diff --git a/app.js b/app.js index cf8874e..17b3457 100644 --- a/app.js +++ b/app.js @@ -76,7 +76,11 @@ app.get('/aboutUs', (req, res) => { }); app.get('/forgotPassword', (req, res) => { - res.render('forgotPass', { error: req.session.error, reset: req.session.reset }); + const error = req.session.error; + const reset = req.session.reset; + req.session.reset = ''; + req.session.error = ''; + res.render('forgotPass', { error: error, reset: reset }); return res.status(status.Ok); }); @@ -105,7 +109,17 @@ app.get('/reset/:token', async (req, res) => { app.post('/resetLink', async (req, res) => { const { token, password, confirmPassword, } = req.body; - + const passwordSchema = joi.object({ + password: joi.string().max(20).min(6).required(), + confirmPassword: joi.string().max(20).min(6).required(), + }); + const valid = passwordSchema.validate(req.body); + if (valid.error) { + console.log("houston we have a problem"); + req.session.error = 'Invalid input'; + res.status(status.BadRequest); + return res.redirect(`/reset/${token}`); + } if (!token || !password || !confirmPassword) { req.session.error = 'field may be missing'; return res.redirect(`/reset/${token}`); @@ -121,7 +135,7 @@ app.post('/resetLink', async (req, res) => { if (!user) { req.session.error = 'Reset link is invalid.'; - return res.redirect('/forgotPassword'); + return res.redirect(`/reset`); } const hashPassword = await bcrypt.hash(password, 12); diff --git a/src/auth/forgotPass.js b/src/auth/forgotPass.js index 8e4880c..62260bf 100644 --- a/src/auth/forgotPass.js +++ b/src/auth/forgotPass.js @@ -1,5 +1,6 @@ const express = require('express'); const crypto = require('crypto'); +const joi = require('joi'); const nodeMail = require('nodemailer'); require('dotenv').config(); @@ -16,17 +17,27 @@ module.exports = (users) => { router.post('/auth/resetPass', async (req, res) => { console.log("we are inside of the post"); - const { email } = req.body; - const user = await users.findOne({ email }); + const resetSchema = joi.object({ + email: joi.string().email().required(), + }); req.session.error = ''; req.session.reset = ''; + const valid = resetSchema.validate(req.body); + if (valid.error) { + req.session.error = 'invalid email'; + return res.redirect('/forgotPassword') + } + const { email } = req.body; + const user = await users.findOne({ email }); + if (!user) { req.session.error = 'No user found' return res.redirect('/forgotPassword'); } const token = crypto.randomBytes(32).toString('hex'); + console.log(`The reset token is ${token}`) const expiration = Date.now() + 360000; await users.updateOne({ email }, { @@ -39,7 +50,7 @@ module.exports = (users) => { from: process.env.EMAIL_USER, to: email, subject: 'Password reset', - text: `reset your password here ${resetUrl} \n this link will expire within 1 hour`, + text: `reset your password here ${resetUrl} this link will expire within 1 hour`, }; diff --git a/src/views/forgotPass.ejs b/src/views/forgotPass.ejs index 8412d3a..811c32d 100644 --- a/src/views/forgotPass.ejs +++ b/src/views/forgotPass.ejs @@ -6,21 +6,33 @@

Reset Password


-
- - -
-
<%= error%>
-
- -
+ <% if (reset==='' ) { %> +
+ + +
+ <% } else { %> +
+

Reset link sent.

+
+ <% } %> + + +
+ <%= error%> +
+ <% if (reset==='' ) { %> +
+ +
+ <% } %>
- <%- include("./partials/footer") %> + <%- include("./partials/footer") %> <%- include("./partials/footer") %>