@rpcbase/auth 0.165.0 → 0.166.0

package/dist/handler-GKdEwnBO.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler-GKdEwnBO.js","names":["z","Route","requestSchema","object","email","string","RequestPayload","infer","responseSchema","success","boolean","error","optional","ResponsePayload","crypto","Api","ApiHandler","Ctx","models","sendEmail","AuthSessionUser","ResendOtp","resendOtp","RequestPayload","ResponsePayload","payload","ctx","Promise","User","getGlobal","parsed","requestSchema","safeParse","success","res","status","error","email","data","user","findOne","emailVerificationCode","randomInt","toString","padStart","emailVerificationExpiresAt","Date","now","save","to","subject","html","text","err","console","updateOne","_id","$unset","releaseErr","api","post","Route"],"sources":["../src/api/resend-otp/index.ts","../src/api/resend-otp/handler.ts"],"sourcesContent":["import { z } from \"zod\"\n\n\nexport const Route = \"/api/rb/auth/resend-otp\"\n\nexport const requestSchema = z.object({\n  email: z.string().email(),\n})\n\nexport type RequestPayload = z.infer<typeof requestSchema>\n\nexport const responseSchema = z.object({\n  success: z.boolean(),\n  error: z.string().optional(),\n})\n\nexport type ResponsePayload = z.infer<typeof responseSchema>\n\n","import crypto from \"crypto\"\n\nimport { Api, ApiHandler, Ctx } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\nimport { sendEmail } from \"@rpcbase/server\"\n\nimport type { AuthSessionUser } from \"../../types\"\n\nimport * as ResendOtp from \"./index\"\n\n\nexport const resendOtp: ApiHandler<ResendOtp.RequestPayload, ResendOtp.ResponsePayload, AuthSessionUser> = async (\n  payload,\n  ctx: Ctx<AuthSessionUser>\n): Promise<ResendOtp.ResponsePayload> => {\n  const User = await models.getGlobal(\"RBUser\", ctx)\n\n  const parsed = ResendOtp.requestSchema.safeParse(payload)\n\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_payload\" }\n  }\n\n  const { email } = parsed.data\n\n  const user = await User.findOne({ email })\n\n  if (!user) {\n    // TODO(auth): avoid account enumeration (return a generic success response even when the user doesn't exist)\n    ctx.res.status(404)\n    return { success: false, error: \"user_not_found\" }\n  }\n\n  // TODO(auth): add server-side throttling / rate limiting for resend-otp\n  const emailVerificationCode = crypto.randomInt(0, 1_000_000).toString().padStart(6, \"0\")\n  const emailVerificationExpiresAt = new Date(Date.now() + 10 * 60 * 1000)\n\n  user.emailVerificationCode = emailVerificationCode\n  user.emailVerificationExpiresAt = emailVerificationExpiresAt\n  await user.save()\n\n  try {\n    await sendEmail({\n      to: email,\n      subject: `Your verification code: ${emailVerificationCode}`,\n      html: `\n        <p>Your verification code is <strong>${emailVerificationCode}</strong>. It expires in 10 minutes.</p>\n        <p>If you didn't request this, you can ignore this message.</p>\n      `,\n      text: `Your verification code is ${emailVerificationCode}. It expires in 10 minutes. If you didn't request this, you can ignore this message.`,\n    })\n  } catch (err) {\n    console.error(\"failed to resend otp email\", err)\n\n    try {\n      await User.updateOne(\n        { _id: user._id, emailVerificationCode },\n        {\n          $unset: {\n            emailVerificationCode: \"\",\n            emailVerificationExpiresAt: \"\",\n          },\n        },\n      )\n    } catch (releaseErr) {\n      console.error(\"failed to clear unsent otp\", releaseErr)\n    }\n\n    ctx.res.status(500)\n    return { success: false, error: \"email_delivery_failed\" }\n  }\n\n  return { success: true }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.post(ResendOtp.Route, resendOtp)\n}\n"],"mappings":";;;;;AAGA,IAAaC,QAAQ;AAErB,IAAaC,gBAAgBF,OAAS,EACpCI,OAAOJ,OAAS,CAAC,CAACI,MAAM,EAC1B,CAAC;AAI6BJ,OAAS;CACrCS,SAAST,QAAU;CACnBW,OAAOX,OAAS,CAAC,CAACY,SAAS;AAC7B,CAAC;;;ACHD,IAAaU,YAA8F,OACzGG,SACAC,QACuC;CACvC,MAAME,OAAO,MAAMV,OAAOW,UAAU,UAAUH,GAAG;CAEjD,MAAMI,SAAAA,cAAiCE,UAAUP,OAAO;CAExD,IAAI,CAACK,OAAOG,SAAS;EACnBP,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAkB;CACpD;CAEA,MAAM,EAAEC,UAAUP,OAAOQ;CAEzB,MAAMC,OAAO,MAAMX,KAAKY,QAAQ,EAAEH,MAAM,CAAC;CAEzC,IAAI,CAACE,MAAM;EAETb,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAiB;CACnD;CAGA,MAAMK,wBAAwB3B,OAAO4B,UAAU,GAAG,GAAS,CAAC,CAACC,SAAS,CAAC,CAACC,SAAS,GAAG,GAAG;CACvF,MAAMC,6BAA6B,IAAIC,KAAKA,KAAKC,IAAI,IAAI,MAAU,GAAI;CAEvER,KAAKE,wBAAwBA;CAC7BF,KAAKM,6BAA6BA;CAClC,MAAMN,KAAKS,KAAK;CAEhB,IAAI;EACF,MAAM7B,UAAU;GACd8B,IAAIZ;GACJa,SAAS,2BAA2BT;GACpCU,MAAM;+CACmCV,sBAAqB;;;GAG9DW,MAAM,6BAA6BX,sBAAqB;EAC1D,CAAC;CACH,SAASY,KAAK;EACZC,QAAQlB,MAAM,8BAA8BiB,GAAG;EAE/C,IAAI;GACF,MAAMzB,KAAK2B,UACT;IAAEC,KAAKjB,KAAKiB;IAAKf;GAAsB,GACvC,EACEgB,QAAQ;IACNhB,uBAAuB;IACvBI,4BAA4B;GAC9B,EACF,CACF;EACF,SAASa,YAAY;GACnBJ,QAAQlB,MAAM,8BAA8BsB,UAAU;EACxD;EAEAhC,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAwB;CAC1D;CAEA,OAAO,EAAEH,SAAS,KAAK;AACzB;AAEA,IAAA,mBAAgB0B,QAA8B;CAC5CA,IAAIC,KAAKvC,OAAiBC,SAAS;AACrC"}

package/dist/handler-IBGVDW5w.js

@@ -0,0 +1,125 @@
+import { a as string, i as object, n as boolean, r as number } from "./schemas-BgOpQqUv.js";
+import crypto from "crypto";
+import { models } from "@rpcbase/db";
+import { sendEmail } from "@rpcbase/server";
+//#region src/api/request-password-reset/index.ts
+var Route = "/api/rb/auth/request-password-reset";
+var requestSchema = object({ email: string().email() });
+object({
+	success: boolean(),
+	error: string().optional(),
+	retryAfterSeconds: number().int().positive().optional()
+});
+//#endregion
+//#region src/api/request-password-reset/handler.ts
+var PASSWORD_RESET_COOLDOWN_SECONDS = 60;
+var PASSWORD_RESET_CODE_TTL_SECONDS = 600;
+var maskEmailForLog = (email) => {
+	const [localRaw, domainRaw = ""] = email.split("@");
+	const local = localRaw || "";
+	const domain = domainRaw || "";
+	const localPrefix = local.slice(0, Math.min(3, local.length));
+	const localMask = "*".repeat(Math.max(5, local.length - localPrefix.length));
+	if (!domain) return `${localPrefix}${localMask}@****`;
+	const domainTailLength = Math.min(7, domain.length);
+	const domainTail = domain.slice(-domainTailLength);
+	return `${localPrefix}${localMask}@${"*".repeat(Math.max(4, domain.length - domainTailLength))}${domainTail}`;
+};
+var requestPasswordReset = async (payload, ctx) => {
+	const User = await models.getGlobal("RBUser", ctx);
+	const parsed = requestSchema.safeParse(payload);
+	if (!parsed.success) {
+		ctx.res.status(400);
+		return {
+			success: false,
+			error: "invalid_payload"
+		};
+	}
+	const { email } = parsed.data;
+	const requestedAt = /* @__PURE__ */ new Date();
+	const cooldownEligibleExpiresAt = new Date(requestedAt.getTime() + (PASSWORD_RESET_CODE_TTL_SECONDS - 60) * 1e3);
+	const passwordResetCode = crypto.randomInt(0, 1e6).toString().padStart(6, "0");
+	const passwordResetCodeExpiresAt = new Date(requestedAt.getTime() + PASSWORD_RESET_CODE_TTL_SECONDS * 1e3);
+	const user = await User.findOneAndUpdate({
+		email,
+		$or: [{ passwordResetCodeExpiresAt: { $exists: false } }, { passwordResetCodeExpiresAt: { $lte: cooldownEligibleExpiresAt } }]
+	}, {
+		$set: {
+			passwordResetCode,
+			passwordResetCodeExpiresAt
+		},
+		$unset: {
+			passwordResetToken: "",
+			passwordResetTokenExpiresAt: ""
+		}
+	}, { returnDocument: "after" });
+	ctx.res.setHeader("Retry-After", String(60));
+	if (!user) {
+		if (!await User.findOne({ email }, { _id: 1 })) try {
+			console.info(`sending password reset account notice to email ${maskEmailForLog(email)}`);
+			await sendEmail({
+				to: email,
+				subject: "No account found for your password reset request",
+				html: `
+            <p>Hello,</p>
+            <p>You requested a new password reset code for this email address, but unfortunately we couldn't find an account associated with it.</p>
+            <p>If you didn't request this, you can ignore this message.</p>
+            <p>If you're having trouble accessing your account, please contact support.</p>
+          `,
+				text: "Hello, You requested a new password reset code for this email address, but unfortunately we couldn't find an account associated with it. If you didn't request this, you can ignore this message. If you're having trouble accessing your account, please contact support."
+			});
+		} catch (err) {
+			console.error("failed to send password reset account notice email", err);
+			ctx.res.status(500);
+			return {
+				success: false,
+				error: "email_delivery_failed"
+			};
+		}
+		return {
+			success: true,
+			retryAfterSeconds: 60
+		};
+	}
+	try {
+		console.info(`sending password reset to email ${maskEmailForLog(email)}`);
+		await sendEmail({
+			to: email,
+			subject: `Your password reset code: ${passwordResetCode}`,
+			html: `
+        <p>Your password reset code is <strong>${passwordResetCode}</strong>. It expires in 10 minutes.</p>
+        <p>If you didn't request this, you can ignore this message.</p>
+      `,
+			text: `Your password reset code is ${passwordResetCode}. It expires in 10 minutes. If you didn't request this, you can ignore this message.`
+		});
+	} catch (err) {
+		console.error("failed to send password reset email", err);
+		try {
+			if ((await User.updateOne({
+				_id: user._id,
+				passwordResetCode
+			}, { $unset: {
+				passwordResetCode: "",
+				passwordResetCodeExpiresAt: ""
+			} })).modifiedCount > 0) ctx.res.removeHeader("Retry-After");
+		} catch (releaseErr) {
+			console.error("failed to release password reset cooldown", releaseErr);
+		}
+		ctx.res.status(500);
+		return {
+			success: false,
+			error: "email_delivery_failed"
+		};
+	}
+	return {
+		success: true,
+		retryAfterSeconds: 60
+	};
+};
+var handler_default = (api) => {
+	api.post(Route, requestPasswordReset);
+};
+//#endregion
+export { PASSWORD_RESET_COOLDOWN_SECONDS, handler_default as default, requestPasswordReset };
+
+//# sourceMappingURL=handler-IBGVDW5w.js.map

package/dist/handler-IBGVDW5w.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler-IBGVDW5w.js","names":["z","Route","requestSchema","object","email","string","RequestPayload","infer","responseSchema","success","boolean","error","optional","retryAfterSeconds","number","int","positive","ResponsePayload","crypto","Api","ApiHandler","Ctx","models","sendEmail","AuthSessionUser","RequestPasswordReset","PASSWORD_RESET_COOLDOWN_SECONDS","PASSWORD_RESET_CODE_TTL_SECONDS","maskEmailForLog","email","localRaw","domainRaw","split","local","domain","localPrefix","slice","Math","min","length","localMask","repeat","max","domainTailLength","domainTail","domainMask","requestPasswordReset","RequestPayload","ResponsePayload","payload","ctx","Promise","User","getGlobal","parsed","requestSchema","safeParse","success","res","status","error","data","requestedAt","Date","cooldownEligibleExpiresAt","getTime","passwordResetCode","randomInt","toString","padStart","passwordResetCodeExpiresAt","user","findOneAndUpdate","$or","$exists","$lte","$set","$unset","passwordResetToken","passwordResetTokenExpiresAt","returnDocument","setHeader","String","existingUser","findOne","_id","console","info","to","subject","html","text","err","retryAfterSeconds","releaseResult","updateOne","modifiedCount","removeHeader","releaseErr","api","post","Route"],"sources":["../src/api/request-password-reset/index.ts","../src/api/request-password-reset/handler.ts"],"sourcesContent":["import { z } from \"zod\"\n\n\nexport const Route = \"/api/rb/auth/request-password-reset\"\n\nexport const requestSchema = z.object({\n  email: z.string().email(),\n})\n\nexport type RequestPayload = z.infer<typeof requestSchema>\n\nexport const responseSchema = z.object({\n  success: z.boolean(),\n  error: z.string().optional(),\n  retryAfterSeconds: z.number().int().positive().optional(),\n})\n\nexport type ResponsePayload = z.infer<typeof responseSchema>\n","import crypto from \"crypto\"\n\nimport { Api, ApiHandler, Ctx } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\nimport { sendEmail } from \"@rpcbase/server\"\n\nimport type { AuthSessionUser } from \"../../types\"\n\nimport * as RequestPasswordReset from \"./index\"\n\n\nexport const PASSWORD_RESET_COOLDOWN_SECONDS = 60\nconst PASSWORD_RESET_CODE_TTL_SECONDS = 10 * 60\n\nconst maskEmailForLog = (email: string) => {\n  const [localRaw, domainRaw = \"\"] = email.split(\"@\")\n  const local = localRaw || \"\"\n  const domain = domainRaw || \"\"\n  const localPrefix = local.slice(0, Math.min(3, local.length))\n  const localMask = \"*\".repeat(Math.max(5, local.length - localPrefix.length))\n\n  if (!domain) {\n    return `${localPrefix}${localMask}@****`\n  }\n\n  const domainTailLength = Math.min(7, domain.length)\n  const domainTail = domain.slice(-domainTailLength)\n  const domainMask = \"*\".repeat(Math.max(4, domain.length - domainTailLength))\n\n  return `${localPrefix}${localMask}@${domainMask}${domainTail}`\n}\n\n\nexport const requestPasswordReset: ApiHandler<\n  RequestPasswordReset.RequestPayload,\n  RequestPasswordReset.ResponsePayload,\n  AuthSessionUser\n> = async(\n  payload,\n  ctx: Ctx<AuthSessionUser>\n): Promise<RequestPasswordReset.ResponsePayload> => {\n  const User = await models.getGlobal(\"RBUser\", ctx)\n\n  const parsed = RequestPasswordReset.requestSchema.safeParse(payload)\n\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_payload\" }\n  }\n\n  const { email } = parsed.data\n  const requestedAt = new Date()\n  const cooldownEligibleExpiresAt = new Date(\n    requestedAt.getTime() + (PASSWORD_RESET_CODE_TTL_SECONDS - PASSWORD_RESET_COOLDOWN_SECONDS) * 1000,\n  )\n  const passwordResetCode = crypto.randomInt(0, 1_000_000).toString().padStart(6, \"0\")\n  const passwordResetCodeExpiresAt = new Date(requestedAt.getTime() + PASSWORD_RESET_CODE_TTL_SECONDS * 1000)\n\n  const user = await User.findOneAndUpdate(\n    {\n      email,\n      $or: [\n        { passwordResetCodeExpiresAt: { $exists: false } },\n        { passwordResetCodeExpiresAt: { $lte: cooldownEligibleExpiresAt } },\n      ],\n    },\n    {\n      $set: {\n        passwordResetCode,\n        passwordResetCodeExpiresAt,\n      },\n      $unset: {\n        passwordResetToken: \"\",\n        passwordResetTokenExpiresAt: \"\",\n      },\n    },\n    { returnDocument: \"after\" },\n  )\n\n  ctx.res.setHeader(\"Retry-After\", String(PASSWORD_RESET_COOLDOWN_SECONDS))\n\n  if (!user) {\n    const existingUser = await User.findOne({ email }, { _id: 1 })\n\n    if (!existingUser) {\n      try {\n        console.info(`sending password reset account notice to email ${maskEmailForLog(email)}`)\n        await sendEmail({\n          to: email,\n          subject: \"No account found for your password reset request\",\n          html: `\n            <p>Hello,</p>\n            <p>You requested a new password reset code for this email address, but unfortunately we couldn't find an account associated with it.</p>\n            <p>If you didn't request this, you can ignore this message.</p>\n            <p>If you're having trouble accessing your account, please contact support.</p>\n          `,\n          text: \"Hello, You requested a new password reset code for this email address, but unfortunately we couldn't find an account associated with it. If you didn't request this, you can ignore this message. If you're having trouble accessing your account, please contact support.\",\n        })\n      } catch (err) {\n        console.error(\"failed to send password reset account notice email\", err)\n        ctx.res.status(500)\n        return { success: false, error: \"email_delivery_failed\" }\n      }\n    }\n\n    return { success: true, retryAfterSeconds: PASSWORD_RESET_COOLDOWN_SECONDS }\n  }\n\n  try {\n    console.info(`sending password reset to email ${maskEmailForLog(email)}`)\n    await sendEmail({\n      to: email,\n      subject: `Your password reset code: ${passwordResetCode}`,\n      html: `\n        <p>Your password reset code is <strong>${passwordResetCode}</strong>. It expires in 10 minutes.</p>\n        <p>If you didn't request this, you can ignore this message.</p>\n      `,\n      text: `Your password reset code is ${passwordResetCode}. It expires in 10 minutes. If you didn't request this, you can ignore this message.`,\n    })\n  } catch (err) {\n    console.error(\"failed to send password reset email\", err)\n\n    try {\n      const releaseResult = await User.updateOne(\n        { _id: user._id, passwordResetCode },\n        {\n          $unset: {\n            passwordResetCode: \"\",\n            passwordResetCodeExpiresAt: \"\",\n          },\n        },\n      )\n      if (releaseResult.modifiedCount > 0) {\n        ctx.res.removeHeader(\"Retry-After\")\n      }\n    } catch (releaseErr) {\n      console.error(\"failed to release password reset cooldown\", releaseErr)\n    }\n\n    ctx.res.status(500)\n    return { success: false, error: \"email_delivery_failed\" }\n  }\n\n  return { success: true, retryAfterSeconds: PASSWORD_RESET_COOLDOWN_SECONDS }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.post(RequestPasswordReset.Route, requestPasswordReset)\n}\n"],"mappings":";;;;;AAGA,IAAaC,QAAQ;AAErB,IAAaC,gBAAgBF,OAAS,EACpCI,OAAOJ,OAAS,CAAC,CAACI,MAAM,EAC1B,CAAC;AAI6BJ,OAAS;CACrCS,SAAST,QAAU;CACnBW,OAAOX,OAAS,CAAC,CAACY,SAAS;CAC3BC,mBAAmBb,OAAS,CAAC,CAACe,IAAI,CAAC,CAACC,SAAS,CAAC,CAACJ,SAAS;AAC1D,CAAC;;;ACJD,IAAac,kCAAkC;AAC/C,IAAMC,kCAAkC;AAExC,IAAMC,mBAAmBC,UAAkB;CACzC,MAAM,CAACC,UAAUC,YAAY,MAAMF,MAAMG,MAAM,GAAG;CAClD,MAAMC,QAAQH,YAAY;CAC1B,MAAMI,SAASH,aAAa;CAC5B,MAAMI,cAAcF,MAAMG,MAAM,GAAGC,KAAKC,IAAI,GAAGL,MAAMM,MAAM,CAAC;CAC5D,MAAMC,YAAY,IAAIC,OAAOJ,KAAKK,IAAI,GAAGT,MAAMM,SAASJ,YAAYI,MAAM,CAAC;CAE3E,IAAI,CAACL,QACH,OAAO,GAAGC,cAAcK,UAAS;CAGnC,MAAMG,mBAAmBN,KAAKC,IAAI,GAAGJ,OAAOK,MAAM;CAClD,MAAMK,aAAaV,OAAOE,MAAM,CAACO,gBAAgB;CAGjD,OAAO,GAAGR,cAAcK,UAAS,GAFd,IAAIC,OAAOJ,KAAKK,IAAI,GAAGR,OAAOK,SAASI,gBAAgB,CAErCE,IAAaD;AACpD;AAGA,IAAaE,uBAIT,OACFG,SACAC,QACkD;CAClD,MAAME,OAAO,MAAM9B,OAAO+B,UAAU,UAAUH,GAAG;CAEjD,MAAMI,SAAAA,cAA4CE,UAAUP,OAAO;CAEnE,IAAI,CAACK,OAAOG,SAAS;EACnBP,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAkB;CACpD;CAEA,MAAM,EAAE/B,UAAUyB,OAAOO;CACzB,MAAMC,8BAAc,IAAIC,KAAK;CAC7B,MAAMC,4BAA4B,IAAID,KACpCD,YAAYG,QAAQ,KAAKtC,kCAAAA,MAAqE,GAChG;CACA,MAAMuC,oBAAoBhD,OAAOiD,UAAU,GAAG,GAAS,CAAC,CAACC,SAAS,CAAC,CAACC,SAAS,GAAG,GAAG;CACnF,MAAMC,6BAA6B,IAAIP,KAAKD,YAAYG,QAAQ,IAAItC,kCAAkC,GAAI;CAE1G,MAAM4C,OAAO,MAAMnB,KAAKoB,iBACtB;EACE3C;EACA4C,KAAK,CACH,EAAEH,4BAA4B,EAAEI,SAAS,MAAM,EAAE,GACjD,EAAEJ,4BAA4B,EAAEK,MAAMX,0BAA0B,EAAE,CAAC;CAEvE,GACA;EACEY,MAAM;GACJV;GACAI;EACF;EACAO,QAAQ;GACNC,oBAAoB;GACpBC,6BAA6B;EAC/B;CACF,GACA,EAAEC,gBAAgB,QAAQ,CAC5B;CAEA9B,IAAIQ,IAAIuB,UAAU,eAAeC,OAAAA,EAAsC,CAAC;CAExE,IAAI,CAACX,MAAM;EAGT,IAAI,CAACY,MAFsB/B,KAAKgC,QAAQ,EAAEvD,MAAM,GAAG,EAAEwD,KAAK,EAAE,CAAC,GAG3D,IAAI;GACFC,QAAQC,KAAK,kDAAkD3D,gBAAgBC,KAAK,GAAG;GACvF,MAAMN,UAAU;IACdiE,IAAI3D;IACJ4D,SAAS;IACTC,MAAM;;;;;;IAMNC,MAAM;GACR,CAAC;EACH,SAASC,KAAK;GACZN,QAAQ1B,MAAM,sDAAsDgC,GAAG;GACvE1C,IAAIQ,IAAIC,OAAO,GAAG;GAClB,OAAO;IAAEF,SAAS;IAAOG,OAAO;GAAwB;EAC1D;EAGF,OAAO;GAAEH,SAAS;GAAMoC,mBAAAA;EAAmD;CAC7E;CAEA,IAAI;EACFP,QAAQC,KAAK,mCAAmC3D,gBAAgBC,KAAK,GAAG;EACxE,MAAMN,UAAU;GACdiE,IAAI3D;GACJ4D,SAAS,6BAA6BvB;GACtCwB,MAAM;iDACqCxB,kBAAiB;;;GAG5DyB,MAAM,+BAA+BzB,kBAAiB;EACxD,CAAC;CACH,SAAS0B,KAAK;EACZN,QAAQ1B,MAAM,uCAAuCgC,GAAG;EAExD,IAAI;GAUF,KAAIE,MATwB1C,KAAK2C,UAC/B;IAAEV,KAAKd,KAAKc;IAAKnB;GAAkB,GACnC,EACEW,QAAQ;IACNX,mBAAmB;IACnBI,4BAA4B;GAC9B,EACF,CACF,EAAA,CACkB0B,gBAAgB,GAChC9C,IAAIQ,IAAIuC,aAAa,aAAa;EAEtC,SAASC,YAAY;GACnBZ,QAAQ1B,MAAM,6CAA6CsC,UAAU;EACvE;EAEAhD,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAwB;CAC1D;CAEA,OAAO;EAAEH,SAAS;EAAMoC,mBAAAA;CAAmD;AAC7E;AAEA,IAAA,mBAAgBM,QAA8B;CAC5CA,IAAIC,KAAK3E,OAA4BqB,oBAAoB;AAC3D"}

package/dist/handler-J2OwFTyf.js

@@ -0,0 +1,51 @@
+import { a as string, i as object, n as boolean } from "./schemas-BgOpQqUv.js";
+import { models } from "@rpcbase/db";
+import { hashPasswordForStorage } from "@rpcbase/server";
+//#region src/api/set-new-password/index.ts
+var Route = "/api/rb/auth/set-new-password";
+var requestSchema = object({
+	email: string().email(),
+	resetToken: string().min(1),
+	password: string().min(8, { message: "Password must be at least 8 characters long." })
+});
+object({
+	success: boolean(),
+	error: string().optional()
+});
+//#endregion
+//#region src/api/set-new-password/handler.ts
+var setNewPassword = async (payload, ctx) => {
+	const User = await models.getGlobal("RBUser", ctx);
+	const parsed = requestSchema.safeParse(payload);
+	if (!parsed.success) {
+		ctx.res.status(400);
+		return {
+			success: false,
+			error: "invalid_payload"
+		};
+	}
+	const { email, resetToken, password } = parsed.data;
+	const user = await User.findOne({ email });
+	const storedToken = user?.passwordResetToken;
+	const tokenExpiresAt = user?.passwordResetTokenExpiresAt;
+	const isExpired = tokenExpiresAt instanceof Date && tokenExpiresAt.getTime() < Date.now();
+	if (!user || !storedToken || storedToken !== resetToken || isExpired) {
+		ctx.res.status(400);
+		return {
+			success: false,
+			error: "invalid_token"
+		};
+	}
+	user.password = await hashPasswordForStorage(password);
+	user.passwordResetToken = void 0;
+	user.passwordResetTokenExpiresAt = void 0;
+	await user.save();
+	return { success: true };
+};
+var handler_default = (api) => {
+	api.post(Route, setNewPassword);
+};
+//#endregion
+export { handler_default as default };
+
+//# sourceMappingURL=handler-J2OwFTyf.js.map

package/dist/handler-J2OwFTyf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler-J2OwFTyf.js","names":["z","Route","requestSchema","object","email","string","resetToken","min","password","message","RequestPayload","infer","responseSchema","success","boolean","error","optional","ResponsePayload","Api","ApiHandler","Ctx","models","hashPasswordForStorage","AuthSessionUser","SetNewPassword","setNewPassword","RequestPayload","ResponsePayload","payload","ctx","Promise","User","getGlobal","parsed","requestSchema","safeParse","success","res","status","error","email","resetToken","password","data","user","findOne","storedToken","passwordResetToken","tokenExpiresAt","passwordResetTokenExpiresAt","isExpired","Date","getTime","now","hashedPassword","undefined","save","api","post","Route"],"sources":["../src/api/set-new-password/index.ts","../src/api/set-new-password/handler.ts"],"sourcesContent":["import { z } from \"zod\"\n\n\nexport const Route = \"/api/rb/auth/set-new-password\"\n\nexport const requestSchema = z.object({\n  email: z.string().email(),\n  resetToken: z.string().min(1),\n  password: z.string().min(8, { message: \"Password must be at least 8 characters long.\" }),\n})\n\nexport type RequestPayload = z.infer<typeof requestSchema>\n\nexport const responseSchema = z.object({\n  success: z.boolean(),\n  error: z.string().optional(),\n})\n\nexport type ResponsePayload = z.infer<typeof responseSchema>\n","import { Api, ApiHandler, Ctx } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\nimport { hashPasswordForStorage } from \"@rpcbase/server\"\n\nimport type { AuthSessionUser } from \"../../types\"\n\nimport * as SetNewPassword from \"./index\"\n\n\nconst setNewPassword: ApiHandler<\n  SetNewPassword.RequestPayload,\n  SetNewPassword.ResponsePayload,\n  AuthSessionUser\n> = async(\n  payload,\n  ctx: Ctx<AuthSessionUser>\n): Promise<SetNewPassword.ResponsePayload> => {\n  const User = await models.getGlobal(\"RBUser\", ctx)\n\n  const parsed = SetNewPassword.requestSchema.safeParse(payload)\n\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_payload\" }\n  }\n\n  const { email, resetToken, password } = parsed.data\n\n  const user = await User.findOne({ email })\n  const storedToken = user?.passwordResetToken\n  const tokenExpiresAt = user?.passwordResetTokenExpiresAt\n  const isExpired = tokenExpiresAt instanceof Date && tokenExpiresAt.getTime() < Date.now()\n\n  if (!user || !storedToken || storedToken !== resetToken || isExpired) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_token\" }\n  }\n\n  const hashedPassword = await hashPasswordForStorage(password)\n  user.password = hashedPassword\n  user.passwordResetToken = undefined\n  user.passwordResetTokenExpiresAt = undefined\n  await user.save()\n\n  return { success: true }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.post(SetNewPassword.Route, setNewPassword)\n}\n"],"mappings":";;;;AAGA,IAAaC,QAAQ;AAErB,IAAaC,gBAAgBF,OAAS;CACpCI,OAAOJ,OAAS,CAAC,CAACI,MAAM;CACxBE,YAAYN,OAAS,CAAC,CAACO,IAAI,CAAC;CAC5BC,UAAUR,OAAS,CAAC,CAACO,IAAI,GAAG,EAAEE,SAAS,+CAA+C,CAAC;AACzF,CAAC;AAI6BT,OAAS;CACrCa,SAASb,QAAU;CACnBe,OAAOf,OAAS,CAAC,CAACgB,SAAS;AAC7B,CAAC;;;ACPD,IAAMS,iBAIF,OACFG,SACAC,QAC4C;CAC5C,MAAME,OAAO,MAAMV,OAAOW,UAAU,UAAUH,GAAG;CAEjD,MAAMI,SAAAA,cAAsCE,UAAUP,OAAO;CAE7D,IAAI,CAACK,OAAOG,SAAS;EACnBP,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAkB;CACpD;CAEA,MAAM,EAAEC,OAAOC,YAAYC,aAAaT,OAAOU;CAE/C,MAAMC,OAAO,MAAMb,KAAKc,QAAQ,EAAEL,MAAM,CAAC;CACzC,MAAMM,cAAcF,MAAMG;CAC1B,MAAMC,iBAAiBJ,MAAMK;CAC7B,MAAMC,YAAYF,0BAA0BG,QAAQH,eAAeI,QAAQ,IAAID,KAAKE,IAAI;CAExF,IAAI,CAACT,QAAQ,CAACE,eAAeA,gBAAgBL,cAAcS,WAAW;EACpErB,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAgB;CAClD;CAGAK,KAAKF,WAAWY,MADahC,uBAAuBoB,QAAQ;CAE5DE,KAAKG,qBAAqBQ,KAAAA;CAC1BX,KAAKK,8BAA8BM,KAAAA;CACnC,MAAMX,KAAKY,KAAK;CAEhB,OAAO,EAAEpB,SAAS,KAAK;AACzB;AAEA,IAAA,mBAAgBqB,QAA8B;CAC5CA,IAAIC,KAAKlC,OAAsBC,cAAc;AAC/C"}