forgot password validatation using joi

app.js

@@ -76,7 +76,11 @@ app.get('/aboutUs', (req, res) => {
 });
 
 app.get('/forgotPassword', (req, res) => {
-    res.render('forgotPass', { error: req.session.error, reset: req.session.reset });
+    const error = req.session.error;
+    const reset = req.session.reset;
+    req.session.reset = '';
+    req.session.error = '';
+    res.render('forgotPass', { error: error, reset: reset });
     return res.status(status.Ok);
 });
 
@@ -105,7 +109,17 @@ app.get('/reset/:token', async (req, res) => {
 
 app.post('/resetLink', async (req, res) => {
     const { token, password, confirmPassword, } = req.body;
-
+    const passwordSchema = joi.object({
+        password: joi.string().max(20).min(6).required(),
+        confirmPassword: joi.string().max(20).min(6).required(),
+    });
+    const valid = passwordSchema.validate(req.body);
+    if (valid.error) {
+        console.log("houston we have a problem");
+        req.session.error = 'Invalid input';
+        res.status(status.BadRequest);
+        return res.redirect(`/reset/${token}`);
+    }
     if (!token || !password || !confirmPassword) {
         req.session.error = 'field may be missing';
         return res.redirect(`/reset/${token}`);
@@ -121,7 +135,7 @@ app.post('/resetLink', async (req, res) => {
 
     if (!user) {
         req.session.error = 'Reset link is invalid.';
-        return res.redirect('/forgotPassword');
+        return res.redirect(`/reset`);
     }
     const hashPassword = await bcrypt.hash(password, 12);
 

src/auth/forgotPass.js

@@ -1,5 +1,6 @@
 const express = require('express');
 const crypto = require('crypto');
+const joi = require('joi');
 const nodeMail = require('nodemailer');
 require('dotenv').config();
 
@@ -16,17 +17,27 @@ module.exports = (users) => {
 
     router.post('/auth/resetPass', async (req, res) => {
         console.log("we are inside of the post");
-        const { email } = req.body;
+        const resetSchema = joi.object({
-        const user = await users.findOne({ email });
+            email: joi.string().email().required(),
+        });
         req.session.error = '';
         req.session.reset = '';
 
+        const valid = resetSchema.validate(req.body);
+        if (valid.error) {
+            req.session.error = 'invalid email';
+            return res.redirect('/forgotPassword')
+        }
+        const { email } = req.body;
+        const user = await users.findOne({ email });
+
         if (!user) {
             req.session.error = 'No user found'
             return res.redirect('/forgotPassword');
         }
 
         const token = crypto.randomBytes(32).toString('hex');
+        console.log(`The reset token is ${token}`)
         const expiration = Date.now() + 360000;
 
         await users.updateOne({ email }, {
@@ -39,7 +50,7 @@ module.exports = (users) => {
             from: process.env.EMAIL_USER,
             to: email,
             subject: 'Password reset',
-            text: `reset your password here ${resetUrl} \n this link will expire within 1 hour`,
+            text: `reset your password here ${resetUrl}   this link will expire within 1 hour`,
 
         };
 

src/views/forgotPass.ejs

@@ -6,21 +6,33 @@
                 <div class="w-96 p-6 shadow-1g bg-white rounded-md">
                     <h1 class="text-3xl block text-center font-semibold">Reset Password</h1>
                     <hr class="mt-3">
-                    <div class="mt-3">
+                    <% if (reset==='' ) { %>
-                        <label for="email" class="block text-base mb-2">Email</label>
+                        <div class="mt-3">
-                        <input type="text" id="email" name="email"
+                            <label for="email" class="block text-base mb-2">Email</label>
-                            class="border focus:border-gray-600 w-full rounded-md text-base px-2 py-1 focus:outline-none focus:ring-0 "
+                            <input type="text" id="email" name="email"
-                            placeholder="Enter Email" />
+                                class="border focus:border-gray-600 w-full rounded-md text-base px-2 py-1 focus:outline-none focus:ring-0 "
-                    </div>
+                                placeholder="Enter Email" />
-                    <div class="text-red-800 font-bold" id="forgor"> <%= error%></div>
+                        </div>
-                    <div class="mt-5">
+                        <% } else { %>
-                        <button type="submit"
+                            <div class="mt-3">
-                            class="cursor-pointer border-2 border-gray-600 bg-blue-600 text-white py-1 w-full rounded-md hover:bg-transparent hover:text-indigo-700 font-semibold">Send
+                                <h1 class="text-2xl block text-center font-bold text-red-600"> Reset link sent. </h1>
-                            reset Link</button>
+                            </div>
-                    </div>
+                            <% } %>
+                                <!---->
+
+                                <div class="text-red-800 font-bold" id="forgor">
+                                    <%= error%>
+                                </div>
+                                <% if (reset==='' ) { %>
+                                    <div class="mt-5">
+                                        <button type="submit"
+                                            class="cursor-pointer border-2 border-gray-600 bg-blue-600 text-white py-1 w-full rounded-md hover:bg-transparent hover:text-indigo-700 font-semibold">Send
+                                            reset Link</button>
+                                    </div>
+                                    <% } %>
                 </div>
             </form>
         </div>
     </main>
 
-    <%- include("./partials/footer") %>
+    <%- include("./partials/footer") %> <%- include("./partials/footer") %>