mongoconection

.gitignore

@@ -0,0 +1,3 @@
+branch_structure.json
+temp_auto_push.bat
+temp_interactive_push.bat

node-api/src/routes/index.js

@@ -1,5 +1,8 @@
 import userRoutes from './users';
 import meRoutes from './me';
 import authRoutes from './auth';
+import { createRequire } from 'module';
+
+const require = createRequire(import.meta.url);
 
 export { userRoutes, meRoutes, authRoutes };

node-api/src/schemas/passwordResets.schema.js

@@ -0,0 +1,15 @@
+import mongoose from "mongoose";
+
+const passwordResetSchema = new mongoose.Schema({
+  email: { required: true, type: String },
+  token: { required: true, type: String },
+  created_at: { type: Date },
+});
+
+passwordResetSchema.virtual("id").get(function () {
+  return this._id.toHexString();
+});
+
+passwordResetSchema.set("toJSON", { virtuals: true });
+
+export const passwordResetModel = mongoose.model("PasswordReset", passwordResetSchema);

node-api/src/services/auth/index.js

@@ -3,6 +3,7 @@ import nodemailer from "nodemailer";
 import randomToken from "random-token";
 import bcrypt from "bcrypt";
 import { userModel } from "../../schemas/user.schema";
+import { passwordResetModel } from "../../schemas/passwordResets.schema";
 import jwt from 'jsonwebtoken';
 
 dotenv.config();
@@ -109,6 +110,14 @@ export const forgotPasswordRouteHandler = async (req, res, email) => {
         email: email,
       },
     };
+
+    // save token in db
+    await passwordResetModel.create({
+        email: foundUser.email,
+        token: token,
+        created_at: new Date(),
+    });
+
     return res.status(204).json(dataSent);
   }
 };
@@ -118,10 +127,8 @@ export const resetPasswordRouteHandler = async (req, res) => {
     email: req.body.data.attributes.email,
   });
 
-  if (!foundUser) {
-    return res.status(400).json({
-      errors: { email: ["The email does not match any existing user."] },
-    });
+  if (!foundUser || !foundToken) {
+    return res.status(400).json({errors: { email: ["The email or token does not match any existing user."] }});
   } else {
     const { password, password_confirmation } = req.body.data.attributes;
     // validate password
@@ -143,6 +150,8 @@ export const resetPasswordRouteHandler = async (req, res) => {
     const salt = await bcrypt.genSalt(10);
     const hashPassword = await bcrypt.hash(password, salt);
 
+    await passwordResetModel.deleteOne({ email: foundUser.email });
+
     await userModel.updateOne(
       { email: foundUser.email },
       { $set: { "password": hashPassword } }