How to send password reset emails from a REST API

import { randomBytes, createHash } from "node:crypto";

const token = randomBytes(32).toString("base64url");
await db.passwordResets.create({
  userId: user.id,
  hash: createHash("sha256").update(token).digest("hex"),
  expiresAt: new Date(Date.now() + 30 * 60_000),
});

const link = `https://yourapp.com/reset?token=${token}`;

await fetch("https://api.sendpository.com/v1/emails", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.SENDPOSITORY_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    from: "Acme <security@mail.yourdomain.com>",
    to: [user.email],
    subject: "Reset your Acme password",
    html: `<p>Someone asked to reset your password.</p>
<p><a href="${link}">Choose a new password</a> - this link works for 30 minutes.</p>
<p>If that wasn't you, ignore this email. Your password won't change.</p>`,
    text: `Reset your password: ${link}\nThis link works for 30 minutes.`,
    track_clicks: false,
    tags: { type: "password_reset" },
  }),
});

import crypto from "node:crypto";
import express from "express";
import { Sendpository } from "sendpository";

const app = express().use(express.json());
const sendpository = new Sendpository(process.env.SENDPOSITORY_API_KEY);
const sha256 = (s: string) => crypto.createHash("sha256").update(s).digest("hex");

// 1. Request a link. The reply is identical whether or not the account exists.
app.post("/password/forgot", async (req, res) => {
  res.status(202).json({ message: "If that address has an account, a link is on its way." });

  const user = await db.user.findByEmail(String(req.body.email ?? ""));
  if (!user) return;

  const token = crypto.randomBytes(32).toString("base64url");
  const reset = await db.passwordReset.insert({
    userId: user.id,
    tokenHash: sha256(token),
    expiresAt: Date.now() + 30 * 60_000,
  });
  const link = `https://app.acme.com/reset?token=${token}`;

  await sendpository.emails.send(
    {
      from: "Acme <security@mail.acme.com>",
      to: [user.email],
      subject: "Reset your Acme password",
      html: `<p><a href="${link}">Choose a new password</a>. The link works for 30 minutes.</p>
<p>If you didn't ask for this, ignore this email.</p>`,
      text: `Choose a new password: ${link}\nThe link works for 30 minutes.`,
      track_clicks: false, // the link must be exactly yours
      tags: { type: "password_reset" },
    },
    { idempotencyKey: `reset-${reset.id}` },
  );
});

// 2. The link opens a form. GET never changes state - scanners follow links.
app.get("/reset", (req, res) => res.render("reset-form", { token: req.query.token }));

// 3. Setting the password is the only step that acts.
app.post("/password/reset", async (req, res) => {
  const reset = await db.passwordReset.findByHash(sha256(String(req.body.token ?? "")));
  if (!reset || reset.usedAt || reset.expiresAt < Date.now()) {
    return res.status(400).json({ error: "link_expired" });
  }
  await db.transaction(async (tx) => {
    await tx.user.setPassword(reset.userId, await hashPassword(req.body.password));
    await tx.passwordReset.markUsed(reset.id);
    await tx.session.revokeAll(reset.userId); // sign out every other device
  });

  const user = await db.user.find(reset.userId);
  await sendpository.emails.send({
    from: "Acme <security@mail.acme.com>",
    to: [user.email],
    subject: "Your Acme password was changed",
    text: "Your password was just changed. If this wasn't you, reply to this email.",
    reply_to: ["security@acme.com"],
  });
  res.json({ ok: true });
});