KrikoriosandClaude Fable 5
eceb6b45d5
SMTP: - Add connection/greeting/socket timeouts so a stalled Gmail connection no longer hangs sign-up - Wrap sendMail in try/catch and fall back to logging the code - Derive secure from port (465 implicit TLS vs 587 STARTTLS) - Strip whitespace from the Gmail app password - Document SMTP_HOST/SMTP_PORT in .env.example and environment.d.ts Password reset (new): - POST /(api)/auth/forgot-password emails a 6-digit code and does not reveal whether the address is registered - POST /(api)/auth/reset-password validates the code, sets the new password, verifies the email, and signs the user in - password_reset_codes table added to seed-db.mjs - "Forgot password?" flow on the mobile sign-in screen User deletion (new): - DELETE /(api)/admin/users/[id], owner-only, blocks self-deletion - Delete button with confirmation on the dashboard Users page Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
80 lines
2.1 KiB
TypeScript
80 lines
2.1 KiB
TypeScript
import { createHash } from "crypto";
|
|
|
|
import { sql } from "@/lib/db";
|
|
import { hashPassword } from "@/lib/password";
|
|
import { issueSession, toProfile } from "@/lib/users";
|
|
|
|
const hashCode = (email: string, code: string): string =>
|
|
createHash("sha256").update(`${email}:${code}`).digest("hex");
|
|
|
|
export async function POST(req: Request) {
|
|
const { email, code, password } = await req.json();
|
|
|
|
if (!email?.trim() || !/^\d{6}$/.test(code ?? "")) {
|
|
return Response.json(
|
|
{ error: "Email and a 6-digit code are required." },
|
|
{ status: 400 },
|
|
);
|
|
}
|
|
|
|
if (typeof password !== "string" || password.length < 8) {
|
|
return Response.json(
|
|
{ error: "Password must be at least 8 characters." },
|
|
{ status: 400 },
|
|
);
|
|
}
|
|
|
|
const normalized = email.trim().toLowerCase();
|
|
|
|
try {
|
|
const valid = await sql<{ email: string }>`
|
|
SELECT email FROM password_reset_codes
|
|
WHERE email = ${normalized}
|
|
AND code_hash = ${hashCode(normalized, code)}
|
|
AND expires_at > CURRENT_TIMESTAMP
|
|
`;
|
|
|
|
if (!valid[0]) {
|
|
await sql`
|
|
UPDATE password_reset_codes SET attempts = attempts + 1
|
|
WHERE email = ${normalized}
|
|
`;
|
|
|
|
return Response.json(
|
|
{ error: "Invalid or expired reset code." },
|
|
{ status: 400 },
|
|
);
|
|
}
|
|
|
|
// A successful reset also proves control of the mailbox, so verify it too.
|
|
const rows = await sql<{
|
|
id: string;
|
|
name: string;
|
|
email: string;
|
|
role: string | null;
|
|
}>`
|
|
UPDATE users
|
|
SET password_hash = ${hashPassword(password)}, email_verified = TRUE
|
|
WHERE email = ${normalized}
|
|
RETURNING id, name, email, role
|
|
`;
|
|
|
|
const user = rows[0];
|
|
|
|
if (!user) {
|
|
return Response.json({ error: "User not found." }, { status: 404 });
|
|
}
|
|
|
|
await sql`DELETE FROM password_reset_codes WHERE email = ${normalized}`;
|
|
|
|
const session = issueSession(user);
|
|
|
|
return Response.json({
|
|
data: { token: session.token, user: toProfile(user) },
|
|
});
|
|
} catch (error) {
|
|
console.error("[RESET_PASSWORD]: ", error);
|
|
return Response.json({ error: "Internal Server Error" }, { status: 500 });
|
|
}
|
|
}
|