Emails password reset links and sets the new password when one is used. routes/password-resets.ts calls it for POST /api/password-resets and PUT /api/password-resets/:token; the link opens the client's /reset-password page.

Functions

f
requestPasswordReset(email: string): Promise<void>

Emails a reset link to the account with address email, if there is one and email is configured. It says nothing of what it did, so that the route answers the same whether the address has an account or not. It sends at most 3 links in a row per address, then one every 10 minutes.

f
resetPassword(
token: string,
newPassword: string
): Promise<string>

Sets newPassword for the user of a reset token, marks the token used, and returns the user's id. Through updateUser, this ends the user's sessions here; the route tells the instances they signed in to.

Usage

import * as mod from "api/services/password-reset-service.ts";