shellphone.app/app/auth/mutations/forgot-password.ts

43 lines
1.4 KiB
TypeScript
Raw Normal View History

import { resolver, generateToken, hash256 } from "blitz";
2021-07-31 14:33:18 +00:00
import db from "../../../db";
import { forgotPasswordMailer } from "../../../mailers/forgot-password-mailer";
import { ForgotPassword } from "../validations";
2021-07-31 14:33:18 +00:00
const RESET_PASSWORD_TOKEN_EXPIRATION_IN_HOURS = 4;
2021-07-31 14:33:18 +00:00
export default resolver.pipe(resolver.zod(ForgotPassword), async ({ email }) => {
// 1. Get the user
const user = await db.user.findFirst({ where: { email: email.toLowerCase() } });
2021-07-31 14:33:18 +00:00
// 2. Generate the token and expiration date.
const token = generateToken();
const hashedToken = hash256(token);
const expiresAt = new Date();
expiresAt.setHours(expiresAt.getHours() + RESET_PASSWORD_TOKEN_EXPIRATION_IN_HOURS);
2021-07-31 14:33:18 +00:00
// 3. If user with this email was found
if (user) {
// 4. Delete any existing password reset tokens
await db.token.deleteMany({ where: { type: "RESET_PASSWORD", userId: user.id } });
2021-07-31 14:33:18 +00:00
// 5. Save this new token in the database.
await db.token.create({
data: {
user: { connect: { id: user.id } },
type: "RESET_PASSWORD",
expiresAt,
hashedToken,
sentTo: user.email,
},
});
2021-07-31 14:33:18 +00:00
// 6. Send the email
await forgotPasswordMailer({ to: user.email, token }).send();
2021-07-31 14:33:18 +00:00
} else {
// 7. If no user found wait the same time so attackers can't tell the difference
await new Promise((resolve) => setTimeout(resolve, 750));
2021-07-31 14:33:18 +00:00
}
// 8. Return the same result whether a password reset email was sent or not
return;
});