@proteinjs/user-server 1.21.1 → 1.22.1

package/dist/test/ExecutePasswordReset.test.js

@@ -50,16 +50,19 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+var crypto_1 = require("crypto");
 var moment_1 = __importDefault(require("moment"));
 var db_1 = require("@proteinjs/db");
-var logger_1 = require("@proteinjs/logger");
 var user_1 = require("@proteinjs/user");
 var executePasswordReset_1 = require("../src/routes/executePasswordReset");
 var PasswordHasher_1 = require("../src/authentication/PasswordHasher");
 var PasswordResetToken_1 = require("../src/authentication/PasswordResetToken");
 var UserServerTestEnvironment_1 = require("./UserServerTestEnvironment");
+var DbTraffic_1 = require("./DbTraffic");
+var LogCapture_1 = require("./LogCapture");
+var MalformedResetTokens_1 = require("./MalformedResetTokens");
 var testEnv = new UserServerTestEnvironment_1.UserServerTestEnvironment();
-var invokeExecute = function (body) { return __awaiter(void 0, void 0, void 0, function () {
+var invokeExecuteRequest = function (request) { return __awaiter(void 0, void 0, void 0, function () {
     var outcome, response;
     return __generator(this, function (_a) {
         switch (_a.label) {
@@ -74,15 +77,45 @@ var invokeExecute = function (body) { return __awaiter(void 0, void 0, void 0, f
                         outcome.body = body;
                     },
                 };
-                return [4 /*yield*/, executePasswordReset_1.executePasswordReset.onRequest({ body: body }, response)];
+                return [4 /*yield*/, executePasswordReset_1.executePasswordReset.onRequest(request, response)];
             case 1:
                 _a.sent();
                 return [2 /*return*/, outcome];
         }
     });
 }); };
-var mintToken = function () { return new PasswordResetToken_1.PasswordResetToken().mint(); };
-var armResetToken = function (email, token, expiration) { return __awaiter(void 0, void 0, void 0, function () {
+var invokeExecute = function (body) { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+    switch (_a.label) {
+        case 0: return [4 /*yield*/, invokeExecuteRequest({ body: body })];
+        case 1: return [2 /*return*/, _a.sent()];
+    }
+}); }); };
+/** The digest a row must hold for `token`, computed here independently of the owner. */
+var sha256Hex = function (value) { return (0, crypto_1.createHash)('sha256').update(value).digest('hex'); };
+/** A well-formed token that was never issued to anyone. */
+var unissuedToken = function () { return sha256Hex("never issued ".concat(Math.random())); };
+/** A user with a token minted by the owner; `expiration` (when given) replaces the expiry the mint stored. */
+var armResetToken = function (email, expiration) { return __awaiter(void 0, void 0, void 0, function () {
+    var user, token;
+    return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Reset User', email: email })];
+            case 1:
+                user = _a.sent();
+                return [4 /*yield*/, new PasswordResetToken_1.PasswordResetToken().mint(user)];
+            case 2:
+                token = _a.sent();
+                if (!(expiration !== undefined)) return [3 /*break*/, 4];
+                return [4 /*yield*/, (0, db_1.getDbAsSystem)().update(user_1.tables.User, { id: user.id, passwordResetTokenExpiration: expiration })];
+            case 3:
+                _a.sent();
+                _a.label = 4;
+            case 4: return [2 /*return*/, { user: user, token: token }];
+        }
+    });
+}); };
+/** A user whose token column is written raw — only for the column states the owner never writes. */
+var armRawTokenColumn = function (email, stored) { return __awaiter(void 0, void 0, void 0, function () {
     var user;
     return __generator(this, function (_a) {
         switch (_a.label) {
@@ -91,8 +124,8 @@ var armResetToken = function (email, token, expiration) { return __awaiter(void
                 user = _a.sent();
                 return [4 /*yield*/, (0, db_1.getDbAsSystem)().update(user_1.tables.User, {
                         id: user.id,
-                        passwordResetToken: token,
-                        passwordResetTokenExpiration: expiration,
+                        passwordResetToken: stored,
+                        passwordResetTokenExpiration: (0, moment_1.default)().add(1, 'hour'),
                     })];
             case 2:
                 _a.sent();
@@ -106,23 +139,28 @@ var userRow = function (id) { return __awaiter(void 0, void 0, void 0, function
         case 1: return [2 /*return*/, _a.sent()];
     }
 }); }); };
-/** Every password in the table, by email — the whole-table outcome a refused request must leave untouched. */
-var passwordsByEmail = function () { return __awaiter(void 0, void 0, void 0, function () {
+/** Every password, stored token and expiry in the table, by email — the whole-table outcome a refused request must leave untouched. */
+var resetStateByEmail = function () { return __awaiter(void 0, void 0, void 0, function () {
     var byEmail, _i, _a, user;
-    return __generator(this, function (_b) {
-        switch (_b.label) {
+    var _b;
+    return __generator(this, function (_c) {
+        switch (_c.label) {
             case 0:
                 byEmail = {};
                 _i = 0;
                 return [4 /*yield*/, (0, db_1.getDbAsSystem)().query(user_1.tables.User, {})];
             case 1:
-                _a = _b.sent();
-                _b.label = 2;
+                _a = _c.sent();
+                _c.label = 2;
             case 2:
                 if (!(_i < _a.length)) return [3 /*break*/, 4];
                 user = _a[_i];
-                byEmail[user.email] = user.password;
-                _b.label = 3;
+                byEmail[user.email] = [
+                    user.password,
+                    (_b = user.passwordResetToken) !== null && _b !== void 0 ? _b : null,
+                    user.passwordResetTokenExpiration ? (0, moment_1.default)(user.passwordResetTokenExpiration).toISOString() : null,
+                ];
+                _c.label = 3;
             case 3:
                 _i++;
                 return [3 /*break*/, 2];
@@ -130,6 +168,31 @@ var passwordsByEmail = function () { return __awaiter(void 0, void 0, void 0, fu
         }
     });
 }); };
+/** Which of `candidates` the stored password hash verifies. */
+var verifiedPasswords = function (storedHash, candidates) { return __awaiter(void 0, void 0, void 0, function () {
+    var verified, _i, candidates_1, candidate;
+    return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0:
+                verified = [];
+                _i = 0, candidates_1 = candidates;
+                _a.label = 1;
+            case 1:
+                if (!(_i < candidates_1.length)) return [3 /*break*/, 4];
+                candidate = candidates_1[_i];
+                return [4 /*yield*/, new PasswordHasher_1.PasswordHasher().verify(storedHash, candidate)];
+            case 2:
+                if (_a.sent()) {
+                    verified.push(candidate);
+                }
+                _a.label = 3;
+            case 3:
+                _i++;
+                return [3 /*break*/, 1];
+            case 4: return [2 /*return*/, verified];
+        }
+    });
+}); };
 describe('executePasswordReset route', function () {
     beforeAll(function () { return __awaiter(void 0, void 0, void 0, function () {
         return __generator(this, function (_a) {
@@ -143,7 +206,7 @@ describe('executePasswordReset route', function () {
                     // No pending reset — the account a `null` token's `IS NULL` filter would match.
                     _a.sent();
                     // An emptied token column — the account an empty token would match.
-                    return [4 /*yield*/, armResetToken('reset-emptied@test.local', '', (0, moment_1.default)().add(1, 'hour'))];
+                    return [4 /*yield*/, armRawTokenColumn('reset-emptied@test.local', '')];
                 case 3:
                     // An emptied token column — the account an empty token would match.
                     _a.sent();
@@ -162,111 +225,233 @@ describe('executePasswordReset route', function () {
         });
     }); });
     describe('a request without a well-formed token is refused before any lookup', function () {
-        it.each([
-            ['absent', {}],
-            ['null', { token: null }],
-            ['empty', { token: '' }],
-            ['not a token string', { token: 'tok-valid-1' }],
-            ['a number', { token: 123 }],
-            ['an array', { token: ['a', 'b'] }],
-            ['an object', { token: { passwordResetToken: null } }],
-        ])('%s: 400, and no password in the table changes', function (_label, tokenField) { return __awaiter(void 0, void 0, void 0, function () {
-            var before, outcome, _a;
+        var liveUser;
+        var liveToken;
+        beforeAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+            var _a;
             return __generator(this, function (_b) {
                 switch (_b.label) {
-                    case 0: return [4 /*yield*/, passwordsByEmail()];
+                    case 0: return [4 /*yield*/, armResetToken('reset-shapes@test.local')];
                     case 1:
-                        before = _b.sent();
-                        return [4 /*yield*/, invokeExecute(__assign(__assign({}, tokenField), { newPassword: 'hijacked' }))];
+                        (_a = _b.sent(), liveUser = _a.user, liveToken = _a.token);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it.each(MalformedResetTokens_1.MalformedResetTokens.CASES)('%s: 400, nothing in the table changes, and nothing reaches the database', function (_label, tokenField) { return __awaiter(void 0, void 0, void 0, function () {
+            var before, _a, outcome, traffic, _b;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
+                    case 0: return [4 /*yield*/, resetStateByEmail()];
+                    case 1:
+                        before = _c.sent();
+                        return [4 /*yield*/, DbTraffic_1.DbTraffic.during(testEnv.spannerDriver, function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0: return [4 /*yield*/, invokeExecute(__assign(__assign({}, tokenField(liveToken)), { newPassword: 'hijacked' }))];
+                                    case 1: return [2 /*return*/, _a.sent()];
+                                }
+                            }); }); })];
                     case 2:
-                        outcome = _b.sent();
+                        _a = _c.sent(), outcome = _a.result, traffic = _a.traffic;
                         expect(outcome.status).toBe(400);
                         expect(outcome.body).toEqual({ error: 'Invalid or expired reset token' });
-                        _a = expect;
-                        return [4 /*yield*/, passwordsByEmail()];
+                        expect(traffic).toEqual(DbTraffic_1.DbTraffic.NONE);
+                        _b = expect;
+                        return [4 /*yield*/, resetStateByEmail()];
+                    case 3:
+                        _b.apply(void 0, [_c.sent()]).toEqual(before);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('after every refusal the live token still resets the password', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var outcome, row;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, invokeExecute({ token: liveToken, newPassword: 'still live' })];
+                    case 1:
+                        outcome = _a.sent();
+                        expect(outcome.status).toBe(200);
+                        return [4 /*yield*/, userRow(liveUser.id)];
+                    case 2:
+                        row = _a.sent();
+                        return [4 /*yield*/, expect(new PasswordHasher_1.PasswordHasher().verify(row.password, 'still live')).resolves.toBe(true)];
                     case 3:
-                        _a.apply(void 0, [_b.sent()]).toEqual(before);
+                        _a.sent();
                         return [2 /*return*/];
                 }
             });
         }); });
     });
+    it.each([
+        ['no body', 'reset-no-body@test.local', {}],
+        ['a null body', 'reset-null-body@test.local', { body: null }],
+    ])('a request with %s: 400, and nothing changes', function (_label, email, request) { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, user, token, before, outcome, _b, _c;
+        return __generator(this, function (_d) {
+            switch (_d.label) {
+                case 0: return [4 /*yield*/, armResetToken(email)];
+                case 1:
+                    _a = _d.sent(), user = _a.user, token = _a.token;
+                    return [4 /*yield*/, resetStateByEmail()];
+                case 2:
+                    before = _d.sent();
+                    return [4 /*yield*/, invokeExecuteRequest(request)];
+                case 3:
+                    outcome = _d.sent();
+                    expect(outcome.status).toBe(400);
+                    _b = expect;
+                    return [4 /*yield*/, resetStateByEmail()];
+                case 4:
+                    _b.apply(void 0, [_d.sent()]).toEqual(before);
+                    _c = expect;
+                    return [4 /*yield*/, userRow(user.id)];
+                case 5:
+                    _c.apply(void 0, [(_d.sent()).passwordResetToken]).toBe(sha256Hex(token));
+                    return [2 /*return*/];
+            }
+        });
+    }); });
     it('a live token resets the password once: the row verifies it, the token clears, a re-presentation is refused', function () { return __awaiter(void 0, void 0, void 0, function () {
-        var token, user, first, afterFirst, second, _a;
-        return __generator(this, function (_b) {
-            switch (_b.label) {
-                case 0:
-                    token = mintToken();
-                    return [4 /*yield*/, armResetToken('reset-live@test.local', token, (0, moment_1.default)().add(1, 'hour'))];
+        var _a, user, token, first, afterFirst, second, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0: return [4 /*yield*/, armResetToken('reset-live@test.local')];
                 case 1:
-                    user = _b.sent();
+                    _a = _c.sent(), user = _a.user, token = _a.token;
                     return [4 /*yield*/, invokeExecute({ token: token, newPassword: 'first new password' })];
                 case 2:
-                    first = _b.sent();
+                    first = _c.sent();
                     expect(first.status).toBe(200);
                     expect(first.body).toEqual({ message: 'Password has been successfully reset' });
                     return [4 /*yield*/, userRow(user.id)];
                 case 3:
-                    afterFirst = _b.sent();
+                    afterFirst = _c.sent();
                     return [4 /*yield*/, expect(new PasswordHasher_1.PasswordHasher().verify(afterFirst.password, 'first new password')).resolves.toBe(true)];
                 case 4:
-                    _b.sent();
+                    _c.sent();
                     expect(afterFirst.passwordResetToken).toBeNull();
                     expect(afterFirst.passwordResetTokenExpiration).toBeNull();
                     return [4 /*yield*/, invokeExecute({ token: token, newPassword: 'second new password' })];
                 case 5:
-                    second = _b.sent();
+                    second = _c.sent();
                     expect(second.status).toBe(400);
-                    _a = expect;
+                    _b = expect;
                     return [4 /*yield*/, userRow(user.id)];
                 case 6:
-                    _a.apply(void 0, [(_b.sent()).password]).toBe(afterFirst.password);
+                    _b.apply(void 0, [(_c.sent()).password]).toBe(afterFirst.password);
                     return [2 /*return*/];
             }
         });
     }); });
-    it('an expired token is refused and changes nothing', function () { return __awaiter(void 0, void 0, void 0, function () {
-        var token, user, before, outcome, row;
-        return __generator(this, function (_a) {
-            switch (_a.label) {
-                case 0:
-                    token = mintToken();
-                    return [4 /*yield*/, armResetToken('reset-expired@test.local', token, (0, moment_1.default)().subtract(1, 'minute'))];
+    it("two simultaneous presentations of one token: exactly one 200, and the row verifies only the winner's password", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, user, token, candidates, hashPassword, release, bothHashed, hashed, hash, outcomes, winner, row, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0: return [4 /*yield*/, armResetToken('reset-race@test.local')];
+                case 1:
+                    _a = _c.sent(), user = _a.user, token = _a.token;
+                    candidates = ['racer one password', 'racer two password'];
+                    hashPassword = PasswordHasher_1.PasswordHasher.prototype.hash;
+                    release = function () { return undefined; };
+                    bothHashed = new Promise(function (resolve) { return (release = resolve); });
+                    hashed = 0;
+                    hash = jest.spyOn(PasswordHasher_1.PasswordHasher.prototype, 'hash').mockImplementation(function (password) {
+                        return __awaiter(this, void 0, void 0, function () {
+                            var hashedPassword;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0: return [4 /*yield*/, hashPassword.call(this, password)];
+                                    case 1:
+                                        hashedPassword = _a.sent();
+                                        if (++hashed === candidates.length) {
+                                            release();
+                                        }
+                                        return [4 /*yield*/, bothHashed];
+                                    case 2:
+                                        _a.sent();
+                                        return [2 /*return*/, hashedPassword];
+                                }
+                            });
+                        });
+                    });
+                    _c.label = 2;
+                case 2:
+                    _c.trys.push([2, , 4, 5]);
+                    return [4 /*yield*/, Promise.all(candidates.map(function (newPassword) { return invokeExecute({ token: token, newPassword: newPassword }); }))];
+                case 3:
+                    outcomes = _c.sent();
+                    return [3 /*break*/, 5];
+                case 4:
+                    hash.mockRestore();
+                    return [7 /*endfinally*/];
+                case 5:
+                    expect(outcomes.map(function (outcome) { return outcome.status; }).sort()).toEqual([200, 400]);
+                    winner = candidates[outcomes.findIndex(function (outcome) { return outcome.status === 200; })];
+                    return [4 /*yield*/, userRow(user.id)];
+                case 6:
+                    row = _c.sent();
+                    _b = expect;
+                    return [4 /*yield*/, verifiedPasswords(row.password, candidates)];
+                case 7:
+                    _b.apply(void 0, [_c.sent()]).toEqual([winner]);
+                    expect(row.passwordResetToken).toBeNull();
+                    expect(row.passwordResetTokenExpiration).toBeNull();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('the row stores the SHA-256 digest of the token, never the token — and the digest presented as a token is refused', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, user, token, armed, _b, outcome, traffic, row;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0: return [4 /*yield*/, armResetToken('reset-digest@test.local')];
                 case 1:
-                    user = _a.sent();
+                    _a = _c.sent(), user = _a.user, token = _a.token;
                     return [4 /*yield*/, userRow(user.id)];
                 case 2:
-                    before = (_a.sent()).password;
-                    return [4 /*yield*/, invokeExecute({ token: token, newPassword: 'hijacked' })];
+                    armed = _c.sent();
+                    expect(armed.passwordResetToken).toBe(sha256Hex(token));
+                    expect(JSON.stringify(armed)).not.toContain(token);
+                    return [4 /*yield*/, DbTraffic_1.DbTraffic.during(testEnv.spannerDriver, function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                            switch (_a.label) {
+                                case 0: return [4 /*yield*/, invokeExecute({ token: armed.passwordResetToken, newPassword: 'hijacked' })];
+                                case 1: return [2 /*return*/, _a.sent()];
+                            }
+                        }); }); })];
                 case 3:
-                    outcome = _a.sent();
+                    _b = _c.sent(), outcome = _b.result, traffic = _b.traffic;
                     expect(outcome.status).toBe(400);
-                    expect(outcome.body).toEqual({ error: 'Reset token has expired' });
+                    expect(outcome.body).toEqual({ error: 'Invalid or expired reset token' });
+                    expect(traffic.lookups).toEqual([{ passwordResetToken: sha256Hex(sha256Hex(token)) }]);
+                    expect(traffic.statements).toBe(1);
+                    expect(traffic.writes).toBe(0);
                     return [4 /*yield*/, userRow(user.id)];
                 case 4:
-                    row = _a.sent();
-                    expect(row.password).toBe(before);
-                    expect(row.passwordResetToken).toBe(token);
+                    row = _c.sent();
+                    expect(row.password).toBe(armed.password);
+                    expect(row.passwordResetToken).toBe(sha256Hex(token));
                     return [2 /*return*/];
             }
         });
     }); });
-    it('a token whose row carries no expiry is refused — never live by omission', function () { return __awaiter(void 0, void 0, void 0, function () {
-        var token, user, before, outcome, _a;
+    it('a token an earlier release stored in clear is refused — it fails for the rest of its hour, no migration', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var clearToken, user, before, outcome, _a;
         return __generator(this, function (_b) {
             switch (_b.label) {
                 case 0:
-                    token = mintToken();
-                    return [4 /*yield*/, armResetToken('reset-no-expiry@test.local', token, null)];
+                    clearToken = unissuedToken();
+                    return [4 /*yield*/, armRawTokenColumn('reset-stored-in-clear@test.local', clearToken)];
                 case 1:
                     user = _b.sent();
                     return [4 /*yield*/, userRow(user.id)];
                 case 2:
                     before = (_b.sent()).password;
-                    return [4 /*yield*/, invokeExecute({ token: token, newPassword: 'hijacked' })];
+                    return [4 /*yield*/, invokeExecute({ token: clearToken, newPassword: 'hijacked' })];
                 case 3:
                     outcome = _b.sent();
                     expect(outcome.status).toBe(400);
+                    expect(outcome.body).toEqual({ error: 'Invalid or expired reset token' });
                     _a = expect;
                     return [4 /*yield*/, userRow(user.id)];
                 case 4:
@@ -275,80 +460,211 @@ describe('executePasswordReset route', function () {
             }
         });
     }); });
-    it('a blank new password is refused without consuming the token', function () { return __awaiter(void 0, void 0, void 0, function () {
-        var token, user, before, _i, _a, newPassword, outcome, row;
+    it('an expired token is refused and changes nothing', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, user, token, before, outcome, row;
         return __generator(this, function (_b) {
             switch (_b.label) {
-                case 0:
-                    token = mintToken();
-                    return [4 /*yield*/, armResetToken('reset-blank@test.local', token, (0, moment_1.default)().add(1, 'hour'))];
+                case 0: return [4 /*yield*/, armResetToken('reset-expired@test.local', (0, moment_1.default)().subtract(1, 'minute'))];
                 case 1:
-                    user = _b.sent();
+                    _a = _b.sent(), user = _a.user, token = _a.token;
                     return [4 /*yield*/, userRow(user.id)];
                 case 2:
                     before = (_b.sent()).password;
-                    _i = 0, _a = ['', undefined, 42];
-                    _b.label = 3;
+                    return [4 /*yield*/, invokeExecute({ token: token, newPassword: 'hijacked' })];
+                case 3:
+                    outcome = _b.sent();
+                    expect(outcome.status).toBe(400);
+                    expect(outcome.body).toEqual({ error: 'Reset token has expired' });
+                    return [4 /*yield*/, userRow(user.id)];
+                case 4:
+                    row = _b.sent();
+                    expect(row.password).toBe(before);
+                    expect(row.passwordResetToken).toBe(sha256Hex(token));
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('a token whose row carries no expiry is refused — never live by omission', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, user, token, before, outcome, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0: return [4 /*yield*/, armResetToken('reset-no-expiry@test.local', null)];
+                case 1:
+                    _a = _c.sent(), user = _a.user, token = _a.token;
+                    return [4 /*yield*/, userRow(user.id)];
+                case 2:
+                    before = (_c.sent()).password;
+                    return [4 /*yield*/, invokeExecute({ token: token, newPassword: 'hijacked' })];
+                case 3:
+                    outcome = _c.sent();
+                    expect(outcome.status).toBe(400);
+                    _b = expect;
+                    return [4 /*yield*/, userRow(user.id)];
+                case 4:
+                    _b.apply(void 0, [(_c.sent()).password]).toBe(before);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('a blank new password is refused without consuming the token', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, user, token, before, _i, _b, newPassword, outcome, row;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0: return [4 /*yield*/, armResetToken('reset-blank@test.local')];
+                case 1:
+                    _a = _c.sent(), user = _a.user, token = _a.token;
+                    return [4 /*yield*/, userRow(user.id)];
+                case 2:
+                    before = (_c.sent()).password;
+                    _i = 0, _b = ['', undefined, 42];
+                    _c.label = 3;
                 case 3:
-                    if (!(_i < _a.length)) return [3 /*break*/, 6];
-                    newPassword = _a[_i];
+                    if (!(_i < _b.length)) return [3 /*break*/, 6];
+                    newPassword = _b[_i];
                     return [4 /*yield*/, invokeExecute({ token: token, newPassword: newPassword })];
                 case 4:
-                    outcome = _b.sent();
+                    outcome = _c.sent();
                     expect(outcome.status).toBe(400);
-                    _b.label = 5;
+                    _c.label = 5;
                 case 5:
                     _i++;
                     return [3 /*break*/, 3];
                 case 6: return [4 /*yield*/, userRow(user.id)];
                 case 7:
-                    row = _b.sent();
+                    row = _c.sent();
                     expect(row.password).toBe(before);
-                    expect(row.passwordResetToken).toBe(token);
+                    expect(row.passwordResetToken).toBe(sha256Hex(token));
                     return [2 /*return*/];
             }
         });
     }); });
-    it('the presented token never reaches the log', function () { return __awaiter(void 0, void 0, void 0, function () {
-        var token, info, _i, _a, entry;
+    it('no token, no leading characters of one and no full digest reach the log — every path through the route', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var live, expired, unissued, log, _i, _a, token;
         return __generator(this, function (_b) {
             switch (_b.label) {
-                case 0:
-                    token = mintToken();
-                    info = jest.spyOn(logger_1.Logger.prototype, 'info');
-                    _b.label = 1;
+                case 0: return [4 /*yield*/, armResetToken('reset-log-live@test.local')];
                 case 1:
-                    _b.trys.push([1, , 3, 4]);
-                    return [4 /*yield*/, invokeExecute({ token: token, newPassword: 'hijacked' })];
+                    live = (_b.sent()).token;
+                    return [4 /*yield*/, armResetToken('reset-log-expired@test.local', (0, moment_1.default)().subtract(1, 'minute'))];
                 case 2:
-                    _b.sent();
-                    expect(info).toHaveBeenCalled();
-                    for (_i = 0, _a = info.mock.calls; _i < _a.length; _i++) {
-                        entry = _a[_i][0];
-                        expect(JSON.stringify(entry)).not.toContain(token);
-                    }
-                    return [3 /*break*/, 4];
+                    expired = (_b.sent()).token;
+                    unissued = unissuedToken();
+                    return [4 /*yield*/, LogCapture_1.LogCapture.during(function () { return __awaiter(void 0, void 0, void 0, function () {
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0: return [4 /*yield*/, invokeExecute({ token: unissued, newPassword: 'hijacked' })];
+                                    case 1:
+                                        _a.sent();
+                                        return [4 /*yield*/, invokeExecute({ token: live.toUpperCase(), newPassword: 'hijacked' })];
+                                    case 2:
+                                        _a.sent();
+                                        return [4 /*yield*/, invokeExecute({ token: sha256Hex(live), newPassword: 'hijacked' })];
+                                    case 3:
+                                        _a.sent();
+                                        return [4 /*yield*/, invokeExecute({ token: expired, newPassword: 'hijacked' })];
+                                    case 4:
+                                        _a.sent();
+                                        return [4 /*yield*/, invokeExecute({ token: live, newPassword: 'a logged password' })];
+                                    case 5:
+                                        _a.sent();
+                                        return [4 /*yield*/, invokeExecute({ token: live, newPassword: 'a second logged password' })];
+                                    case 6:
+                                        _a.sent();
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })];
                 case 3:
-                    info.mockRestore();
-                    return [7 /*endfinally*/];
-                case 4: return [2 /*return*/];
+                    log = _b.sent();
+                    // The capture saw the route's lines: each path above logged.
+                    expect(log.text).toContain('Invalid reset token used');
+                    expect(log.text).toContain('Expired reset token used');
+                    expect(log.text).toContain('Password successfully reset');
+                    expect(log.lines.length).toBeGreaterThanOrEqual(6);
+                    // The digest presented as a token is covered by `live`: its full digest is what was presented.
+                    for (_i = 0, _a = [unissued, live, expired]; _i < _a.length; _i++) {
+                        token = _a[_i];
+                        log.expectFreeOf(token);
+                    }
+                    return [2 /*return*/];
             }
         });
     }); });
     describe('PasswordResetToken', function () {
         var internals = new PasswordResetToken_1.PasswordResetToken();
-        it('mints 64 lowercase hex characters, fresh each time', function () {
-            var token = mintToken();
-            expect(token).toMatch(/^[0-9a-f]{64}$/);
-            expect(mintToken()).not.toBe(token);
+        it('mints 64 lowercase hex characters, fresh each time, and stores the digest with an expiry an hour out', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var user, first, afterFirst, second, afterSecond, minutesOut;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Reset User', email: 'reset-mint@test.local' })];
+                    case 1:
+                        user = _a.sent();
+                        return [4 /*yield*/, new PasswordResetToken_1.PasswordResetToken().mint(user)];
+                    case 2:
+                        first = _a.sent();
+                        return [4 /*yield*/, userRow(user.id)];
+                    case 3:
+                        afterFirst = _a.sent();
+                        return [4 /*yield*/, new PasswordResetToken_1.PasswordResetToken().mint(user)];
+                    case 4:
+                        second = _a.sent();
+                        return [4 /*yield*/, userRow(user.id)];
+                    case 5:
+                        afterSecond = _a.sent();
+                        expect(first).toMatch(/^[0-9a-f]{64}$/);
+                        expect(second).toMatch(/^[0-9a-f]{64}$/);
+                        expect(second).not.toBe(first);
+                        expect(afterFirst.passwordResetToken).toBe(sha256Hex(first));
+                        expect(afterSecond.passwordResetToken).toBe(sha256Hex(second));
+                        minutesOut = (0, moment_1.default)(afterSecond.passwordResetTokenExpiration).diff((0, moment_1.default)(), 'minutes', true);
+                        expect(minutesOut).toBeGreaterThan(59);
+                        expect(minutesOut).toBeLessThanOrEqual(60);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it.each(MalformedResetTokens_1.MalformedResetTokens.CASES)('resolve refuses %s as malformed without touching the database, and gives it no log reference', function (_label, tokenField) { return __awaiter(void 0, void 0, void 0, function () {
+            var presented, _a, resolution, traffic;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        presented = tokenField(unissuedToken()).token;
+                        return [4 /*yield*/, DbTraffic_1.DbTraffic.during(testEnv.spannerDriver, function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0: return [4 /*yield*/, new PasswordResetToken_1.PasswordResetToken().resolve(presented)];
+                                    case 1: return [2 /*return*/, _a.sent()];
+                                }
+                            }); }); })];
+                    case 1:
+                        _a = _b.sent(), resolution = _a.result, traffic = _a.traffic;
+                        expect(resolution).toEqual({ status: 'malformed' });
+                        expect(traffic).toEqual(DbTraffic_1.DbTraffic.NONE);
+                        expect(new PasswordResetToken_1.PasswordResetToken().fingerprint(presented)).toBeUndefined();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('the log reference to a token is cut from its digest, never from the token: the same token reads the same, another reads differently', function () {
+            var token = unissuedToken();
+            var another = unissuedToken();
+            var reference = new PasswordResetToken_1.PasswordResetToken().fingerprint(token);
+            expect(reference).toBe(sha256Hex(token).slice(0, 12));
+            expect(reference).not.toBe(token.slice(0, 12));
+            expect(new PasswordResetToken_1.PasswordResetToken().fingerprint(token)).toBe(reference);
+            expect(new PasswordResetToken_1.PasswordResetToken().fingerprint(another)).not.toBe(reference);
+        });
+        it('the digest is the SHA-256 of the token, hex-encoded', function () {
+            var token = unissuedToken();
+            expect(internals.digest(token)).toBe(sha256Hex(token));
+            expect(internals.digest(token)).not.toBe(token);
         });
-        it('a stored token matches only the same string — never an absent or emptied one', function () {
-            var token = mintToken();
-            expect(internals.matches(token, token)).toBe(true);
-            expect(internals.matches(mintToken(), token)).toBe(false);
-            expect(internals.matches(null, token)).toBe(false);
-            expect(internals.matches(undefined, token)).toBe(false);
-            expect(internals.matches('', token)).toBe(false);
+        it('a stored digest matches only the same digest — never an absent or emptied one', function () {
+            var digest = sha256Hex('one token');
+            expect(internals.matches(digest, digest)).toBe(true);
+            expect(internals.matches(sha256Hex('another token'), digest)).toBe(false);
+            expect(internals.matches(null, digest)).toBe(false);
+            expect(internals.matches(undefined, digest)).toBe(false);
+            expect(internals.matches('', digest)).toBe(false);
         });
         it('an expiry is live only as a valid timestamp in the future', function () {
             expect(internals.isLive((0, moment_1.default)().add(1, 'minute'))).toBe(true);
@@ -357,34 +673,107 @@ describe('executePasswordReset route', function () {
             expect(internals.isLive(undefined)).toBe(false);
             expect(internals.isLive(moment_1.default.invalid())).toBe(false);
         });
-        it('redeem writes only while the row still carries the token', function () { return __awaiter(void 0, void 0, void 0, function () {
-            var live, user, before, _a, row;
+        it("redeem writes only while the row still carries the token's digest", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var _a, user, live, before, _b, row;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
+                    case 0: return [4 /*yield*/, armResetToken('reset-redeem@test.local')];
+                    case 1:
+                        _a = _c.sent(), user = _a.user, live = _a.token;
+                        return [4 /*yield*/, userRow(user.id)];
+                    case 2:
+                        before = (_c.sent()).password;
+                        return [4 /*yield*/, expect(new PasswordResetToken_1.PasswordResetToken().redeem(user, unissuedToken(), 'other-hash')).resolves.toBe(false)];
+                    case 3:
+                        _c.sent();
+                        return [4 /*yield*/, expect(new PasswordResetToken_1.PasswordResetToken().redeem(user, sha256Hex(live), 'other-hash')).resolves.toBe(false)];
+                    case 4:
+                        _c.sent();
+                        _b = expect;
+                        return [4 /*yield*/, userRow(user.id)];
+                    case 5:
+                        _b.apply(void 0, [(_c.sent()).password]).toBe(before);
+                        return [4 /*yield*/, expect(new PasswordResetToken_1.PasswordResetToken().redeem(user, live, 'new-hash')).resolves.toBe(true)];
+                    case 6:
+                        _c.sent();
+                        return [4 /*yield*/, userRow(user.id)];
+                    case 7:
+                        row = _c.sent();
+                        expect(row.password).toBe('new-hash');
+                        expect(row.passwordResetToken).toBeNull();
+                        expect(row.passwordResetTokenExpiration).toBeNull();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('concurrent redeems of one token: exactly one resolves true, and the row holds the winner', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var _a, user, token, hashes, results, row;
             return __generator(this, function (_b) {
                 switch (_b.label) {
-                    case 0:
-                        live = mintToken();
-                        return [4 /*yield*/, armResetToken('reset-redeem@test.local', live, (0, moment_1.default)().add(1, 'hour'))];
+                    case 0: return [4 /*yield*/, armResetToken('reset-redeem-race@test.local')];
                     case 1:
-                        user = _b.sent();
+                        _a = _b.sent(), user = _a.user, token = _a.token;
+                        hashes = ['hash-1', 'hash-2', 'hash-3', 'hash-4', 'hash-5', 'hash-6', 'hash-7', 'hash-8'];
+                        return [4 /*yield*/, Promise.all(hashes.map(function (hash) { return new PasswordResetToken_1.PasswordResetToken().redeem(user, token, hash); }))];
+                    case 2:
+                        results = _b.sent();
+                        expect(results.filter(function (redeemed) { return redeemed; })).toHaveLength(1);
                         return [4 /*yield*/, userRow(user.id)];
+                    case 3:
+                        row = _b.sent();
+                        expect(row.password).toBe(hashes[results.indexOf(true)]);
+                        expect(row.passwordResetToken).toBeNull();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('revoke clears the row only while it still carries the token — a newer token is left alone', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var _a, user, withdrawn, newer, _b, row;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
+                    case 0: return [4 /*yield*/, armResetToken('reset-revoke@test.local')];
+                    case 1:
+                        _a = _c.sent(), user = _a.user, withdrawn = _a.token;
+                        return [4 /*yield*/, new PasswordResetToken_1.PasswordResetToken().mint(user)];
                     case 2:
-                        before = (_b.sent()).password;
-                        return [4 /*yield*/, expect(new PasswordResetToken_1.PasswordResetToken().redeem(user, mintToken(), 'other-hash')).resolves.toBe(false)];
+                        newer = _c.sent();
+                        return [4 /*yield*/, new PasswordResetToken_1.PasswordResetToken().revoke(user, withdrawn)];
                     case 3:
-                        _b.sent();
-                        _a = expect;
+                        _c.sent();
+                        _b = expect;
                         return [4 /*yield*/, userRow(user.id)];
                     case 4:
-                        _a.apply(void 0, [(_b.sent()).password]).toBe(before);
-                        return [4 /*yield*/, expect(new PasswordResetToken_1.PasswordResetToken().redeem(user, live, 'new-hash')).resolves.toBe(true)];
+                        _b.apply(void 0, [(_c.sent()).passwordResetToken]).toBe(sha256Hex(newer));
+                        return [4 /*yield*/, new PasswordResetToken_1.PasswordResetToken().revoke(user, newer)];
                     case 5:
-                        _b.sent();
+                        _c.sent();
                         return [4 /*yield*/, userRow(user.id)];
                     case 6:
-                        row = _b.sent();
-                        expect(row.password).toBe('new-hash');
+                        row = _c.sent();
                         expect(row.passwordResetToken).toBeNull();
                         expect(row.passwordResetTokenExpiration).toBeNull();
+                        expect(row.password).toBe('test');
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('mintedAt is the moment the outstanding token was minted — undefined when the row carries none', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var idle, user, mintedAt, _a, _b;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
+                    case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Reset User', email: 'reset-minted-at-idle@test.local' })];
+                    case 1:
+                        idle = _c.sent();
+                        return [4 /*yield*/, armResetToken('reset-minted-at@test.local')];
+                    case 2:
+                        user = (_c.sent()).user;
+                        expect(new PasswordResetToken_1.PasswordResetToken().mintedAt(idle)).toBeUndefined();
+                        _b = (_a = new PasswordResetToken_1.PasswordResetToken()).mintedAt;
+                        return [4 /*yield*/, userRow(user.id)];
+                    case 3:
+                        mintedAt = _b.apply(_a, [_c.sent()]);
+                        expect(mintedAt).toBeDefined();
+                        expect(Math.abs((0, moment_1.default)().diff(mintedAt, 'seconds'))).toBeLessThan(30);
                         return [2 /*return*/];
                 }
             });