feat: implement secure forgot password flow with hashed tokens (#1426)

[jayshreerathoreai32-hue]

Resolves #1426

Description

This PR finalizes and secures the backend Forgot Password / Password Reset workflow.

Previously, password reset tokens were generated and stored directly in the database as plain-text values. This created a potential security vulnerability because anyone who gained unauthorized access to the database could potentially use active reset tokens to reset user passwords.

This PR addresses the issue by introducing one-way SHA-256 hashing for reset tokens before database storage, securely validating tokens during password reset, and adding comprehensive automated tests for the complete password recovery flow.

Problem Statement

The application previously lacked a fully secure and tested password reset flow.

The main security concern was that generated password reset tokens were stored directly in the database without hashing. Since reset tokens function as temporary credentials, storing them in plain text increases the impact of a potential database compromise.

The implementation also required additional test coverage to ensure that reset emails, token validation, token invalidation, and invalid reset requests behave correctly.

Changes Included

1. Secure Password Reset Token Hashing

• Updated forgotPassword.js to hash generated reset tokens using SHA-256 before storing them in the database.
• The original plain-text token is only used for the reset link sent to the user.
• The database stores only the resulting cryptographic hash.
• This ensures that an attacker who gains access to the database cannot directly use stored reset tokens.

2. Secure Token Validation

• Updated resetPassword.js to securely validate incoming reset tokens.
• The plain-text token received from the reset request is hashed using the same SHA-256 process.
• The resulting hash is then compared against the stored database value.
• This preserves the existing reset-link functionality while preventing plain-text token storage.

3. Password Reset Token Invalidation

• Reset tokens are invalidated after successful password reset.
• Prevents previously used reset links from being reused.
• Helps ensure that each reset token can only be used for its intended password recovery operation.

4. Comprehensive Automated Testing

Added passwordReset.test.js with isolated tests covering the password reset workflow.

The tests mock:

• Nodemailer to simulate email delivery without sending real emails.
• UserModel to isolate database interactions.

The test coverage verifies that:

• Forgot-password requests are processed correctly.
• Reset emails are dispatched through the mocked mailer.
• Reset tokens are generated and stored securely as hashes.
• Valid reset tokens are accepted.
• Invalid reset tokens are rejected.
• Used reset tokens are invalidated after a successful password reset.
• Password reset requests behave correctly under invalid conditions.

5. Additional Routing Fix

• Fixed a minor routing syntax issue in rateLimiter.js that was identified while running the password reset tests.
• This ensures the affected middleware continues to load and function correctly alongside the updated authentication flow.

Security Improvements

This PR significantly improves the security of the password recovery system.

The reset token now follows the same general security principle used for passwords and other sensitive credentials: the database never needs to store the usable plain-text token.

The updated flow is:

User requests password reset
        ↓
Generate random reset token
        ↓
Send plain-text token via reset link
        ↓
Hash token using SHA-256
        ↓
Store only the hash in database
        ↓
User submits reset token
        ↓
Hash submitted token
        ↓
Compare with stored hash
        ↓
Reset password if valid
        ↓
Invalidate token

[vercel]

@jayshreerathoreai32-hue is attempting to deploy a commit to the jiya's projects Team on Vercel.

A member of the Team first needs to authorize it.

[netlify]

✅ Deploy Preview for codevibeforyou ready!

Name	Link
🔨 Latest commit	e027cf9
🔍 Latest deploy log	https://app.netlify.com/projects/codevibeforyou/deploys/6a7cd49522677b0008f2e153
😎 Deploy Preview	https://deploy-preview-1467--codevibeforyou.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.