d5939db
use base64::Engine;
use time::OffsetDateTime;
use uuid::Uuid;
use db::conn::sea_orm::{
ActiveModelTrait, EntityTrait, QueryFilter, Set, TransactionTrait,
};
use db::user::user_emails::Entity as EmailEntity;
use db::user::user_password_reset_tokens::{
ActiveModel as TokenActiveModel, Entity as TokenEntity,
};
use db::user::users::{ActiveModel as UserActiveModel, Entity as UserEntity};
use cache::redis::RedisError;
use jwt::session as jwt_session;
use crate::error::AuthError;
use crate::features::AuthService;
use crate::features::password_hash;
use super::{ResetPasswordCmd, ResetPasswordResp};
fn map_redis(e: RedisError) -> AuthError {
AuthError::Internal(format!("redis: {e}"))
}
fn sha256_hex(data: &[u8]) -> String {
use sha2::Digest;
let digest = sha2::Sha256::digest(data);
base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(digest)
}
fn redis_key(temp_id: &Uuid) -> String {
format!("auth:reset:{}", temp_id.simple())
}
fn constant_time_eq(a: &[u8], b: &[u8]) -> bool {
if a.len() != b.len() {
return false;
}
let mut diff: u8 = 0;
for (x, y) in a.iter().zip(b.iter()) {
diff |= x ^ y;
}
diff == 0
}
/// Reset a user's password using a token previously delivered via the
/// forgot-password flow. On success, every active session for the user is
/// revoked so the new credentials take effect immediately.
pub async fn reset_password(
cmd: ResetPasswordCmd,
svc: &AuthService,
) -> Result<ResetPasswordResp, AuthError> {
password_hash::validate_password(
password_hash::ValidatePasswordRequest {
password: &cmd.new_password,
},
&svc.config.password_policy,
)?;
let db = svc.db.writer();
let temp_id = Uuid::parse_str(&cmd.temp_key_value)?;
let key = redis_key(&temp_id);
let stored = svc
.kv
.get_bytes(&key)
.await
.map_err(map_redis)?
.ok_or_else(|| AuthError::BadRequest("reset token expired or not found".into()))?;
if !constant_time_eq(stored.as_slice(), cmd.token.as_bytes()) {
return Err(AuthError::BadRequest("invalid reset token".into()));
}
svc.kv.delete(&key).await.map_err(map_redis)?;
let token_hash = sha256_hex(cmd.token.as_bytes());
let row = TokenEntity::find()
.filter(TokenEntity::COLUMN.token_hash.eq(token_hash))
.filter(TokenEntity::COLUMN.used_at.is_null())
.one(&db)
.await?
.ok_or_else(|| AuthError::BadRequest("reset token not found".into()))?;
if row.expires_at < OffsetDateTime::now_utc() {
return Err(AuthError::BadRequest("reset token expired".into()));
}
// Resolve user via email; if the user was deleted out-of-band we hard-fail.
let lower = cmd.email.trim().to_ascii_lowercase();
let (em, user) = EmailEntity::find()
.filter(EmailEntity::COLUMN.lower_email.eq(lower))
.find_also_related(UserEntity)
.one(&db)
.await?
.ok_or_else(|| AuthError::NotFound("user not found".into()))?;
if em.user_id != row.user_id {
return Err(AuthError::BadRequest(
"reset token does not match email".into(),
));
}
let user = user.ok_or_else(|| AuthError::NotFound("user not found".into()))?;
let new_hash = password_hash::usecase::hash_password(password_hash::PasswordInput {
password: &cmd.new_password,
})?;
// VULN-006/B5: a reset by the real owner of the email also activates an
// account that was registered but never verified (email squatting). This
// is the forgot-password recovery lane for unclaimed addresses.
let activate = !user.is_active;
let txn = db.begin().await?;
let mut am: UserActiveModel = user.into();
let current_version = match &am.passwd_version {
db::conn::sea_orm::ActiveValue::Set(Some(v)) => *v,
_ => 0,
};
let new_version = current_version + 1;
am.passwd_hash = Set(Some(new_hash.0));
am.password_last_changed_at = Set(Some(OffsetDateTime::now_utc()));
am.passwd_version = Set(Some(new_version));
if activate {
am.is_active = Set(true);
}
am.updated_at = Set(OffsetDateTime::now_utc());
am.update(&txn).await?;
let mut tam: TokenActiveModel = row.into();
tam.used_at = Set(Some(OffsetDateTime::now_utc()));
tam.update(&txn).await?;
// Revoke every existing session atomically with the password change.
// A failure here aborts the transaction, preventing the caller from
// receiving a success response while stale refresh tokens remain live.
jwt_session::delete_sessions_by_user(&txn, em.user_id).await?;
txn.commit().await?;
// VULN-005: put the user on the access-token deny-list so any already-issued
// stateless access tokens stop validating immediately after the password
// change (the DB sessions were revoked inside the transaction above).
let ttl = svc.jwt.settings.access_ttl.whole_seconds().max(1) as u64;
rate_limit::AccessTokenBlacklist::new(svc.kv.clone())
.revoke_user(em.user_id, ttl)
.await
.map_err(map_redis)?;
Ok(ResetPasswordResp { ok: true })
}