Method register

backend/src/auth/auth.service.ts:141–191

(registerUserInput: RegisterUserInput)

    // honest way to authorise the change. The UI hides the form for these.
    if (!user.password) {
      throw new BadRequestException(
        'This account signs in with Google and has no password to change.',
      );
    }
    if (!(await compare(currentPassword ?? '', user.password))) {
      throw new UnauthorizedException('Current password is incorrect');
    }
    if (!newPassword || newPassword.length < 8) {
      throw new BadRequestException('Password must be at least 8 characters.');
    }

    user.password = await hash(newPassword, 10);
    await this.userRepository.save(user);

    // Same reason as a reset: the point of changing a password is usually
    // that someone else might have the old one.
    await this.endAllSessions(userId);

    // Then re-admit this device only.
    const accessToken = this.jwtService.sign(
      { userId: user.id, email: user.email },
      { expiresIn: '30m' },
    );
    const refreshTokenEntity = await this.createRefreshToken(user);
    this.jwtCacheService.storeAccessToken(accessToken, user.id);

    return { accessToken, refreshToken: refreshTokenEntity.token };
  }

  /**
   * Start a password reset. Always answers the same thing.
   *
   * The response cannot depend on whether the address has an account, or on
   * how long the work took — either one turns this into an oracle for
   * "is X registered here". So an unknown address, a Google-only account and
   * a real account all get the identical message, and the only thing that
   * varies is whether an email actually goes out.
   */
  async requestPasswordReset(
    email: string,
  ): Promise<EmailConfirmationResponse> {
    const same = {
      message:
        'If that address has an account, a reset link is on its way. Check your inbox.',
      success: true,
    };

    const user = await findUserByEmail(this.userRepository, email);
    // No account, or a Google sign-in with no password to reset.
    if (!user || !user.password) return same;

    // Same cooldown the resend path uses, and the same column. Without it
    // this endpoint is an unauthenticated way to send mail to any address.
    const cooldown = 60 * 1000;