Method login

backend/src/auth/auth.service.ts:193–226

(loginUserInput: LoginUserInput)

    // Same cooldown the resend path uses, and the same column. Without it
    // this endpoint is an unauthenticated way to send mail to any address.
    const cooldown = 60 * 1000;
    if (
      user.lastEmailSendTime &&
      Date.now() - user.lastEmailSendTime.getTime() < cooldown
    ) {
      return same;
    }

    const token = signResetToken(
      this.configService.jwtSecret,
      user.id,
      user.password,
    );

    user.lastEmailSendTime = new Date();
    await this.userRepository.save(user);

    if (this.isMailEnabled) {
      await this.mailService.sendPasswordResetEmail(user, token);
    } else {
      // SMTP is off in every environment today, so without this the feature
      // could not be exercised at all. The link is the whole secret, so it
      // goes to the server log and nowhere near the response.
      Logger.warn(
        `[auth] mail disabled — reset link for ${user.email}: ` +
          `${this.configService.frontendUrl}/reset-password?token=${token}`,
      );
    }

    return same;
  }

  /**
   * Finish a reset.
   *
   * Single use falls out of how the token is signed: the key includes the