Password Resets

1. The user requests a password reset.
2. The server generates a random token, puts it in a link and (usually) emails it to the user.
3. The user opens the link, and the server validates the token.
4. The user sets new password for the account.

Most reset vulnerabilities come from several predictable mistakes:

• Tokens that are guessable
• Tokens that never expire
• Tokens that can be reused
• Tokens not tied to a specific user
• Tokens leaked through logs, analytics, browser history, or referrer headers

A password reset token should be treated like a temporary password, so it should be:

• Unpredictable (long, random, and not guessable)
• Short-lived (expires after a short window, usually minutes)
• Single-use (invalid after use)
• Bound to one account (tied to the specific user who requested it)
• Stored as a hash (the database never stores the raw token)

Bearly Secure's password reset tokens are predictable, the provided hashing helper doesn't hash anything, and tokens remain valid for an hour. The routes also bypass the provided validation and atomic reset helpers.

Replace the insecure implementations and connect the provided password-reset helpers.

1. In src/auth/passwordResetTokens.ts, secure reset-token creation:
   1. Import hash and randomBytes from node:crypto.
   2. Replace the predictable token with one generated from 32 cryptographically random bytes and encoded as hexadecimal.
   3. Update the provided hashPasswordResetToken function so it uses SHA-256 to hash the token with hexadecimal output.
   4. Change reset tokens to expire after 15 minutes instead of one hour.
2. In src/routes/auth.ts, use the provided password-reset helpers:
   1. Import validatePasswordResetToken and resetPasswordWithToken from ../auth/passwordResetTokens.ts.
   2. Use validatePasswordResetToken when displaying the reset form.
   3. Use validatePasswordResetToken before processing the submitted password.
   4. Set passwordResetSucceeded to the result of calling resetPasswordWithToken.
   5. Remove the direct updateUserPassword call and its unused import.
3. Reset and seed the database with npm run db:reset.
4. Start the app.

With Bearly Secure still running, run and submit the CLI tests from the project root.