Method createRefreshToken

backend/src/auth/auth.service.ts:228–240

(user: User)

  /**
   * Finish a reset.
   *
   * Single use falls out of how the token is signed: the key includes the
   * current password hash, so the moment this saves a new one every link
   * issued against the old password stops verifying. Nothing to store, and
   * nothing to clean up.
   */
  async resetPassword(
    token: string,
    newPassword: string,
  ): Promise<EmailConfirmationResponse> {
    const bad = {
      message: 'This reset link is invalid or has expired. Request a new one.',
      success: false,
    };

    const parsed = parseResetToken(token);