Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
const emails = user.emails || [];
if (
!includes(
emails.map((email: EmailRecord) => email.address),
resetTokenRecord.address
)
) {
throw new Error(this.options.errors.resetPasswordLinkUnknownAddress);
}
const password = await this.hashAndBcryptPassword(newPassword);
// Change the user password and remove the old token
await this.db.setResetPassword(user.id, resetTokenRecord.address, password, token);
this.server.getHooks().emit(ServerHooks.ResetPasswordSuccess, user);
// If user clicked on an enrollment link we can verify his email
if (resetTokenRecord.reason === 'enroll') {
await this.db.verifyEmail(user.id, resetTokenRecord.address);
}
// Changing the password should invalidate existing sessions
if (this.options.invalidateAllSessionsAfterPasswordReset) {
await this.db.invalidateAllSessions(user.id);
}
if (this.options.notifyUserAfterPasswordChanged) {
const address = user.emails && user.emails[0].address;
if (!address) {
throw new Error(this.options.errors.noEmailSet);
}