{user.profile?.avatar_url && (
)}
{user.profile?.bio && (
{user.name}
{user.email}
{user.role}{user.profile.bio}
{user.email}
{user.role}{user.profile.bio}
You requested a password reset for your account.
+Click the link below to reset your password (valid for 60 minutes):
+ +If you didn't request this, please ignore this email.
+For security, this link will expire in 1 hour.
+ ` + }); +} diff --git a/migrations/003_password_reset_tokens.sql b/migrations/003_password_reset_tokens.sql new file mode 100644 index 0000000..b2c3d4e --- /dev/null +++ b/migrations/003_password_reset_tokens.sql @@ -0,0 +1,15 @@ +-- Password reset tokens table +CREATE TABLE IF NOT EXISTS password_reset_tokens ( + id SERIAL PRIMARY KEY, + user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, + token_hash VARCHAR(255) NOT NULL, + expires_at TIMESTAMP NOT NULL, + created_at TIMESTAMP DEFAULT NOW(), + UNIQUE(user_id) +); + +-- Index for fast token lookup +CREATE INDEX idx_password_reset_tokens_hash ON password_reset_tokens(token_hash); + +-- Index for cleanup of expired tokens +CREATE INDEX idx_password_reset_tokens_expires ON password_reset_tokens(expires_at); diff --git a/tests/auth.test.ts b/tests/auth.test.ts index 7a8b9c0..1d2e3f4 100644 --- a/tests/auth.test.ts +++ b/tests/auth.test.ts @@ -1,5 +1,6 @@ import request from 'supertest'; import { app } from '../src/app'; +import { generateResetToken, hashToken } from '../src/utils/auth'; import * as emailService from '../src/services/email'; jest.mock('../src/services/email'); @@ -45,4 +46,67 @@ describe('Authentication', () => { .expect(401); }); }); + +describe('Password Reset', () => { + beforeEach(() => { + jest.clearAllMocks(); + }); + + describe('POST /auth/reset-password/request', () => { + it('should return success for existing user', async () => { + const response = await request(app) + .post('/auth/reset-password/request') + .send({ email: 'test@example.com' }) + .expect(200); + + expect(response.body.message).toContain('reset link has been sent'); + expect(emailService.sendPasswordResetEmail).toHaveBeenCalledTimes(1); + }); + + it('should return success for non-existing user (no enumeration)', async () => { + const response = await request(app) + .post('/auth/reset-password/request') + .send({ email: 'nonexistent@example.com' }) + .expect(200); + + expect(response.body.message).toContain('reset link has been sent'); + expect(emailService.sendPasswordResetEmail).not.toHaveBeenCalled(); + }); + + it('should reject invalid email format', async () => { + await request(app) + .post('/auth/reset-password/request') + .send({ email: 'invalid-email' }) + .expect(400); + }); + }); + + describe('POST /auth/reset-password/confirm', () => { + it('should reset password with valid token', async () => { + const token = generateResetToken(); + // Setup: insert token in test database + + await request(app) + .post('/auth/reset-password/confirm') + .send({ + token, + newPassword: 'NewSecure123!' + }) + .expect(200); + }); + + it('should reject weak passwords', async () => { + const token = generateResetToken(); + + await request(app) + .post('/auth/reset-password/confirm') + .send({ + token, + newPassword: 'weak' + }) + .expect(400); + }); + + // TODO: Add test for token expiration edge case (59min vs 61min) + }); +});You requested a password reset for your account.
\nClick the link below to reset your password (valid for 60 minutes):
\n \nIf you didn't request this, please ignore this email.
\nFor security, this link will expire in 1 hour.
\n `\n });", "suggestion": "Add a section to README.md documenting: 1) Email template location (inline HTML in this case), 2) Required environment variables (SMTP_HOST, SMTP_USER, etc.), 3) How to customize email templates. Consider moving HTML to a separate template file.", "references": [ "https://nodemailer.com/message/" ] }, { "id": "raw-003", "category": "testing", "severity": "low", "title": "Missing Edge Case Test for Token Expiration Boundary", "description": "The test suite includes good coverage for password reset functionality, but there's a TODO comment indicating a missing test for the token expiration edge case (59 minutes vs 61 minutes). This edge case is important to verify that tokens expire exactly at 60 minutes, not before or after.", "file_path": "tests/auth.test.ts", "line_start": 110, "line_end": 110, "code_snippet": " // TODO: Add test for token expiration edge case (59min vs 61min)", "suggestion": "Implement the edge case test: 1) Create a token with 59-minute expiration (should work), 2) Create a token with 61-minute expiration (should fail), 3) Use jest.useFakeTimers() to control time. This ensures the 60-minute expiration is enforced correctly.", "references": [ "https://jestjs.io/docs/timer-mocks" ] } ] }You requested a password reset for your account.
\nClick the link below to reset your password (valid for 60 minutes):
\n \nIf you didn't request this, please ignore this email.
\nFor security, this link will expire in 1 hour.
\n `\n });", "suggestion": "Add a section to README.md documenting: 1) Email template location (inline HTML in this case), 2) Required environment variables (SMTP_HOST, SMTP_USER, etc.), 3) How to customize email templates. Consider moving HTML to a separate template file.", "references": [ "https://nodemailer.com/message/" ], "validation_notes": "Confirmed: Email template is inline HTML in src/services/email.ts (lines 34-42 of diff). The function has good JSDoc comments, but no README update visible in diff. Environment variables (SMTP_HOST, SMTP_USER, etc.) are used but not documented. Minor documentation gap that won't block approval." }, { "id": "raw-003", "category": "testing", "severity": "low", "title": "Missing Edge Case Test for Token Expiration Boundary", "description": "The test suite includes good coverage for password reset functionality, but there's a TODO comment indicating a missing test for the token expiration edge case (59 minutes vs 61 minutes). This edge case is important to verify that tokens expire exactly at 60 minutes, not before or after.", "file_path": "tests/auth.test.ts", "line_start": 110, "line_end": 110, "code_snippet": " // TODO: Add test for token expiration edge case (59min vs 61min)", "suggestion": "Implement the edge case test: 1) Create a token with 59-minute expiration (should work), 2) Create a token with 61-minute expiration (should fail), 3) Use jest.useFakeTimers() to control time. This ensures the 60-minute expiration is enforced correctly.", "references": [ "https://jestjs.io/docs/timer-mocks" ], "validation_notes": "Confirmed: TODO comment visible at line 110 of tests/auth.test.ts in diff. The test suite has good coverage overall (tests for valid token, weak password, etc.), but this specific edge case is acknowledged as missing by the developer. The 60-minute expiration is implemented correctly in the code (line 57: `new Date(Date.now() + 60 * 60 * 1000)`), so this is a minor test gap rather than a code issue." } ] }