forgot-password

Forgot password management for @itrocks/user, including form, token generation, email sending, and secure reset.

Requirements

• Node.js 24 or newer.
• An application using @itrocks/user.
• An SMTP server configured through the shared smtp application configuration.

Installation

npm i @itrocks/forgot-password

The package contributes the public /user/forgot-password route through its config.yaml file. The it.rocks framework loads dependency configuration files automatically.

Usage

Configure the same SMTP source used by the rest of the application:

smtp:
  from:
    email: [email protected]
    name: Example
  host: smtp.example.com
  pass: "<SMTP_PASSWORD>"
  port: 465
  secure: true
  user: [email protected]

Opening /user/forgot-password displays the recovery form. Submitting an email always produces the same public response, whether the address exists, delivery fails, or the message is sent.

For a matching account, the action:

1. creates a random one-hour token;
2. stores only its SHA-256 fingerprint;
3. sends the raw token once in an SMTP email;
4. accepts one password reset before deleting the token.

Concurrent reset attempts are serialized by a unique persisted consumption record. Only one attempt can change the password.

API

Forgot

class Forgot<T extends User = User> extends Action<T> {
	async html(request: Request<T>): Promise<HtmlResponse>
}

Implements the HTML request, email delivery, token validation and password reset steps. The framework normally instantiates this action from the contributed route.

Dependencies

See dependency configuration for password-change lifecycle hooks and framework integration.