From 99cb8a07f7d47ea7bc8e45460ed0e21f47ed5bbb Mon Sep 17 00:00:00 2001
From: Victor Piousbox <victor@wasya.co>
Date: Sun, 20 Mar 2016 02:54:52 +0000
Subject: [PATCH] reset password route

---
 .../POST-user_reset_password.test.js          |  2 +-
 website/src/controllers/api-v3/auth.js        | 51 +++++++++++++++++++
 website/src/libs/api-v3/email.js              |  2 +-
 3 files changed, 53 insertions(+), 2 deletions(-)
 rename test/api/v3/integration/user/{ => auth}/POST-user_reset_password.test.js (94%)

diff --git a/test/api/v3/integration/user/POST-user_reset_password.test.js b/test/api/v3/integration/user/auth/POST-user_reset_password.test.js
similarity index 94%
rename from test/api/v3/integration/user/POST-user_reset_password.test.js
rename to test/api/v3/integration/user/auth/POST-user_reset_password.test.js
index b08642de17..34612106d6 100644
--- a/test/api/v3/integration/user/POST-user_reset_password.test.js
+++ b/test/api/v3/integration/user/auth/POST-user_reset_password.test.js
@@ -1,7 +1,7 @@
 import {
   generateUser,
   translate as t,
-} from '../../../../helpers/api-integration/v3';
+} from '../../../../../helpers/api-integration/v3';
 
 describe('POST /user/reset-password', async () => {
   let endpoint = '/user/reset-password';
diff --git a/website/src/controllers/api-v3/auth.js b/website/src/controllers/api-v3/auth.js
index 875d8672ca..e278d95f01 100644
--- a/website/src/controllers/api-v3/auth.js
+++ b/website/src/controllers/api-v3/auth.js
@@ -20,6 +20,7 @@ import { model as EmailUnsubscription } from '../../models/emailUnsubscription';
 import { sendTxn as sendTxnEmail } from '../../libs/api-v3/email';
 import { decrypt } from '../../libs/api-v3/encryption';
 import FirebaseTokenGenerator from 'firebase-token-generator';
+import { send as sendEmail } from '../../libs/api-v3/email';
 
 let api = {};
 
@@ -368,6 +369,56 @@ api.updatePassword = {
   },
 };
 
+/**
+ * @api {post} /user/reset-password
+ * @apiVersion 3.0.0
+ * @apiName resetPassword
+ * @apiGroup User
+ * @apiParam {string} email email
+ * @apiSuccess {Object} The success message
+ **/
+api.resetPassword = {
+  method: 'POST',
+  middlewares: [],
+  url: '/user/reset-password',
+  async handler (req, res) {
+    req.checkBody({
+      email: {
+        notEmpty: {errorMessage: res.t('missingEmail')},
+      },
+    });
+    let validationErrors = req.validationErrors();
+    if (validationErrors) throw validationErrors;
+
+    let email = req.body.email.toLowerCase();
+    let salt = passwordUtils.makeSalt();
+    let newPassword =  passwordUtils.makeSalt(); // use a salt as the new password too (they'll change it later)
+    let hashedPassword = passwordUtils.encrypt(newPassword, salt);
+
+    let user = await User.findOne({ 'auth.local.email': email }, { 'auth.local': 1 });
+
+    if (user) {
+      user.auth.local.salt = salt;
+      user.auth.local.hashed_password = hashedPassword; // eslint-disable-line camelcase
+      sendEmail({
+        from: 'Habitica <admin@habitica.com>',
+        to: email,
+        subject: res.t('passwordResetEmailSubject'),
+        text: res.t('passwordResetEmailText', { username: user.auth.local.username,
+                                                newPassword,
+                                                baseUrl: nconf.get('BASE_URL'),
+                                              }),
+        html: res.t('passwordResetEmailHtml', { username: user.auth.local.username,
+                                                newPassword,
+                                                baseUrl: nconf.get('BASE_URL'),
+                                              }),
+      });
+      await user.save();
+    }
+    res.respond(200, { message: res.t('passwordReset') });
+  },
+};
+
 /**
  * @api {put} /user/auth/update-email
  * @apiVersion 3.0.0
diff --git a/website/src/libs/api-v3/email.js b/website/src/libs/api-v3/email.js
index 6a7b2ac2ee..c201410d60 100644
--- a/website/src/libs/api-v3/email.js
+++ b/website/src/libs/api-v3/email.js
@@ -30,7 +30,7 @@ export function send (mailData) {
       .sendMail(mailData)
       .catch((error) => logger.error(error));
   } else {
-    return { send: () => {} } // mock
+    return { send: () => {} }; // mock
   }
 }