Tria/edr-platform
1
0
Fork 0
mirror of https://github.com/Tria-plc/edr-platform.git synced 2026-08-29 12:58:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: otp double sending

Browse Source
This commit is contained in:
Nathnael
2026-07-20 12:10:49 +00:00
parent aa02700e4c
commit 0549a88d57
17 changed files with 741 additions and 461 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
apps/edr-freight-api/src/modules/auth/forgot-password.controller.ts
View File

@@ -29,17 +29,19 @@ export class ForgotPasswordController {
@Post("forgot-password/request")
@ApiOperation({
summary: "Send a password-reset code over email or SMS",
summary: "Send a password-reset code to the account's email AND phone",
description:
"Always reports success. An unknown, inactive, or channel-less account is " +
"indistinguishable from a real one, so this cannot be used to enumerate accounts.",
"One code, delivered over every contact the account has; either delivery " +
"verifies it. Always reports success — an unknown, inactive, or contactless " +
"account is indistinguishable from a real one, so this cannot be used to " +
"enumerate accounts.",
})
async request(@Body() dto: ForgotPasswordRequestDto): Promise<{ success: true }> {
const user = await this.forgotPasswordService.resolveActiveUser(dto.identifier);
if (user) {
try {
await this.forgotPasswordService.requestReset(user, dto.channel);
await this.forgotPasswordService.requestReset(user);
} catch (error) {
// A delivery failure must not change the response shape either — log it
// and let the caller sit on the OTP screen.
@@ -65,11 +67,7 @@ export class ForgotPasswordController {
"alongside the same identifier and the new password.",
})
verify(@Body() dto: ForgotPasswordVerifyDto): Promise<ResetTicket> {
return this.forgotPasswordService.verifyAndMintTicket(
dto.identifier,
dto.channel,
dto.otp,
);
return this.forgotPasswordService.verifyAndMintTicket(dto.identifier, dto.otp);
}
@Post("forgot-password/resolve-link")