Merge branch 'main' into feature-rate-limiting

api/src/controllers/auth.ts

@@ -10,6 +10,7 @@ import { InvalidPayloadException } from '../exceptions/invalid-payload';
 import ms from 'ms';
 import cookieParser from 'cookie-parser';
 import env from '../env';
+import UsersService from '../services/users';
 
 const router = Router();
 
@@ -17,7 +18,7 @@ const loginSchema = Joi.object({
 	email: Joi.string().email().required(),
 	password: Joi.string().required(),
 	mode: Joi.string().valid('cookie', 'json'),
-	otp: Joi.string()
+	otp: Joi.string(),
 });
 
 router.post(
@@ -153,6 +154,55 @@ router.post(
 	})
 );
 
+router.post(
+	'/password/request',
+	asyncHandler(async (req, res) => {
+		if (!req.body.email) {
+			throw new InvalidPayloadException(`"email" field is required.`);
+		}
+
+		const accountability = {
+			ip: req.ip,
+			userAgent: req.get('user-agent'),
+			role: null,
+		};
+
+		const service = new UsersService({ accountability });
+
+		try {
+			await service.requestPasswordReset(req.body.email);
+		} catch {
+			// We don't want to give away what email addresses exist, so we'll always return a 200
+			// from this endpoint
+		} finally {
+			return res.status(200).end();
+		}
+	})
+);
+
+router.post(
+	'/password/reset',
+	asyncHandler(async (req, res) => {
+		if (!req.body.token) {
+			throw new InvalidPayloadException(`"token" field is required.`);
+		}
+
+		if (!req.body.password) {
+			throw new InvalidPayloadException(`"password" field is required.`);
+		}
+
+		const accountability = {
+			ip: req.ip,
+			userAgent: req.get('user-agent'),
+			role: null,
+		};
+
+		const service = new UsersService({ accountability });
+		await service.resetPassword(req.body.token, req.body.password);
+		return res.status(200).end();
+	})
+);
+
 router.use(
 	'/sso',
 	session({ secret: env.SECRET as string, saveUninitialized: false, resave: false })

api/src/controllers/server.ts

@@ -1,8 +1,14 @@
 import { Router } from 'express';
+import ServerService from '../services/server';
 
 const router = Router();
 
 router.get('/ping', (req, res) => res.send('pong'));
-router.get('/info', (req, res) => res.json({ data: process.versions }));
+
+router.get('/info', (req, res) => {
+	const service = new ServerService({ accountability: req.accountability });
+	const data = service.serverInfo();
+	res.json({ data });
+});
 
 export default router;