luulam/AFFiNE
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

fix: password reset token (#4743)

Browse Source
This commit is contained in:
DarkSky
2023-10-27 04:52:29 -05:00
committed by GitHub
parent ef8024c657
commit 588f63505d
2 changed files with 10 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
packages/backend/server/src/modules/auth/resolver.ts
View File

@@ -135,12 +135,13 @@ export class AuthResolver {
@Args('token') token: string, @Args('token') token: string,
@Args('newPassword') newPassword: string @Args('newPassword') newPassword: string
) { ) {
const id = await this.session.get(token); // we only create user account after user sign in with email link
if (!id || id !== user.id) { const email = await this.session.get(token);
if (!email || email !== user.email || !user.emailVerified) {
throw new ForbiddenException('Invalid token'); throw new ForbiddenException('Invalid token');
} }
await this.auth.changePassword(id, newPassword); await this.auth.changePassword(email, newPassword);
await this.session.delete(token); await this.session.delete(token);
return user; return user;

9
packages/backend/server/src/modules/auth/service.ts
View File

@@ -233,10 +233,13 @@ export class AuthService {
return Boolean(user.password); return Boolean(user.password);
} }
async changePassword(id: string, newPassword: string): Promise<User> { async changePassword(email: string, newPassword: string): Promise<User> {
const user = await this.prisma.user.findUnique({ const user = await this.prisma.user.findUnique({
where: { where: {
id, email,
emailVerified: {
not: null,
},
}, },
}); });
@@ -248,7 +251,7 @@ export class AuthService {
return this.prisma.user.update({ return this.prisma.user.update({
where: { where: {
id, id: user.id,
}, },
data: { data: {
password: hashedPassword, password: hashedPassword,