feat: customer password reset via email round-trip (#32)

Adds "Forgot password?" to the login page, a request page, and a reset
page reached by a one-hour, single-use token delivered by email. Reuses
customer_tokens with a new password_reset kind alongside verify_email.

The request endpoint always answers 200, whether or not the address has
an account, so it cannot be used to test addresses for membership. Note
/register still reveals existence through its 409 on a duplicate, so this
protection is currently partial; closing that is its own change.

Completing a reset deletes every session for that customer. A reset
prompted by a compromise has to evict the intruder, and leaving a 30-day
cookie alive would defeat the point. It also marks the address verified,
since receiving the mail is exactly what verification proves, and
supersedes any outstanding token so an older link in the inbox cannot be
resurrected.

Introduces the first rate limiting in the codebase, on the request
endpoint only. The limiter is keyed on caller *and* submitted address:
keying on IP alone would let one person lock out everyone behind the same
proxy, and everything arrives via Nginx Proxy Manager. Applying that same
limiter to the reset endpoint, which carries no address, collapsed every
caller into one shared bucket -- so that endpoint is deliberately
unlimited instead, protected by a 32-byte single-use token whose bcrypt
work only runs after the token matches.

The e2e tests read the issued token directly from Postgres rather than
through a test-support endpoint. An endpoint returning a reset token for
an arbitrary address is account takeover for every customer if it is ever
reachable, and an environment gate is thin protection against that.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

backend/package-lock.json

@@ -11,6 +11,7 @@
         "bcryptjs": "^2.4.3",
         "cookie-parser": "^1.4.6",
         "express": "^4.19.2",
+        "express-rate-limit": "^8.6.2",
         "multer": "^1.4.5-lts.1",
         "node-cron": "^3.0.3",
         "node-pg-migrate": "^7.6.1",
@@ -2865,6 +2866,48 @@
         "url": "https://opencollective.com/express"
       }
     },
+    "node_modules/express-rate-limit": {
+      "version": "8.6.2",
+      "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.6.2.tgz",
+      "integrity": "sha512-YH4ru+eOJxQABscKFfRCy9R7x9QFGdezclVMwwgFFndzS2Xnm0uo6B0ABZsLhcpeptGv2qvuJVWlQr9gQZoC3A==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "^4.4.3",
+        "ip-address": "^10.2.0"
+      },
+      "engines": {
+        "node": ">= 16"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/express-rate-limit"
+      },
+      "peerDependencies": {
+        "express": ">= 4.11"
+      }
+    },
+    "node_modules/express-rate-limit/node_modules/debug": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+      "license": "MIT",
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/express-rate-limit/node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "license": "MIT"
+    },
     "node_modules/fast-json-stable-stringify": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz",
@@ -3333,6 +3376,15 @@
       "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
       "license": "ISC"
     },
+    "node_modules/ip-address": {
+      "version": "10.5.0",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.5.0.tgz",
+      "integrity": "sha512-R5SnVLJmgYYvf2F2ZgwSBnelz5G4q5AxIC277GDfUaNbrZKNANcBC7RHqYYePlszf4kBolVkJauG0ZjHHFh55g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 12"
+      }
+    },
     "node_modules/ipaddr.js": {
       "version": "1.9.1",
       "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",

backend/package.json

@@ -19,30 +19,31 @@
     "migrate:create": "node-pg-migrate create --migration-file-language js"
   },
   "dependencies": {
-    "express": "^4.19.2",
-    "pg": "^8.12.0",
-    "multer": "^1.4.5-lts.1",
     "bcryptjs": "^2.4.3",
     "cookie-parser": "^1.4.6",
-    "nodemailer": "^6.9.14",
+    "express": "^4.19.2",
+    "express-rate-limit": "^8.6.2",
+    "multer": "^1.4.5-lts.1",
     "node-cron": "^3.0.3",
-    "node-pg-migrate": "^7.6.1"
+    "node-pg-migrate": "^7.6.1",
+    "nodemailer": "^6.9.14",
+    "pg": "^8.12.0"
   },
   "devDependencies": {
-    "typescript": "^5.5.4",
-    "tsx": "^4.16.5",
-    "@types/express": "^4.17.21",
-    "@types/node": "^20.14.15",
-    "@types/multer": "^1.4.11",
-    "@types/pg": "^8.11.6",
     "@types/bcryptjs": "^2.4.6",
     "@types/cookie-parser": "^1.4.7",
-    "@types/nodemailer": "^6.4.15",
-    "@types/node-cron": "^3.0.11",
-    "jest": "^29.7.0",
-    "ts-jest": "^29.2.4",
+    "@types/express": "^4.17.21",
     "@types/jest": "^29.5.12",
+    "@types/multer": "^1.4.11",
+    "@types/node": "^20.14.15",
+    "@types/node-cron": "^3.0.11",
+    "@types/nodemailer": "^6.4.15",
+    "@types/pg": "^8.11.6",
+    "@types/supertest": "^6.0.2",
+    "jest": "^29.7.0",
     "supertest": "^7.0.0",
-    "@types/supertest": "^6.0.2"
+    "ts-jest": "^29.2.4",
+    "tsx": "^4.16.5",
+    "typescript": "^5.5.4"
   }
-}
+}

backend/src/rateLimit.ts

@@ -0,0 +1,35 @@
+import rateLimit from 'express-rate-limit';
+import { Request } from 'express';
+
+// First rate limiting in the codebase. The password-reset endpoints need it
+// most: without one, anyone can make the server send unlimited mail to any
+// address. Login and registration are the obvious next candidates.
+//
+// The default in-memory store suits a single-instance deployment, which this
+// is. Running more than one app container would need a shared store, or each
+// instance would enforce its own separate allowance.
+
+const WINDOW_MS = 15 * 60 * 1000;
+const MAX_REQUESTS = 5;
+
+// Keyed on caller *and* address rather than caller alone. Keying on IP only
+// would let one person's reset attempts lock out everyone behind the same
+// NAT or reverse proxy — and everything here arrives via Nginx Proxy Manager,
+// so a great many customers share an apparent address.
+//
+// This key only makes sense on a request that carries an email. Applying the
+// same limiter to an endpoint without one collapses every caller into a single
+// `ip:` bucket, which is a shared allowance rather than a per-caller one.
+function keyByCallerAndEmail(req: Request): string {
+  const email = typeof req.body?.email === 'string' ? req.body.email.toLowerCase().trim() : '';
+  return `${req.ip}:${email}`;
+}
+
+export const passwordResetRequestLimiter = rateLimit({
+  windowMs: WINDOW_MS,
+  limit: MAX_REQUESTS,
+  keyGenerator: keyByCallerAndEmail,
+  standardHeaders: 'draft-7',
+  legacyHeaders: false,
+  message: { error: 'too many attempts, please try again later' }
+});

backend/src/routes/customers.ts

@@ -5,6 +5,8 @@ import { pool } from '../db';
 import { requireCustomer } from '../middleware/customerAuth';
 import { sendMail } from '../mailer';
 import { MARKETING_CONSENT_TEXT, isValidEmail } from '../utils';
+import { asyncRoute } from '../asyncRoute';
+import { passwordResetRequestLimiter } from '../rateLimit';
 
 const router = Router();
 
@@ -93,6 +95,98 @@ router.post('/verify-email', async (req: Request, res: Response) => {
   res.json({ status: 'verified' });
 });
 
+const RESET_TOKEN_TTL_MS = 60 * 60 * 1000;
+
+// Always answers 200, whether or not the address has an account. A response
+// that differed would let anyone test addresses for membership.
+//
+// Note /register still reveals existence via its 409 on a duplicate address,
+// so this protection is currently partial — closing that is its own change.
+router.post('/request-password-reset', passwordResetRequestLimiter, asyncRoute(async (req: Request, res: Response) => {
+  const email = String(req.body?.email || '').toLowerCase().trim();
+  if (!email || !isValidEmail(email)) {
+    return res.status(400).json({ error: 'a valid email is required' });
+  }
+
+  const { rows } = await pool.query(`SELECT * FROM customers WHERE email = $1`, [email]);
+  const customer = rows[0];
+
+  if (customer) {
+    // Supersede any outstanding token, so a link cannot be resurrected later
+    // from an older message in the customer's inbox.
+    await pool.query(`DELETE FROM customer_tokens WHERE customer_id = $1 AND kind = 'password_reset'`, [customer.id]);
+
+    const token = crypto.randomBytes(32).toString('hex');
+    await pool.query(
+      `INSERT INTO customer_tokens (token, customer_id, kind, expires_at) VALUES ($1, $2, 'password_reset', $3)`,
+      [token, customer.id, new Date(Date.now() + RESET_TOKEN_TTL_MS)]
+    );
+
+    const resetUrl = `${process.env.PUBLIC_URL}/reset-password?token=${token}`;
+    sendMail(
+      customer.email,
+      'Reset your Redefined Designs password',
+      `<p>Someone asked to reset the password for this account.</p>
+       <p><a href="${resetUrl}">Choose a new password</a>. This link expires in one hour.</p>
+       <p>If this wasn't you, you can ignore this email — your password has not changed.</p>`
+    ).catch(err => console.error('password reset email send failed', err));
+  }
+
+  res.json({ status: 'sent' });
+}));
+
+// Deliberately not rate limited. The limiter above is keyed on the submitted
+// email, which this endpoint does not carry, so reusing it would put every
+// customer completing a reset into one shared bucket. Nor is a limit needed
+// here: the token is 32 random bytes, single-use, and expires in an hour, and
+// the expensive bcrypt hash only runs *after* the token has been matched, so
+// invalid guesses cost a single indexed lookup.
+router.post('/reset-password', asyncRoute(async (req: Request, res: Response) => {
+  const { token, password } = req.body || {};
+  if (!password || String(password).length < 8) {
+    // Checked before the token is looked at, so a rejected attempt does not
+    // consume the customer's only reset link.
+    return res.status(400).json({ error: 'password must be at least 8 characters' });
+  }
+
+  const { rows } = await pool.query(
+    `SELECT * FROM customer_tokens WHERE token = $1 AND kind = 'password_reset' AND expires_at > now()`,
+    [token]
+  );
+  if (!rows.length) return res.status(400).json({ error: 'invalid or expired token' });
+  const customerId = rows[0].customer_id;
+
+  const passwordHash = await bcrypt.hash(String(password), 12);
+
+  const client = await pool.connect();
+  try {
+    await client.query('BEGIN');
+    await client.query(
+      // The customer has demonstrably received mail at this address, which is
+      // exactly what verification proves, so an unverified address becomes
+      // verified here.
+      `UPDATE customers SET password_hash = $1, email_verified = true WHERE id = $2`,
+      [passwordHash, customerId]
+    );
+    // Every existing session goes, including any an attacker holds. Without
+    // this, a reset prompted by a compromise leaves the intruder signed in for
+    // up to 30 days.
+    await client.query(`DELETE FROM customer_sessions WHERE customer_id = $1`, [customerId]);
+    await client.query(`DELETE FROM customer_tokens WHERE customer_id = $1 AND kind = 'password_reset'`, [customerId]);
+    await client.query('COMMIT');
+  } catch (err) {
+    await client.query('ROLLBACK');
+    throw err;
+  } finally {
+    client.release();
+  }
+
+  const { rows: fresh } = await pool.query(`SELECT * FROM customers WHERE id = $1`, [customerId]);
+  const sessionToken = await createSession(customerId);
+  setSessionCookie(res, sessionToken);
+  res.json(publicCustomer(fresh[0]));
+}));
+
 router.post('/login', async (req: Request, res: Response) => {
   const { email, password } = req.body;
   const { rows } = await pool.query(`SELECT * FROM customers WHERE email = $1`, [String(email || '').toLowerCase().trim()]);

backend/tests/integration/passwordReset.integration.test.ts

@@ -0,0 +1,207 @@
+import request from 'supertest';
+import app from '../../src/app';
+import { pool } from '../../src/db';
+import { resetDb, closeDb } from './setup/testDb';
+
+beforeEach(async () => {
+  await resetDb();
+});
+
+afterAll(async () => {
+  await pool.end();
+  await closeDb();
+});
+
+const PASSWORD = 'supersecret123';
+
+async function register(email: string) {
+  const agent = request.agent(app);
+  const res = await agent.post('/api/customers/register').send({ email, password: PASSWORD });
+  expect(res.status).toBe(200);
+  return agent;
+}
+
+async function latestResetToken(email: string): Promise<string | undefined> {
+  const { rows } = await pool.query(
+    `SELECT t.token FROM customer_tokens t
+     JOIN customers c ON c.id = t.customer_id
+     WHERE c.email = $1 AND t.kind = 'password_reset'
+     ORDER BY t.created_at DESC LIMIT 1`,
+    [email]
+  );
+  return rows[0]?.token;
+}
+
+describe('POST /api/customers/request-password-reset', () => {
+  it('issues a reset token for a known address', async () => {
+    await register('known@example.com');
+
+    const res = await request(app).post('/api/customers/request-password-reset').send({ email: 'known@example.com' });
+    expect(res.status).toBe(200);
+    expect(await latestResetToken('known@example.com')).toBeTruthy();
+  });
+
+  it('reports the same success for an unknown address, and issues nothing', async () => {
+    const res = await request(app)
+      .post('/api/customers/request-password-reset')
+      .send({ email: 'nobody@example.com' });
+
+    // Differing responses would turn this endpoint into an oracle for which
+    // addresses have accounts.
+    expect(res.status).toBe(200);
+    const { rows } = await pool.query(`SELECT COUNT(*)::int AS n FROM customer_tokens WHERE kind = 'password_reset'`);
+    expect(rows[0].n).toBe(0);
+  });
+
+  it('matches the address case-insensitively, as login does', async () => {
+    await register('mixed@example.com');
+
+    await request(app).post('/api/customers/request-password-reset').send({ email: 'MiXeD@Example.com  ' });
+    expect(await latestResetToken('mixed@example.com')).toBeTruthy();
+  });
+
+  it('invalidates an earlier token when a new one is requested', async () => {
+    await register('twice@example.com');
+
+    await request(app).post('/api/customers/request-password-reset').send({ email: 'twice@example.com' });
+    const first = await latestResetToken('twice@example.com');
+    await request(app).post('/api/customers/request-password-reset').send({ email: 'twice@example.com' });
+    const second = await latestResetToken('twice@example.com');
+
+    expect(second).not.toBe(first);
+    const stale = await request(app)
+      .post('/api/customers/reset-password')
+      .send({ token: first, password: 'brandnewpassword' });
+    expect(stale.status).toBe(400);
+  });
+
+  it('rejects a malformed email without pretending to have sent anything', async () => {
+    const res = await request(app).post('/api/customers/request-password-reset').send({ email: 'not-an-email' });
+    expect(res.status).toBe(400);
+  });
+
+  it('rate limits repeated requests for the same address', async () => {
+    await register('flood@example.com');
+
+    const statuses: number[] = [];
+    for (let i = 0; i < 8; i++) {
+      const res = await request(app).post('/api/customers/request-password-reset').send({ email: 'flood@example.com' });
+      statuses.push(res.status);
+    }
+
+    // Without a limit this endpoint will send unlimited mail to any address.
+    expect(statuses).toContain(429);
+  });
+});
+
+describe('POST /api/customers/reset-password', () => {
+  async function requestReset(email: string): Promise<string> {
+    await request(app).post('/api/customers/request-password-reset').send({ email });
+    const token = await latestResetToken(email);
+    expect(token).toBeTruthy();
+    return token as string;
+  }
+
+  it('sets a new password and rejects the old one', async () => {
+    await register('change@example.com');
+    const token = await requestReset('change@example.com');
+
+    const res = await request(app).post('/api/customers/reset-password').send({ token, password: 'a-brand-new-password' });
+    expect(res.status).toBe(200);
+
+    const oldLogin = await request(app).post('/api/customers/login').send({ email: 'change@example.com', password: PASSWORD });
+    expect(oldLogin.status).toBe(401);
+
+    const newLogin = await request(app)
+      .post('/api/customers/login')
+      .send({ email: 'change@example.com', password: 'a-brand-new-password' });
+    expect(newLogin.status).toBe(200);
+  });
+
+  it('signs the customer in on success', async () => {
+    await register('signedin@example.com');
+    const token = await requestReset('signedin@example.com');
+
+    const agent = request.agent(app);
+    const res = await agent.post('/api/customers/reset-password').send({ token, password: 'a-brand-new-password' });
+    expect(res.status).toBe(200);
+
+    const me = await agent.get('/api/customers/me');
+    expect(me.status).toBe(200);
+    expect(me.body.email).toBe('signedin@example.com');
+  });
+
+  it('terminates sessions established before the reset', async () => {
+    const oldSession = await register('evict@example.com');
+    expect((await oldSession.get('/api/customers/me')).status).toBe(200);
+
+    const token = await requestReset('evict@example.com');
+    await request(app).post('/api/customers/reset-password').send({ token, password: 'a-brand-new-password' });
+
+    // A reset prompted by a compromise has to evict the attacker; leaving a
+    // 30-day cookie alive would defeat the point.
+    expect((await oldSession.get('/api/customers/me')).status).toBe(401);
+  });
+
+  it('marks the email verified, since the customer received mail at it', async () => {
+    await register('unverified@example.com');
+    const token = await requestReset('unverified@example.com');
+
+    await request(app).post('/api/customers/reset-password').send({ token, password: 'a-brand-new-password' });
+
+    const { rows } = await pool.query(`SELECT email_verified FROM customers WHERE email = $1`, ['unverified@example.com']);
+    expect(rows[0].email_verified).toBe(true);
+  });
+
+  it('consumes the token so it cannot be replayed', async () => {
+    await register('replay@example.com');
+    const token = await requestReset('replay@example.com');
+
+    await request(app).post('/api/customers/reset-password').send({ token, password: 'a-brand-new-password' });
+    const second = await request(app).post('/api/customers/reset-password').send({ token, password: 'another-password' });
+    expect(second.status).toBe(400);
+  });
+
+  it('rejects an expired token', async () => {
+    await register('expired@example.com');
+    const token = await requestReset('expired@example.com');
+    await pool.query(`UPDATE customer_tokens SET expires_at = now() - interval '1 minute' WHERE token = $1`, [token]);
+
+    const res = await request(app).post('/api/customers/reset-password').send({ token, password: 'a-brand-new-password' });
+    expect(res.status).toBe(400);
+  });
+
+  it('refuses a verify_email token, so one kind cannot stand in for another', async () => {
+    await register('crosskind@example.com');
+    const { rows } = await pool.query(
+      `SELECT t.token FROM customer_tokens t JOIN customers c ON c.id = t.customer_id
+       WHERE c.email = $1 AND t.kind = 'verify_email'`,
+      ['crosskind@example.com']
+    );
+    expect(rows[0].token).toBeTruthy();
+
+    const res = await request(app)
+      .post('/api/customers/reset-password')
+      .send({ token: rows[0].token, password: 'a-brand-new-password' });
+    expect(res.status).toBe(400);
+  });
+
+  it('rejects an unknown token', async () => {
+    const res = await request(app)
+      .post('/api/customers/reset-password')
+      .send({ token: 'nonsense', password: 'a-brand-new-password' });
+    expect(res.status).toBe(400);
+  });
+
+  it('enforces the same minimum password length as registration', async () => {
+    await register('short@example.com');
+    const token = await requestReset('short@example.com');
+
+    const res = await request(app).post('/api/customers/reset-password').send({ token, password: 'short' });
+    expect(res.status).toBe(400);
+
+    // A rejected attempt must not burn the token.
+    const retry = await request(app).post('/api/customers/reset-password').send({ token, password: 'long-enough-password' });
+    expect(retry.status).toBe(200);
+  });
+});