overleaf/services/web/app/src/Features/PasswordReset/PasswordResetHandler.js

const settings = require('settings-sharelatex')
const UserGetter = require('../User/UserGetter')
const OneTimeTokenHandler = require('../Security/OneTimeTokenHandler')
const EmailHandler = require('../Email/EmailHandler')
const AuthenticationManager = require('../Authentication/AuthenticationManager')

const PasswordResetHandler = {
  generateAndEmailResetToken(email, callback) {
    UserGetter.getUserByAnyEmail(email, (err, user) => {
      if (err || !user) {
        return callback(err, null)
      }
      if (user.email !== email) {
        return callback(null, 'secondary')
      }
      const data = { user_id: user._id.toString(), email: email }
      OneTimeTokenHandler.getNewToken('password', data, (err, token) => {
        if (err) {
          return callback(err)
        }
        const emailOptions = {
          to: email,
          setNewPasswordUrl: `${
            settings.siteUrl
          }/user/password/set?passwordResetToken=${token}&email=${encodeURIComponent(
            email
          )}`
        }
        EmailHandler.sendEmail('passwordResetRequested', emailOptions, err => {
          if (err) {
            return callback(err)
          }
          callback(null, 'primary')
        })
      })
    })
  },

  setNewUserPassword(token, password, callback) {
    PasswordResetHandler.getUserForPasswordResetToken(token, (err, user) => {
      if (err) {
        return callback(err)
      }
      if (!user) {
        return callback(null, false, null)
      }
      AuthenticationManager.setUserPassword(
        user._id,
        password,
        (err, reset) => {
          if (err) {
            return callback(err)
          }
          callback(null, reset, user._id)
        }
      )
    })
  },

  getUserForPasswordResetToken(token, callback) {
    OneTimeTokenHandler.getValueFromTokenAndExpire(
      'password',
      token,
      (err, data) => {
        if (err != null) {
          if (err.name === 'NotFoundError') {
            return callback(null, null)
          } else {
            return callback(err)
          }
        }
        if (data == null || data.email == null) {
          return callback(null, null)
        }
        UserGetter.getUserByMainEmail(
          data.email,
          { _id: 1, 'overleaf.id': 1 },
          (err, user) => {
            if (err != null) {
              callback(err)
            } else if (user == null) {
              callback(null, null)
            } else if (
              data.user_id != null &&
              data.user_id === user._id.toString()
            ) {
              callback(null, user)
            } else if (
              data.v1_user_id != null &&
              user.overleaf != null &&
              data.v1_user_id === user.overleaf.id
            ) {
              callback(null, user)
            } else {
              callback(null, null)
            }
          }
        )
      }
    )
  }
}

module.exports = PasswordResetHandler