{"version":3,"file":"reset-password.mjs","names":["userTokenServices.getSingle","constants","securityAuditServices.logSecurityAudit","sendEmail","emailServices.sendEmail"],"sources":["../../../src/services/account/reset-password.ts"],"sourcesContent":["import { scrypt } from \"@noble/hashes/scrypt.js\";\nimport constants from \"../../constants/constants.js\";\nimport { copy } from \"../../libs/i18n/index.js\";\nimport {\n\tUsersRepository,\n\tUserTokensRepository,\n} from \"../../libs/repositories/index.js\";\nimport {\n\tformatEmailSubject,\n\tgenerateSecret,\n} from \"../../utils/helpers/index.js\";\nimport type { ServiceFn } from \"../../utils/services/types.js\";\nimport {\n\temailServices,\n\tsecurityAuditServices,\n\tuserTokenServices,\n} from \"../index.js\";\n\nconst resetPassword: ServiceFn<\n\t[\n\t\t{\n\t\t\ttoken: string;\n\t\t\tpassword: string;\n\t\t},\n\t],\n\tundefined\n> = async (context, data) => {\n\tif (context.config.auth.password.enabled === false) {\n\t\treturn {\n\t\t\terror: {\n\t\t\t\ttype: \"basic\",\n\t\t\t\tstatus: 400,\n\t\t\t\tmessage: copy(\n\t\t\t\t\t\"server:core.auth.password.authentication.disabled.message\",\n\t\t\t\t),\n\t\t\t},\n\t\t\tdata: undefined,\n\t\t};\n\t}\n\n\tconst UserTokens = new UserTokensRepository(\n\t\tcontext.db.client,\n\t\tcontext.config.db,\n\t);\n\tconst Users = new UsersRepository(context.db.client, context.config.db);\n\n\tconst tokenRes = await userTokenServices.getSingle(context, {\n\t\ttoken: data.token,\n\t\ttokenType: constants.userTokens.passwordReset,\n\t});\n\tif (tokenRes.error) return tokenRes;\n\n\tif (tokenRes.data.user_id === null) {\n\t\treturn {\n\t\t\terror: {\n\t\t\t\ttype: \"basic\",\n\t\t\t\tmessage: copy(\"server:core.tokens.not.found.message\"),\n\t\t\t\tstatus: 404,\n\t\t\t},\n\t\t\tdata: undefined,\n\t\t};\n\t}\n\n\tconst userRes = await Users.selectSingle({\n\t\tselect: [\"id\"],\n\t\twhere: [\n\t\t\t{\n\t\t\t\tkey: \"id\",\n\t\t\t\toperator: \"=\",\n\t\t\t\tvalue: tokenRes.data.user_id,\n\t\t\t},\n\t\t],\n\t\tvalidation: {\n\t\t\tenabled: true,\n\t\t\tdefaultError: {\n\t\t\t\tstatus: 404,\n\t\t\t\tmessage: copy(\"server:core.user.not.found.message\"),\n\t\t\t},\n\t\t},\n\t});\n\tif (userRes.error) return userRes;\n\n\tconst now = new Date().toISOString();\n\tconst consumeTokenRes = await UserTokens.updateSingle({\n\t\tdata: {\n\t\t\tconsumed_at: now,\n\t\t\trevoked_at: now,\n\t\t\trevoke_reason: constants.userTokenRevokeReasons.passwordResetUsed,\n\t\t\texpiry_date: now,\n\t\t},\n\t\twhere: [\n\t\t\t{\n\t\t\t\tkey: \"id\",\n\t\t\t\toperator: \"=\",\n\t\t\t\tvalue: tokenRes.data.id,\n\t\t\t},\n\t\t\t{\n\t\t\t\tkey: \"token_type\",\n\t\t\t\toperator: \"=\",\n\t\t\t\tvalue: constants.userTokens.passwordReset,\n\t\t\t},\n\t\t\t{\n\t\t\t\tkey: \"expiry_date\",\n\t\t\t\toperator: \">\",\n\t\t\t\tvalue: now,\n\t\t\t},\n\t\t\t{\n\t\t\t\tkey: \"revoked_at\",\n\t\t\t\toperator: \"is\",\n\t\t\t\tvalue: null,\n\t\t\t},\n\t\t\t{\n\t\t\t\tkey: \"consumed_at\",\n\t\t\t\toperator: \"is\",\n\t\t\t\tvalue: null,\n\t\t\t},\n\t\t],\n\t\treturning: [\"id\"],\n\t});\n\tif (consumeTokenRes.error) return consumeTokenRes;\n\tif (!consumeTokenRes.data) {\n\t\treturn {\n\t\t\terror: {\n\t\t\t\ttype: \"basic\",\n\t\t\t\tmessage: copy(\"server:core.tokens.not.found.message\"),\n\t\t\t\tstatus: 404,\n\t\t\t},\n\t\t\tdata: undefined,\n\t\t};\n\t}\n\n\tconst { secret, encryptSecret } = generateSecret(\n\t\tcontext.config.secrets.encryption,\n\t);\n\n\tconst hashedPassword = Buffer.from(\n\t\tscrypt(data.password, secret, constants.scrypt),\n\t).toString(\"base64\");\n\n\tconst [updatedUserRes, auditRes] = await Promise.all([\n\t\tUsers.updateSingle({\n\t\t\tdata: {\n\t\t\t\tpassword: hashedPassword,\n\t\t\t\tsecret: encryptSecret,\n\t\t\t\tupdated_at: new Date().toISOString(),\n\t\t\t},\n\t\t\twhere: [\n\t\t\t\t{\n\t\t\t\t\tkey: \"id\",\n\t\t\t\t\toperator: \"=\",\n\t\t\t\t\tvalue: tokenRes.data.user_id,\n\t\t\t\t},\n\t\t\t],\n\t\t\treturning: [\"id\", \"first_name\", \"last_name\", \"email\"],\n\t\t\tvalidation: {\n\t\t\t\tenabled: true,\n\t\t\t\tdefaultError: {\n\t\t\t\t\tstatus: 400,\n\t\t\t\t},\n\t\t\t},\n\t\t}),\n\t\tsecurityAuditServices.logSecurityAudit(context, {\n\t\t\tuserId: tokenRes.data.user_id,\n\t\t\taction: constants.securityAudit.actions.passwordChange,\n\t\t\tperformedBy: tokenRes.data.user_id,\n\t\t\tpreviousValue: constants.securityAudit.redactedValue,\n\t\t\tnewValue: constants.securityAudit.redactedValue,\n\t\t}),\n\t]);\n\tif (updatedUserRes.error) return updatedUserRes;\n\tif (auditRes.error) return auditRes;\n\n\tconst sendEmail = await emailServices.sendEmail(context, {\n\t\ttemplate: constants.email.templates.passwordResetSuccess.key,\n\t\ttype: \"internal\",\n\t\tto: updatedUserRes.data.email,\n\t\tsubject: (emailData) =>\n\t\t\tformatEmailSubject(\n\t\t\t\tcontext.translate(\"server:core.auth.password.reset.success.subject\"),\n\t\t\t\temailData.context.brand.name,\n\t\t\t),\n\t\tdata: {\n\t\t\tfirstName: updatedUserRes.data.first_name,\n\t\t\tlastName: updatedUserRes.data.last_name,\n\t\t},\n\t});\n\tif (sendEmail.error) return sendEmail;\n\n\treturn {\n\t\terror: undefined,\n\t\tdata: undefined,\n\t};\n};\n\nexport default resetPassword;\n"],"mappings":"qfAkBA,MAAM,EAQF,MAAO,EAAS,IAAS,CAC5B,GAAI,EAAQ,OAAO,KAAK,SAAS,UAAY,GAC5C,MAAO,CACN,MAAO,CACN,KAAM,QACN,OAAQ,IACR,QAAS,EACR,2DACD,CACD,EACA,KAAM,IAAA,EACP,EAGD,IAAM,EAAa,IAAI,EACtB,EAAQ,GAAG,OACX,EAAQ,OAAO,EAChB,EACM,EAAQ,IAAI,EAAgB,EAAQ,GAAG,OAAQ,EAAQ,OAAO,EAAE,EAEhE,EAAW,MAAMA,EAA4B,EAAS,CAC3D,MAAO,EAAK,MACZ,UAAWC,EAAU,WAAW,aACjC,CAAC,EACD,GAAI,EAAS,MAAO,OAAO,EAE3B,GAAI,EAAS,KAAK,UAAY,KAC7B,MAAO,CACN,MAAO,CACN,KAAM,QACN,QAAS,EAAK,sCAAsC,EACpD,OAAQ,GACT,EACA,KAAM,IAAA,EACP,EAGD,IAAM,EAAU,MAAM,EAAM,aAAa,CACxC,OAAQ,CAAC,IAAI,EACb,MAAO,CACN,CACC,IAAK,KACL,SAAU,IACV,MAAO,EAAS,KAAK,OACtB,CACD,EACA,WAAY,CACX,QAAS,GACT,aAAc,CACb,OAAQ,IACR,QAAS,EAAK,oCAAoC,CACnD,CACD,CACD,CAAC,EACD,GAAI,EAAQ,MAAO,OAAO,EAE1B,IAAM,EAAM,IAAI,KAAK,CAAA,CAAE,YAAY,EAC7B,EAAkB,MAAM,EAAW,aAAa,CACrD,KAAM,CACL,YAAa,EACb,WAAY,EACZ,cAAeA,EAAU,uBAAuB,kBAChD,YAAa,CACd,EACA,MAAO,CACN,CACC,IAAK,KACL,SAAU,IACV,MAAO,EAAS,KAAK,EACtB,EACA,CACC,IAAK,aACL,SAAU,IACV,MAAOA,EAAU,WAAW,aAC7B,EACA,CACC,IAAK,cACL,SAAU,IACV,MAAO,CACR,EACA,CACC,IAAK,aACL,SAAU,KACV,MAAO,IACR,EACA,CACC,IAAK,cACL,SAAU,KACV,MAAO,IACR,CACD,EACA,UAAW,CAAC,IAAI,CACjB,CAAC,EACD,GAAI,EAAgB,MAAO,OAAO,EAClC,GAAI,CAAC,EAAgB,KACpB,MAAO,CACN,MAAO,CACN,KAAM,QACN,QAAS,EAAK,sCAAsC,EACpD,OAAQ,GACT,EACA,KAAM,IAAA,EACP,EAGD,GAAM,CAAE,SAAQ,iBAAkB,EACjC,EAAQ,OAAO,QAAQ,UACxB,EAEM,EAAiB,OAAO,KAC7B,EAAO,EAAK,SAAU,EAAQA,EAAU,MAAM,CAC/C,CAAC,CAAC,SAAS,QAAQ,EAEb,CAAC,EAAgB,GAAY,MAAM,QAAQ,IAAI,CACpD,EAAM,aAAa,CAClB,KAAM,CACL,SAAU,EACV,OAAQ,EACR,WAAY,IAAI,KAAK,CAAA,CAAE,YAAY,CACpC,EACA,MAAO,CACN,CACC,IAAK,KACL,SAAU,IACV,MAAO,EAAS,KAAK,OACtB,CACD,EACA,UAAW,CAAC,KAAM,aAAc,YAAa,OAAO,EACpD,WAAY,CACX,QAAS,GACT,aAAc,CACb,OAAQ,GACT,CACD,CACD,CAAC,EACDC,EAAuC,EAAS,CAC/C,OAAQ,EAAS,KAAK,QACtB,OAAQD,EAAU,cAAc,QAAQ,eACxC,YAAa,EAAS,KAAK,QAC3B,cAAeA,EAAU,cAAc,cACvC,SAAUA,EAAU,cAAc,aACnC,CAAC,CACF,CAAC,EACD,GAAI,EAAe,MAAO,OAAO,EACjC,GAAI,EAAS,MAAO,OAAO,EAE3B,IAAME,EAAY,MAAMC,EAAwB,EAAS,CACxD,SAAUH,EAAU,MAAM,UAAU,qBAAqB,IACzD,KAAM,WACN,GAAI,EAAe,KAAK,MACxB,QAAU,GACT,EACC,EAAQ,UAAU,iDAAiD,EACnE,EAAU,QAAQ,MAAM,IACzB,EACD,KAAM,CACL,UAAW,EAAe,KAAK,WAC/B,SAAU,EAAe,KAAK,SAC/B,CACD,CAAC,EAGD,OAFIE,EAAU,MAAcA,EAErB,CACN,MAAO,IAAA,GACP,KAAM,IAAA,EACP,CACD"}