Add forget/reset password

close #50

Signed-off-by: gearnode <bryan@frimin.fr>

pkg/coredata/user.go

@@ -273,3 +273,36 @@ WHERE
 
 	return nil
 }
+
+func (u *User) UpdatePassword(
+	ctx context.Context,
+	conn pg.Conn,
+	hashedPassword []byte,
+) error {
+	q := `
+UPDATE
+    users
+SET
+    hashed_password = @hashed_password,
+    updated_at = @updated_at
+WHERE
+    id = @user_id
+`
+
+	now := time.Now()
+	args := pgx.StrictNamedArgs{
+		"user_id":         u.ID,
+		"hashed_password": hashedPassword,
+		"updated_at":      now,
+	}
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot update user password: %w", err)
+	}
+
+	u.HashedPassword = hashedPassword
+	u.UpdatedAt = now
+
+	return nil
+}

pkg/server/api/console/v1/forget_password_handler.go

@@ -0,0 +1,55 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package console_v1
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+
+	"github.com/getprobo/probo/pkg/usrmgr"
+	"go.gearno.de/kit/httpserver"
+)
+
+type (
+	ForgetPasswordRequest struct {
+		Email string `json:"email"`
+	}
+
+	ForgetPasswordResponse struct {
+		Success bool `json:"success"`
+	}
+)
+
+func ForgetPasswordHandler(usrmgrSvc *usrmgr.Service, authCfg AuthConfig) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		var req ForgetPasswordRequest
+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+			httpserver.RenderError(w, http.StatusBadRequest, fmt.Errorf("cannot decode body: %w", err))
+			return
+		}
+
+		err := usrmgrSvc.ForgetPassword(r.Context(), req.Email)
+		if err != nil {
+			// For security reasons, we don't expose whether an email exists or not
+			httpserver.RenderError(w, http.StatusInternalServerError, fmt.Errorf("cannot process request: %w", err))
+			return
+		}
+
+		httpserver.RenderJSON(w, http.StatusOK, ForgetPasswordResponse{
+			Success: true,
+		})
+	}
+}

pkg/server/api/console/v1/reset_password_handler.go

@@ -0,0 +1,70 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package console_v1
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+
+	"errors"
+
+	"github.com/getprobo/probo/pkg/usrmgr"
+	"go.gearno.de/kit/httpserver"
+)
+
+type (
+	ResetPasswordRequest struct {
+		Token    string `json:"token"`
+		Password string `json:"password"`
+	}
+
+	ResetPasswordResponse struct {
+		Success bool `json:"success"`
+	}
+)
+
+func ResetPasswordHandler(usrmgrSvc *usrmgr.Service, authCfg AuthConfig) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		var req ResetPasswordRequest
+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+			httpserver.RenderError(w, http.StatusBadRequest, fmt.Errorf("cannot decode body: %w", err))
+			return
+		}
+
+		err := usrmgrSvc.ResetPassword(r.Context(), req.Token, req.Password)
+		if err != nil {
+			var invalidPasswordErr *usrmgr.ErrInvalidPassword
+			var invalidTokenErr *usrmgr.ErrInvalidTokenType
+
+			if errors.As(err, &invalidPasswordErr) {
+				httpserver.RenderError(w, http.StatusBadRequest, err)
+				return
+			}
+
+			if errors.As(err, &invalidTokenErr) {
+				httpserver.RenderError(w, http.StatusBadRequest, err)
+				return
+			}
+
+			httpserver.RenderError(w, http.StatusInternalServerError, fmt.Errorf("cannot reset password: %w", err))
+			return
+		}
+
+		httpserver.RenderJSON(w, http.StatusOK, ResetPasswordResponse{
+			Success: true,
+		})
+	}
+}

pkg/server/api/console/v1/resolver.go

@@ -78,6 +78,8 @@ func NewMux(proboSvc *probo.Service, usrmgrSvc *usrmgr.Service, authCfg AuthConf
 	r.Post("/auth/login", SignInHandler(usrmgrSvc, authCfg))
 	r.Delete("/auth/logout", SignOutHandler(usrmgrSvc, authCfg))
 	r.Post("/auth/invitation", InvitationConfirmationHandler(usrmgrSvc, authCfg))
+	r.Post("/auth/forget-password", ForgetPasswordHandler(usrmgrSvc, authCfg))
+	r.Post("/auth/reset-password", ResetPasswordHandler(usrmgrSvc, authCfg))
 
 	r.Get("/", playground.Handler("GraphQL", "/api/console/v1/query"))
 	r.Post("/query", graphqlHandler(proboSvc, usrmgrSvc, authCfg))

pkg/usrmgr/usrmgr.go

@@ -83,12 +83,17 @@ type (
 		Email          string  `json:"email"`
 		FullName       string  `json:"full_name"`
 	}
+
+	PasswordResetData struct {
+		Email string `json:"email"`
+	}
 )
 
 // Token types
 const (
 	TokenTypeEmailConfirmation      = "email_confirmation"
 	TokenTypeOrganizationInvitation = "organization_invitation"
+	TokenTypePasswordReset          = "password_reset"
 )
 
 var (
@@ -107,6 +112,16 @@ var (
 
 	[1] %s
 	`
+
+	passwordResetEmailSubject  = "Reset your password"
+	passwordResetEmailTemplate = `
+	You have requested a password reset for your Probo account.
+	Please click the link below to reset your password[1]
+
+	If you did not request this password reset, please ignore this email.
+
+	[1] %s
+	`
 )
 
 func (e ErrInvalidCredentials) Error() string {
@@ -162,6 +177,68 @@ func NewService(
 	}, nil
 }
 
+func (s Service) ForgetPassword(
+	ctx context.Context,
+	email string,
+) error {
+	// Always generate a new token to avoid timing attacks and leaking information
+	// about existing emails
+	passwordResetToken, err := statelesstoken.NewToken(
+		s.tokenSecret,
+		TokenTypePasswordReset,
+		1*time.Hour,
+		PasswordResetData{Email: email},
+	)
+	if err != nil {
+		return fmt.Errorf("cannot generate password reset token: %w", err)
+	}
+
+	resetPasswordUrl := url.URL{
+		Scheme: "https",
+		Host:   s.hostname,
+		Path:   "/reset-password",
+		RawQuery: url.Values{
+			"token": []string{passwordResetToken},
+		}.Encode(),
+	}
+
+	user := &coredata.User{}
+
+	err = s.pg.WithTx(
+		ctx,
+		func(tx pg.Conn) error {
+			if err := user.LoadByEmail(ctx, tx, email); err != nil {
+				var errUserNotFound *coredata.ErrUserNotFound
+
+				if errors.As(err, &errUserNotFound) {
+					// We don't want to leak information about existing emails
+					// Return success even if the email doesn't exist
+					return nil
+				}
+				return fmt.Errorf("cannot load user by %q email: %w", email, err)
+			}
+
+			resetPasswordEmail := coredata.NewEmail(
+				user.FullName,
+				user.EmailAddress,
+				passwordResetEmailSubject,
+				fmt.Sprintf(passwordResetEmailTemplate, resetPasswordUrl.String()),
+			)
+
+			if err := resetPasswordEmail.Insert(ctx, tx); err != nil {
+				return fmt.Errorf("cannot insert email: %w", err)
+			}
+
+			return nil
+		},
+	)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
 func (s Service) SignUp(
 	ctx context.Context,
 	email, password, fullName string,
@@ -711,3 +788,46 @@ func (s Service) RemoveUser(ctx context.Context, organizationID gid.GID, userID
 		},
 	)
 }
+
+func (s Service) ResetPassword(ctx context.Context, tokenString string, newPassword string) error {
+	token, err := statelesstoken.ValidateToken[PasswordResetData](
+		s.tokenSecret,
+		TokenTypePasswordReset,
+		tokenString,
+	)
+	if err != nil {
+		return fmt.Errorf("cannot validate password reset token: %w", err)
+	}
+
+	if len(newPassword) < 8 {
+		return &ErrInvalidPassword{length: 8}
+	}
+
+	hashedPassword, err := s.hp.HashPassword([]byte(newPassword))
+	if err != nil {
+		return fmt.Errorf("cannot hash password: %w", err)
+	}
+
+	return s.pg.WithTx(
+		ctx,
+		func(tx pg.Conn) error {
+			user := &coredata.User{}
+
+			if err := user.LoadByEmail(ctx, tx, token.Data.Email); err != nil {
+				var errUserNotFound *coredata.ErrUserNotFound
+
+				if errors.As(err, &errUserNotFound) {
+					return fmt.Errorf("user not found: %w", err)
+				}
+
+				return fmt.Errorf("cannot load user by email: %w", err)
+			}
+
+			if err := user.UpdatePassword(ctx, tx, hashedPassword); err != nil {
+				return fmt.Errorf("cannot update user password: %w", err)
+			}
+
+			return nil
+		},
+	)
+}