Skip to main content
zerotal

Documentation

Documentation / @zerotal/auth / PasswordBroker

Class: PasswordBroker

Defined in: auth/src/PasswordBroker.ts:72

Stateful, DB-backed password-reset broker (an alternative to the stateless PasswordReset mixin).

Remarks

Persistence is delegated to the injected callbacks in PasswordBrokerOptions, so this class is database-agnostic. Security properties: only the SHA-256 hash of the reset token is stored, and reset compares the presented token's hash against it in constant time (safeEqual). A token is single-use — it is deleted on a successful reset — and expired tokens are rejected (and pruned) on use.

Example

const broker = new PasswordBroker({
  findToken, storeToken, deleteToken, pruneTokens,
  sendResetLink: (email, token) => Mail.to(email).send(new ResetLink(token)),
  resetPassword: (email, pw) => User.query().where("email", email).update({ password: pw }),
});

await broker.sendResetLink(email);                     // PASSWORDS.SENT
const result = await broker.reset(token, email, newPw); // PASSWORDS.RESET | PASSWORDS.TOKEN

Constructors

Constructor

new PasswordBroker(_opts): PasswordBroker

Defined in: auth/src/PasswordBroker.ts:75

Parameters

_opts

PasswordBrokerOptions

Returns

PasswordBroker

Methods

sendResetLink(email): Promise<"passwords.sent">

Defined in: auth/src/PasswordBroker.ts:85

Generate a reset token, store its hash, and send the plaintext to the user.

Parameters

email

string

The address requesting the reset.

Returns

Promise<"passwords.sent">

PASSWORDS.SENT.

reset()

reset(token, email, newPassword): Promise<"passwords.token" | "passwords.reset">

Defined in: auth/src/PasswordBroker.ts:108

Verify token + email and reset the password if valid.

Parameters

token

string

The plaintext reset token from the emailed link.

email

string

The address the token was issued for.

newPassword

string

The new password to persist (via the resetPassword callback).

Returns

Promise<"passwords.token" | "passwords.reset">

PASSWORDS.RESET on success, PASSWORDS.TOKEN when missing, expired, or wrong.

Remarks

The stored token is matched by constant-time hash comparison; on success the token is consumed (deleted). Expired tokens are deleted and rejected.

prune()

prune(): Promise<void>

Defined in: auth/src/PasswordBroker.ts:133

Remove expired tokens. Call from a scheduled task.

Returns

Promise<void>