C;oBAA1C,EAAE,QAAA,EAAE,EAAE,QAAA,EAAE,IAAI,UAAA,EAAE,EAAE,QAAA,EAAE,OAAO,aAAA,EAAE,IAAI,UAAA,EAAE,OAAO,aAAA;gBAAO,OAAA,CAAC;oBACtD,EAAE,IAAA;oBACF,EAAE,IAAA;oBACF,IAAI,MAAA;oBACJ,EAAE,IAAA;oBACF,OAAO,SAAA;oBACP,IAAI,MAAA;oBACJ,OAAO,SAAA;oBACP,GAAG,EAAE,oBAAa,EAAE,CAAE;iBACvB,CAAC;YATqD,CASrD,CAAC,CAAC;YACN,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,UAAA,EAAE,CAAC,CAAC;;;SACzC;CACF,CAAC;AAEW,QAAA,cAAc,GAAU;IACnC,IAAI,EAAE,eAAe;IACrB,MAAM,EAAE,KAAK;IACb,SAAS,EAAE,UAAO,OAAO,EAAE,QAAQ;;;;YACjC,IAAI,CAAC,SAAS,EAAE,EAAE;gBAChB,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC5B,sBAAO;aACR;YACK,MAAM,GAAG,uBAAQ,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,MAAA,MAAA,OAAO,CAAC,MAAM,0CAAE,EAAE,mCAAI,EAAE,CAAC,CAAC,CAAC;YACpE,IAAI,CAAC,MAAM,EAAE;gBACX,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC5B,sBAAO;aACR;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE;gBAC7B,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACpD,sBAAO;aACR;YACD,QAAQ;iBACL,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,MAAM,CAAC;iBACZ,IAAI,CAAC,MAAA,MAAM,CAAC,IAAI,mCAAI,EAAE,CAAC,CAAC;;;SAC5B;CACF,CAAC"}

package/dist/src/routes/executePasswordReset.d.ts

@@ -2,13 +2,13 @@ import { Route } from '@proteinjs/server-api';
 /**
  * Route handler for executing a password reset.
  *
- * This function handles the process of resetting a user's password using a provided reset token.
- * It verifies the token, checks its expiration, and updates the user's password if everything is valid.
+ * Resolves the presented token through `PasswordResetToken` — which refuses anything but a
+ * well-formed token before any lookup — checks its expiry, and redeems it: the new password is
+ * written and the token cleared in one conditional update, so a token resets a password once.
+ * The token itself never reaches the log.
  *
  * @bodyParam {string} token - The password reset token.
  * @bodyParam {string} newPassword - The new password for the user.
- *
- * @throws {Error} If there's an issue with the database operations or if the token is invalid or expired.
  */
 export declare const executePasswordReset: Route;
 //# sourceMappingURL=executePasswordReset.d.ts.map

package/dist/src/routes/executePasswordReset.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"executePasswordReset.d.ts","sourceRoot":"","sources":["../../../src/routes/executePasswordReset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAO9C;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,EAAE,KAqClC,CAAC"}
+{"version":3,"file":"executePasswordReset.d.ts","sourceRoot":"","sources":["../../../src/routes/executePasswordReset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAM9C;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,EAAE,KAuClC,CAAC"}

package/dist/src/routes/executePasswordReset.js

@@ -35,64 +35,65 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
         if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
     }
 };
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.executePasswordReset = void 0;
-var db_1 = require("@proteinjs/db");
 var user_1 = require("@proteinjs/user");
 var logger_1 = require("@proteinjs/logger");
-var moment_1 = __importDefault(require("moment"));
 var PasswordHasher_1 = require("../authentication/PasswordHasher");
+var PasswordResetToken_1 = require("../authentication/PasswordResetToken");
 /**
  * Route handler for executing a password reset.
  *
- * This function handles the process of resetting a user's password using a provided reset token.
- * It verifies the token, checks its expiration, and updates the user's password if everything is valid.
+ * Resolves the presented token through `PasswordResetToken` — which refuses anything but a
+ * well-formed token before any lookup — checks its expiry, and redeems it: the new password is
+ * written and the token cleared in one conditional update, so a token resets a password once.
+ * The token itself never reaches the log.
  *
  * @bodyParam {string} token - The password reset token.
  * @bodyParam {string} newPassword - The new password for the user.
- *
- * @throws {Error} If there's an issue with the database operations or if the token is invalid or expired.
  */
 exports.executePasswordReset = {
     path: user_1.routes.executePasswordReset.path,
     method: user_1.routes.executePasswordReset.method,
     onRequest: function (request, response) { return __awaiter(void 0, void 0, void 0, function () {
-        var logger, _a, token, newPassword, db, user, currentTime, tokenExpiration, hashedPassword;
+        var logger, _a, token, newPassword, resetToken, resolution, user, hashedPassword;
         return __generator(this, function (_b) {
             switch (_b.label) {
                 case 0:
                     logger = new logger_1.Logger({ name: 'executePasswordReset' });
                     _a = request.body, token = _a.token, newPassword = _a.newPassword;
-                    db = (0, db_1.getDbAsSystem)();
-                    return [4 /*yield*/, db.get(user_1.tables.User, { passwordResetToken: token })];
+                    if (typeof newPassword !== 'string' || newPassword.length === 0) {
+                        response.status(400).send({ error: 'New password cannot be blank' });
+                        return [2 /*return*/];
+                    }
+                    resetToken = new PasswordResetToken_1.PasswordResetToken();
+                    return [4 /*yield*/, resetToken.resolve(token)];
                 case 1:
-                    user = _b.sent();
-                    if (!user) {
-                        logger.info({ message: "Invalid reset token used", obj: { token: token } });
+                    resolution = _b.sent();
+                    if (resolution.status === 'malformed' || resolution.status === 'unknown') {
+                        logger.info({
+                            message: "Invalid reset token used",
+                            obj: { reason: resolution.status, token: resetToken.fingerprint(token) },
+                        });
                         response.status(400).send({ error: 'Invalid or expired reset token' });
                         return [2 /*return*/];
                     }
-                    currentTime = (0, moment_1.default)();
-                    tokenExpiration = (0, moment_1.default)(user.passwordResetTokenExpiration);
-                    if (currentTime.isAfter(tokenExpiration)) {
-                        logger.info({ message: "Expired reset token used", obj: { email: user.email } });
+                    if (resolution.status === 'expired') {
+                        logger.info({ message: "Expired reset token used", obj: { email: resolution.user.email } });
                         response.status(400).send({ error: 'Reset token has expired' });
                         return [2 /*return*/];
                     }
+                    user = resolution.user;
                     return [4 /*yield*/, new PasswordHasher_1.PasswordHasher().hash(newPassword)];
                 case 2:
                     hashedPassword = _b.sent();
-                    return [4 /*yield*/, db.update(user_1.tables.User, {
-                            id: user.id,
-                            password: hashedPassword,
-                            passwordResetToken: null,
-                            passwordResetTokenExpiration: null,
-                        })];
+                    return [4 /*yield*/, resetToken.redeem(user, resolution.token, hashedPassword)];
                 case 3:
-                    _b.sent();
+                    if (!(_b.sent())) {
+                        logger.info({ message: "Reset token already redeemed", obj: { email: user.email } });
+                        response.status(400).send({ error: 'Invalid or expired reset token' });
+                        return [2 /*return*/];
+                    }
                     logger.info({ message: "Password successfully reset", obj: { email: user.email } });
                     response.send({ message: 'Password has been successfully reset' });
                     return [2 /*return*/];

package/dist/src/routes/executePasswordReset.js.map

@@ -1 +1 @@
-{"version":3,"file":"executePasswordReset.js","sourceRoot":"","sources":["../../../src/routes/executePasswordReset.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,oCAA8C;AAC9C,wCAAiD;AACjD,4CAA2C;AAC3C,kDAA4B;AAC5B,mEAAkE;AAElE;;;;;;;;;;GAUG;AACU,QAAA,oBAAoB,GAAU;IACzC,IAAI,EAAE,aAAM,CAAC,oBAAoB,CAAC,IAAI;IACtC,MAAM,EAAE,aAAM,CAAC,oBAAoB,CAAC,MAAM;IAC1C,SAAS,EAAE,UAAO,OAAO,EAAE,QAAQ;;;;;oBAC3B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;oBACtD,KAAyB,OAAO,CAAC,IAAI,EAAnC,KAAK,WAAA,EAAE,WAAW,iBAAA,CAAkB;oBACtC,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;oBAGd,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAA;;oBAA/D,IAAI,GAAG,SAAwD;oBACrE,IAAI,CAAC,IAAI,EAAE;wBACT,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;wBACrE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;wBACvE,sBAAO;qBACR;oBAGK,WAAW,GAAG,IAAA,gBAAM,GAAE,CAAC;oBACvB,eAAe,GAAG,IAAA,gBAAM,EAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;oBAClE,IAAI,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE;wBACxC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;wBACjF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;wBAChE,sBAAO;qBACR;oBAGsB,qBAAM,IAAI,+BAAc,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAAA;;oBAA7D,cAAc,GAAG,SAA4C;oBACnE,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE;4BAC3B,EAAE,EAAE,IAAI,CAAC,EAAE;4BACX,QAAQ,EAAE,cAAc;4BACxB,kBAAkB,EAAE,IAAI;4BACxB,4BAA4B,EAAE,IAAI;yBACnC,CAAC,EAAA;;oBALF,SAKE,CAAC;oBAEH,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACpF,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC;;;;SACpE;CACF,CAAC"}
+{"version":3,"file":"executePasswordReset.js","sourceRoot":"","sources":["../../../src/routes/executePasswordReset.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,wCAAyC;AACzC,4CAA2C;AAC3C,mEAAkE;AAClE,2EAA0E;AAE1E;;;;;;;;;;GAUG;AACU,QAAA,oBAAoB,GAAU;IACzC,IAAI,EAAE,aAAM,CAAC,oBAAoB,CAAC,IAAI;IACtC,MAAM,EAAE,aAAM,CAAC,oBAAoB,CAAC,MAAM;IAC1C,SAAS,EAAE,UAAO,OAAO,EAAE,QAAQ;;;;;oBAC3B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;oBACtD,KAAyB,OAAO,CAAC,IAAI,EAAnC,KAAK,WAAA,EAAE,WAAW,iBAAA,CAAkB;oBAC5C,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE;wBAC/D,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;wBACrE,sBAAO;qBACR;oBAEK,UAAU,GAAG,IAAI,uCAAkB,EAAE,CAAC;oBACzB,qBAAM,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,EAAA;;oBAA5C,UAAU,GAAG,SAA+B;oBAClD,IAAI,UAAU,CAAC,MAAM,KAAK,WAAW,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE;wBACxE,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,0BAA0B;4BACnC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE;yBACzE,CAAC,CAAC;wBACH,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;wBACvE,sBAAO;qBACR;oBAED,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE;wBACnC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;wBAC5F,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;wBAChE,sBAAO;qBACR;oBAEO,IAAI,GAAK,UAAU,KAAf,CAAgB;oBACL,qBAAM,IAAI,+BAAc,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAAA;;oBAA7D,cAAc,GAAG,SAA4C;oBAC7D,qBAAM,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,KAAK,EAAE,cAAc,CAAC,EAAA;;oBAArE,IAAI,CAAC,CAAC,SAA+D,CAAC,EAAE;wBACtE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;wBACrF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;wBACvE,sBAAO;qBACR;oBAED,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACpF,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC;;;;SACpE;CACF,CAAC"}

package/dist/src/routes/initiatePasswordReset.js

@@ -56,7 +56,7 @@ var user_1 = require("@proteinjs/user");
 var logger_1 = require("@proteinjs/logger");
 var moment_1 = __importDefault(require("moment"));
 var email_server_1 = require("@proteinjs/email-server");
-var crypto_js_1 = require("crypto-js");
+var PasswordResetToken_1 = require("../authentication/PasswordResetToken");
 /**
  * Route for initiating a password reset process.
  *
@@ -108,7 +108,7 @@ exports.initiatePasswordReset = {
                     if (!defaultConfigFactory) {
                         throw new Error("Unable to find a @proteinjs/email-server/DefaultPasswordResetEmailConfigFactory implementation when initiating password reset.");
                     }
-                    passwordResetToken = crypto_js_1.lib.WordArray.random(32).toString();
+                    passwordResetToken = new PasswordResetToken_1.PasswordResetToken().mint();
                     passwordResetTokenExpiration = (0, moment_1.default)().add(1, 'hour');
                     _d.label = 2;
                 case 2:

package/dist/src/routes/initiatePasswordReset.js.map

@@ -1 +1 @@
-{"version":3,"file":"initiatePasswordReset.js","sourceRoot":"","sources":["../../../src/routes/initiatePasswordReset.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,oCAA8C;AAC9C,wCAA2D;AAC3D,4CAA2C;AAC3C,kDAA4B;AAC5B,wDAGiC;AACjC,uCAAgC;AAEhC;;;;;;;;;;;;GAYG;AACU,QAAA,qBAAqB,GAAU;IAC1C,IAAI,EAAE,aAAM,CAAC,qBAAqB,CAAC,IAAI;IACvC,MAAM,EAAE,aAAM,CAAC,qBAAqB,CAAC,MAAM;IAC3C,SAAS,EAAE,UAAO,OAAO,EAAE,QAAQ;;;;;;oBAC3B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;oBACvD,KAAK,GAAG,MAAA,OAAO,CAAC,IAAI,CAAC,KAAK,0CAAE,WAAW,EAAE,CAAC;oBAC1C,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;oBAErB,eAAe,GAAG,EAAE,OAAO,EAAE,2EAA2E,EAAE,CAAC;oBAEpG,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;;oBAA3C,IAAI,GAAG,SAAoC;oBACjD,IAAI,CAAC,IAAI,EAAE;wBACT,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,gDAAgD,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;wBAC3F,2CAA2C;wBAC3C,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;wBAC/B,sBAAO;qBACR;oBAED,sEAAsE;oBACtE,IAAI,IAAI,CAAC,kBAAkB,IAAI,IAAI,CAAC,4BAA4B,EAAE;wBAC1D,WAAW,GAAG,IAAA,gBAAM,GAAE,CAAC;wBACvB,iBAAiB,GAAG,IAAA,gBAAM,EAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;wBAClF,cAAc,GAAG,WAAW,CAAC,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;wBACtE,IAAI,cAAc,GAAG,CAAC,EAAE;4BACtB,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;4BACvF,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;4BAC/B,sBAAO;yBACR;qBACF;oBAEK,WAAW,GAAG,IAAI,0BAAW,EAAE,CAAC;oBAEhC,oBAAoB,GAAG,IAAA,wDAAuB,GAAE,CAAC;oBACvD,IAAI,CAAC,oBAAoB,EAAE;wBACzB,MAAM,IAAI,KAAK,CACb,gIAAgI,CACjI,CAAC;qBACH;oBAGK,kBAAkB,GAAG,eAAG,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;oBACzD,4BAA4B,GAAG,IAAA,gBAAM,GAAE,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;;;;oBAGrD,MAAM,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC;oBAC1C,KAAiB,MAAM,CAAC,eAAe,CAAC,UAAG,eAAQ,CAAC,IAAI,CAAC,aAAa,oBAAU,kBAAkB,CAAE,CAAC,EAAnG,IAAI,UAAA,EAAE,IAAI,UAAA,CAA0F;oBAE5G,qCAAqC;oBACrC,qBAAM,WAAW,CAAC,SAAS,YACzB,EAAE,EAAE,IAAI,CAAC,KAAK,EACd,OAAO,EAAE,CAAA,MAAA,MAAM,CAAC,OAAO,0CAAE,OAAO,KAAI,gBAAgB,EACpD,IAAI,MAAA,EACJ,IAAI,MAAA,IACD,MAAM,CAAC,OAAO,EACjB,EAAA;;oBAPF,qCAAqC;oBACrC,SAME,CAAC;oBAEH,iEAAiE;oBACjE,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,kBAAkB,oBAAA,EAAE,4BAA4B,8BAAA,EAAE,CAAC,EAAA;;oBAD/F,iEAAiE;oBACjE,SAA+F,CAAC;oBAChG,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;;;;oBAE/B,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,KAAK,SAAA,EAAE,CAAC,CAAC;oBACxF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8DAA8D,EAAE,CAAC,CAAC;;;;;SAExG;CACF,CAAC"}
+{"version":3,"file":"initiatePasswordReset.js","sourceRoot":"","sources":["../../../src/routes/initiatePasswordReset.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,oCAA8C;AAC9C,wCAA2D;AAC3D,4CAA2C;AAC3C,kDAA4B;AAC5B,wDAGiC;AACjC,2EAA0E;AAE1E;;;;;;;;;;;;GAYG;AACU,QAAA,qBAAqB,GAAU;IAC1C,IAAI,EAAE,aAAM,CAAC,qBAAqB,CAAC,IAAI;IACvC,MAAM,EAAE,aAAM,CAAC,qBAAqB,CAAC,MAAM;IAC3C,SAAS,EAAE,UAAO,OAAO,EAAE,QAAQ;;;;;;oBAC3B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;oBACvD,KAAK,GAAG,MAAA,OAAO,CAAC,IAAI,CAAC,KAAK,0CAAE,WAAW,EAAE,CAAC;oBAC1C,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;oBAErB,eAAe,GAAG,EAAE,OAAO,EAAE,2EAA2E,EAAE,CAAC;oBAEpG,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;;oBAA3C,IAAI,GAAG,SAAoC;oBACjD,IAAI,CAAC,IAAI,EAAE;wBACT,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,gDAAgD,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;wBAC3F,2CAA2C;wBAC3C,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;wBAC/B,sBAAO;qBACR;oBAED,sEAAsE;oBACtE,IAAI,IAAI,CAAC,kBAAkB,IAAI,IAAI,CAAC,4BAA4B,EAAE;wBAC1D,WAAW,GAAG,IAAA,gBAAM,GAAE,CAAC;wBACvB,iBAAiB,GAAG,IAAA,gBAAM,EAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;wBAClF,cAAc,GAAG,WAAW,CAAC,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;wBACtE,IAAI,cAAc,GAAG,CAAC,EAAE;4BACtB,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;4BACvF,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;4BAC/B,sBAAO;yBACR;qBACF;oBAEK,WAAW,GAAG,IAAI,0BAAW,EAAE,CAAC;oBAEhC,oBAAoB,GAAG,IAAA,wDAAuB,GAAE,CAAC;oBACvD,IAAI,CAAC,oBAAoB,EAAE;wBACzB,MAAM,IAAI,KAAK,CACb,gIAAgI,CACjI,CAAC;qBACH;oBAGK,kBAAkB,GAAG,IAAI,uCAAkB,EAAE,CAAC,IAAI,EAAE,CAAC;oBACrD,4BAA4B,GAAG,IAAA,gBAAM,GAAE,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;;;;oBAGrD,MAAM,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC;oBAC1C,KAAiB,MAAM,CAAC,eAAe,CAAC,UAAG,eAAQ,CAAC,IAAI,CAAC,aAAa,oBAAU,kBAAkB,CAAE,CAAC,EAAnG,IAAI,UAAA,EAAE,IAAI,UAAA,CAA0F;oBAE5G,qCAAqC;oBACrC,qBAAM,WAAW,CAAC,SAAS,YACzB,EAAE,EAAE,IAAI,CAAC,KAAK,EACd,OAAO,EAAE,CAAA,MAAA,MAAM,CAAC,OAAO,0CAAE,OAAO,KAAI,gBAAgB,EACpD,IAAI,MAAA,EACJ,IAAI,MAAA,IACD,MAAM,CAAC,OAAO,EACjB,EAAA;;oBAPF,qCAAqC;oBACrC,SAME,CAAC;oBAEH,iEAAiE;oBACjE,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,kBAAkB,oBAAA,EAAE,4BAA4B,8BAAA,EAAE,CAAC,EAAA;;oBAD/F,iEAAiE;oBACjE,SAA+F,CAAC;oBAChG,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;;;;oBAE/B,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,KAAK,SAAA,EAAE,CAAC,CAAC;oBACxF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8DAA8D,EAAE,CAAC,CAAC;;;;;SAExG;CACF,CAAC"}

package/dist/src/routes/validateResetPasswordToken.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validateResetPasswordToken.d.ts","sourceRoot":"","sources":["../../../src/routes/validateResetPasswordToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAM9C,eAAO,MAAM,0BAA0B,EAAE,KAoCxC,CAAC"}
+{"version":3,"file":"validateResetPasswordToken.d.ts","sourceRoot":"","sources":["../../../src/routes/validateResetPasswordToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAK9C,eAAO,MAAM,0BAA0B,EAAE,KAkCxC,CAAC"}

package/dist/src/routes/validateResetPasswordToken.js

@@ -35,42 +35,39 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
         if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
     }
 };
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.validateResetPasswordToken = void 0;
-var db_1 = require("@proteinjs/db");
 var user_1 = require("@proteinjs/user");
 var logger_1 = require("@proteinjs/logger");
-var moment_1 = __importDefault(require("moment"));
+var PasswordResetToken_1 = require("../authentication/PasswordResetToken");
 exports.validateResetPasswordToken = {
     path: user_1.routes.validateResetToken.path,
     method: user_1.routes.validateResetToken.method,
     onRequest: function (request, response) { return __awaiter(void 0, void 0, void 0, function () {
-        var logger, token, db, user, currentTime, tokenExpiration;
+        var logger, token, resetToken, resolution;
         return __generator(this, function (_a) {
             switch (_a.label) {
                 case 0:
                     logger = new logger_1.Logger({ name: 'validateResetToken' });
                     token = request.query.token;
-                    db = (0, db_1.getDbAsSystem)();
                     if (!token) {
                         response.status(400).send({ isValid: false, message: 'No token provided' });
                         return [2 /*return*/];
                     }
-                    return [4 /*yield*/, db.get(user_1.tables.User, { passwordResetToken: token })];
+                    resetToken = new PasswordResetToken_1.PasswordResetToken();
+                    return [4 /*yield*/, resetToken.resolve(token)];
                 case 1:
-                    user = _a.sent();
-                    if (!user) {
-                        logger.info({ message: "Invalid reset token used", obj: { token: token } });
+                    resolution = _a.sent();
+                    if (resolution.status === 'malformed' || resolution.status === 'unknown') {
+                        logger.info({
+                            message: "Invalid reset token used",
+                            obj: { reason: resolution.status, token: resetToken.fingerprint(token) },
+                        });
                         response.status(200).send({ isValid: false, message: 'Invalid token' });
                         return [2 /*return*/];
                     }
-                    currentTime = (0, moment_1.default)();
-                    tokenExpiration = (0, moment_1.default)(user.passwordResetTokenExpiration);
-                    if (currentTime.isAfter(tokenExpiration)) {
-                        logger.info({ message: "Expired reset token used", obj: { email: user.email } });
+                    if (resolution.status === 'expired') {
+                        logger.info({ message: "Expired reset token used", obj: { email: resolution.user.email } });
                         response.status(200).send({ isValid: false, message: 'Token has expired' });
                         return [2 /*return*/];
                     }
@@ -78,7 +75,7 @@ exports.validateResetPasswordToken = {
                     // read-only `autocomplete="username"` field so password managers associate the updated
                     // password with the stored credential. The token was delivered to this very inbox, so a
                     // valid-token holder learns nothing new; invalid/expired verdicts stay email-free.
-                    response.status(200).send({ isValid: true, email: user.email });
+                    response.status(200).send({ isValid: true, email: resolution.user.email });
                     return [2 /*return*/];
             }
         });

package/dist/src/routes/validateResetPasswordToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"validateResetPasswordToken.js","sourceRoot":"","sources":["../../../src/routes/validateResetPasswordToken.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,oCAA8C;AAC9C,wCAAiD;AACjD,4CAA2C;AAC3C,kDAA4B;AAEf,QAAA,0BAA0B,GAAU;IAC/C,IAAI,EAAE,aAAM,CAAC,kBAAkB,CAAC,IAAI;IACpC,MAAM,EAAE,aAAM,CAAC,kBAAkB,CAAC,MAAM;IACxC,SAAS,EAAE,UAAO,OAAO,EAAE,QAAQ;;;;;oBAC3B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;oBAClD,KAAK,GAAK,OAAO,CAAC,KAAK,MAAlB,CAAmB;oBAC1B,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;oBAE3B,IAAI,CAAC,KAAK,EAAE;wBACV,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;wBAC5E,sBAAO;qBACR;oBAGY,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAA;;oBAA/D,IAAI,GAAG,SAAwD;oBACrE,IAAI,CAAC,IAAI,EAAE;wBACT,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;wBACrE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;wBACxE,sBAAO;qBACR;oBAGK,WAAW,GAAG,IAAA,gBAAM,GAAE,CAAC;oBACvB,eAAe,GAAG,IAAA,gBAAM,EAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;oBAClE,IAAI,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE;wBACxC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;wBACjF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;wBAC5E,sBAAO;qBACR;oBAED,oFAAoF;oBACpF,uFAAuF;oBACvF,wFAAwF;oBACxF,mFAAmF;oBACnF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;;;;SACjE;CACF,CAAC"}
+{"version":3,"file":"validateResetPasswordToken.js","sourceRoot":"","sources":["../../../src/routes/validateResetPasswordToken.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,wCAAyC;AACzC,4CAA2C;AAC3C,2EAA0E;AAE7D,QAAA,0BAA0B,GAAU;IAC/C,IAAI,EAAE,aAAM,CAAC,kBAAkB,CAAC,IAAI;IACpC,MAAM,EAAE,aAAM,CAAC,kBAAkB,CAAC,MAAM;IACxC,SAAS,EAAE,UAAO,OAAO,EAAE,QAAQ;;;;;oBAC3B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;oBAClD,KAAK,GAAK,OAAO,CAAC,KAAK,MAAlB,CAAmB;oBAChC,IAAI,CAAC,KAAK,EAAE;wBACV,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;wBAC5E,sBAAO;qBACR;oBAEK,UAAU,GAAG,IAAI,uCAAkB,EAAE,CAAC;oBACzB,qBAAM,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,EAAA;;oBAA5C,UAAU,GAAG,SAA+B;oBAClD,IAAI,UAAU,CAAC,MAAM,KAAK,WAAW,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE;wBACxE,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,0BAA0B;4BACnC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE;yBACzE,CAAC,CAAC;wBACH,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;wBACxE,sBAAO;qBACR;oBAED,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE;wBACnC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;wBAC5F,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;wBAC5E,sBAAO;qBACR;oBAED,oFAAoF;oBACpF,uFAAuF;oBACvF,wFAAwF;oBACxF,mFAAmF;oBACnF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;;;;SAC5E;CACF,CAAC"}

package/dist/test/DevMail.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=DevMail.test.d.ts.map

package/dist/test/DevMail.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DevMail.test.d.ts","sourceRoot":"","sources":["../../test/DevMail.test.ts"],"names":[],"mappings":""}