api-v3 password reset

common/locales/en/api-v3.json

@@ -12,6 +12,7 @@
   "usernameTaken": "Username already taken.",
   "passwordConfirmationMatch": "Password confirmation doesn't match password.",
   "invalidLoginCredentials": "Incorrect username / email and / or password.",
+  "passwordReset": "If we have your email on file, your password reset link has been sent to your email.",
   "invalidCredentials": "User not found with given auth credentials.",
   "accountSuspended": "Account has been suspended, please contact leslie@habitica.com with your UUID \"<%= userId %>\" for assistance.",
   "onlyFbSupported": "Only Facebook supported currently.",

test/api/v3/integration/user/auth/POST-user_reset_password.test.js

@@ -0,0 +1,39 @@
+import {
+  generateUser,
+  translate as t,
+} from '../../../../../helpers/api-integration/v3';
+
+describe.only('POST /user/reset-password', async () => {
+  let endpoint = '/user/reset-password';
+  let user;
+
+  beforeEach(async () => {
+    user = await generateUser();
+  });
+
+  afterEach(async () => {
+  });
+
+  it('resets password', async () => {
+    let response = await user.post(endpoint, {
+      email: user.auth.local.email,
+    });
+    expect(response).to.eql({code: 200, message: t('passwordReset')});
+  });
+
+  it('same message on error as on success', async () => {
+    let response = await user.post(endpoint, {
+      email: 'nonExistent@email.com',
+    });
+    expect(response).to.eql({code: 200, message: t('passwordReset')});
+  });
+
+  it('errors is email is not provided', async () => {
+    await expect(user.post(endpoint)).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('invalidReqParams'),
+    });
+  });
+});
+

website/src/controllers/api-v3/email.js

@@ -28,7 +28,6 @@ api.unsubscribe = {
         notEmpty: {errorMessage: res.t('missingUnsubscriptionCode')},
       },
     });
-
     let validationErrors = req.validationErrors();
     if (validationErrors) throw validationErrors;
 

website/src/controllers/api-v3/user.js

@@ -12,6 +12,8 @@ import { model as User } from '../../models/user';
 import Q from 'q';
 import _ from 'lodash';
 import * as passwordUtils from '../../libs/api-v3/password';
+import { send as sendEmail } from '../../libs/api-v3/email';
+import nconf from 'nconf';
 
 let api = {};
 
@@ -81,6 +83,50 @@ api.updatePassword = {
   },
 };
 
+/**
+ * @api {post} /user/reset-password
+ * @apiVersion 3.0.0
+ * @apiName resetPassword
+ * @apiGroup User
+ * @apiParam {string} email email
+ * @apiSuccess {Object} The success message
+ **/
+api.resetPassword = {
+  method: 'POST',
+  middlewares: [],
+  url: '/user/reset-password',
+  async handler (req, res) {
+    req.checkBody({
+      email: {
+        notEmpty: {errorMessage: res.t('missingEmail')},
+      },
+    });
+    let validationErrors = req.validationErrors();
+    if (validationErrors) throw validationErrors;
+
+    let email = req.body.email && req.body.email.toLowerCase();
+    let salt = passwordUtils.makeSalt();
+    let newPassword =  passwordUtils.makeSalt(); // use a salt as the new password too (they'll change it later)
+    let hashedPassword = passwordUtils.encrypt(newPassword, salt);
+
+    let user = await User.findOne({ 'auth.local.email': email }, { 'auth.local': 1 });
+
+    if (user) {
+      user.auth.local.salt = salt;
+      user.auth.local.hashed_password = hashedPassword; // eslint-disable-line camelcase
+      sendEmail({
+        from: 'Habitica <admin@habitica.com>',
+        to: email,
+        subject: 'Password Reset for Habitica',
+        text: `Password for ${user.auth.local.username} has been reset to ${newPassword} . Important! Both username and password are case-sensitive -- you must enter both exactly as shown here. We recommend copying and pasting both instead of typing them. Log in at ${nconf.get('BASE_URL')}. After you have logged in, head to ${nconf.get('BASE_URL')}/#/options/settings/settings and change your password.`,
+        html: `Password for <strong>${user.auth.local.username}</strong> has been reset to <strong>${newPassword}</strong><br /><br />Important! Both username and password are case-sensitive -- you must enter both exactly as shown here. We recommend copying and pasting both instead of typing them.<br /><br />Log in at ${nconf.get('BASE_URL')}. After you have logged in, head to ${nconf.get('BASE_URL')}/#/options/settings/settings and change your password.`,
+      });
+      await user.save();
+    }
+    res.respond(300, { message: res.t('passwordReset') });
+  },
+};
+
 /**
  * @api {post} /user/update-username
  * @apiVersion 3.0.0