Add password recovery API

README.md

@@ -76,6 +76,17 @@ Brevo is configured as Supabase Auth's SMTP provider; the Express API does not s
 
    Set **Site URL** to the frontend origin. Allow the frontend callback URLs listed above. The Pages proxy forwards confirmation to the backend, which verifies the one-time token and redirects to `/login?verified=1`; the user then signs in with their email and password. Existing email links using the Space origin should be replaced by newly issued emails.
 
+6. In **Authentication → Email Templates → Reset Password**, use a token-hash link to the public reset page. The page asks the user to confirm before exchanging the one-time token, so email security scanners do not consume it:
+
+   ```html
+   <h2>Reset your Sporalize password</h2>
+   <p>We received a request to reset the password for your Sporalize account.</p>
+   <p><a href="{{ .SiteURL }}/reset-password?token_hash={{ .TokenHash }}&amp;type=recovery">Reset password</a></p>
+   <p>If you did not request this, you can ignore this email.</p>
+   ```
+
+   Keep the Supabase **Site URL** set to the frontend origin (`https://sporalize.pages.dev` in production). Add `https://sporalize.pages.dev/reset-password` and `http://localhost:8080/reset-password` to the allowed redirect URLs for production and local development.
+
 Brevo credentials stay in Supabase SMTP settings and are not added to the browser or committed to `.env`.
 
 ## Routes
@@ -85,6 +96,9 @@ Brevo credentials stay in Supabase SMTP settings and are not added to the browse
 - `GET /api/auth/google?redirect=/labs` — starts Google OAuth.
 - `GET /api/auth/callback` — exchanges the Supabase code and sets HttpOnly cookies.
 - `GET /api/auth/confirm?token_hash=...` — verifies the signup email and redirects to the login page with a confirmation message.
+- `POST /api/auth/password/reset` — requests a password-reset email without revealing whether the email is registered.
+- `POST /api/auth/password/recovery/verify` — verifies the one-time recovery token and starts a short-lived recovery session.
+- `POST /api/auth/password/recovery` — changes the password only during that verified recovery session.
 - `GET /api/auth/me` — verifies the session and refreshes it when necessary.
 - `POST /api/auth/logout` — clears the session cookies.
 - `GET /api/auth/profile` and `PATCH /api/auth/profile` — read and update the signed-in user's profile.

src/auth.ts

@@ -1,3 +1,4 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
 import type { Request, Response } from "express";
 import type { Session, User } from "@supabase/supabase-js";
 import { env, isProduction } from "./config.js";
@@ -5,8 +6,42 @@ import { supabaseAuth } from "./supabase.js";
 
 const accessCookie = "sp_access";
 const refreshCookie = "sp_refresh";
+const passwordRecoveryCookie = "sp_password_recovery";
+const passwordRecoveryWindowMs = 15 * 60 * 1000;
 const sameSite = "lax" as const;
 const cookieOptions = { httpOnly: true, secure: isProduction, sameSite, path: "/" };
+const passwordRecoveryCookieOptions = {
+  httpOnly: true, secure: isProduction, sameSite, path: "/api/auth/password/recovery",
+};
+
+function passwordRecoverySignature(userId: string, expiresAt: number) {
+  return createHmac("sha256", env.SUPABASE_SERVICE_ROLE_KEY)
+    .update(`sporalize-password-recovery:${userId}:${expiresAt}`)
+    .digest("base64url");
+}
+
+export function setPasswordRecoveryCookie(res: Response, userId: string) {
+  const expiresAt = Date.now() + passwordRecoveryWindowMs;
+  res.cookie(passwordRecoveryCookie, `${expiresAt}.${passwordRecoverySignature(userId, expiresAt)}`, {
+    ...passwordRecoveryCookieOptions, maxAge: passwordRecoveryWindowMs,
+  });
+}
+
+export function hasPasswordRecoveryCookie(req: Request, userId: string) {
+  const value = req.cookies?.[passwordRecoveryCookie];
+  if (typeof value !== "string") return false;
+  const [expiresText, suppliedSignature, extra] = value.split(".");
+  const expiresAt = Number(expiresText);
+  if (extra !== undefined || !Number.isSafeInteger(expiresAt) || expiresAt <= Date.now() ||
+      expiresAt > Date.now() + passwordRecoveryWindowMs + 5_000 || !suppliedSignature) return false;
+  const expected = Buffer.from(passwordRecoverySignature(userId, expiresAt));
+  const supplied = Buffer.from(suppliedSignature);
+  return expected.length === supplied.length && timingSafeEqual(expected, supplied);
+}
+
+export function clearPasswordRecoveryCookie(res: Response) {
+  res.clearCookie(passwordRecoveryCookie, passwordRecoveryCookieOptions);
+}
 
 export function setSessionCookies(res: Response, session: Session) {
   res.cookie(accessCookie, session.access_token, { ...cookieOptions, maxAge: Math.max(session.expires_in * 1000, 60_000) });

src/server.ts

@@ -9,7 +9,7 @@ import { pipeline } from "node:stream/promises";
 import { z } from "zod";
 import { authPublicOrigin, env } from "./config.js";
 import { analysisRouter } from "./analysis.js";
-import { authenticatedUser, clearSessionCookies, safeRedirect, setSessionCookies } from "./auth.js";
+import { authenticatedUser, clearPasswordRecoveryCookie, clearSessionCookies, hasPasswordRecoveryCookie, safeRedirect, setPasswordRecoveryCookie, setSessionCookies } from "./auth.js";
 import { hashPassword, oauthClient, supabaseAdmin, supabaseAuth, syncProfile, userHasPassword, userPayload } from "./supabase.js";
 
 const app = express();
@@ -46,10 +46,15 @@ app.use((req, res, next) => {
 });
 
 const authLimiter = rateLimit({ windowMs: 15 * 60 * 1000, limit: 25, standardHeaders: "draft-8", legacyHeaders: false });
+const passwordResetRequestLimiter = rateLimit({ windowMs: 60 * 60 * 1000, limit: 5, standardHeaders: "draft-8", legacyHeaders: false });
+const passwordRecoveryLimiter = rateLimit({ windowMs: 15 * 60 * 1000, limit: 15, standardHeaders: "draft-8", legacyHeaders: false });
 const apiLimiter = rateLimit({ windowMs: 15 * 60 * 1000, limit: 3000, standardHeaders: "draft-8", legacyHeaders: false });
 const analysisUploadLimiter = rateLimit({ windowMs: 15 * 60 * 1000, limit: 4, standardHeaders: "draft-8", legacyHeaders: false });
 const signupSchema = z.object({ fname: z.string().trim().min(1).max(100), lname: z.string().trim().min(1).max(100), email: z.string().trim().toLowerCase().email().max(255), password: z.string().min(8).max(128), academy: z.string().trim().max(150).optional() });
 const loginSchema = z.object({ email: z.string().trim().toLowerCase().email(), password: z.string().min(1).max(128) });
+const passwordResetRequestSchema = z.object({ email: z.string().trim().toLowerCase().email().max(255) });
+const passwordRecoveryVerifySchema = z.object({ tokenHash: z.string().trim().min(1).max(512) });
+const passwordRecoverySchema = z.object({ newPassword: z.string().min(8).max(128) }).strict();
 const profileRoles = ["football_player", "coach", "club_manager", "academy_manager", "scout", "performance_analyst", "sports_director", "other"] as const;
 const profileSchema = z.object({
   fname: z.string().trim().min(1).max(100),
@@ -402,12 +407,66 @@ app.post("/api/auth/signup", authLimiter, async (req, res, next) => {
     if (data.user?.identities?.length) await syncProfile(data.user, { ...input, passwordHash });
     if (data.user && data.session) {
       setSessionCookies(res, data.session);
+      clearPasswordRecoveryCookie(res);
       return res.status(201).json({ user: userPayload(data.user), requiresEmailVerification: false });
     }
     return res.status(201).json({ user: data.user ? userPayload(data.user) : null, requiresEmailVerification: true });
   } catch (error) { next(error); }
 });
 
+app.post("/api/auth/password/reset", passwordResetRequestLimiter, async (req, res, next) => {
+  try {
+    const input = passwordResetRequestSchema.parse(req.body);
+    const { error } = await supabaseAuth.auth.resetPasswordForEmail(input.email);
+    if (error) {
+      console.error("Supabase password reset request failed", { status: error.status, code: error.code });
+      return res.status(503).json({ error: "We couldn't send the reset email right now. Please try again later." });
+    }
+    // Keep the response identical whether or not the email belongs to an account.
+    return res.json({ ok: true });
+  } catch (error) { next(error); }
+});
+
+app.post("/api/auth/password/recovery/verify", passwordRecoveryLimiter, async (req, res, next) => {
+  try {
+    const input = passwordRecoveryVerifySchema.parse(req.body);
+    const { data, error } = await supabaseAuth.auth.verifyOtp({ token_hash: input.tokenHash, type: "recovery" });
+    if (error || !data.user || !data.session) {
+      return res.status(400).json({ error: "This reset link is invalid or has expired. Request a new one." });
+    }
+    setSessionCookies(res, data.session);
+    setPasswordRecoveryCookie(res, data.user.id);
+    res.set("Cache-Control", "no-store");
+    return res.json({ ok: true });
+  } catch (error) { next(error); }
+});
+
+app.post("/api/auth/password/recovery", passwordRecoveryLimiter, async (req, res, next) => {
+  try {
+    const current = await authenticatedUser(req, res);
+    if (!current) return res.status(401).json({ error: "Your reset link has expired. Request a new one." });
+    if (!hasPasswordRecoveryCookie(req, current.user.id)) {
+      return res.status(403).json({ error: "Verify a password reset link before changing your password." });
+    }
+    const input = passwordRecoverySchema.parse(req.body);
+    const { error } = await supabaseAdmin.auth.admin.updateUserById(current.user.id, {
+      password: input.newPassword,
+      app_metadata: { ...current.user.app_metadata, has_password: true },
+    });
+    if (error) return res.status(400).json({ error: "Unable to update your password. Please try again." });
+
+    const passwordHash = await hashPassword(input.newPassword);
+    const { error: profileError } = await supabaseAdmin.from("users")
+      .update({ password_hash: passwordHash }).eq("user_id", current.user.id);
+    if (profileError) throw new Error(`Password updated but profile hash sync failed: ${profileError.message}`);
+
+    clearSessionCookies(res);
+    clearPasswordRecoveryCookie(res);
+    res.set("Cache-Control", "no-store");
+    return res.json({ ok: true });
+  } catch (error) { next(error); }
+});
+
 app.post("/api/auth/login", authLimiter, async (req, res, next) => {
   try {
     const input = loginSchema.parse(req.body);
@@ -415,6 +474,7 @@ app.post("/api/auth/login", authLimiter, async (req, res, next) => {
     if (error || !data.user || !data.session) return res.status(401).json({ error: "Invalid email or password." });
     await syncProfile(data.user);
     setSessionCookies(res, data.session);
+    clearPasswordRecoveryCookie(res);
     const subscription = await activeSubscriptionFor(data.user.id);
     return res.json({ user: userPayload(data.user), access: { active: Boolean(subscription), subscription } });
   } catch (error) { next(error); }
@@ -439,6 +499,7 @@ app.get("/api/auth/callback", async (req, res, next) => {
     if (error || !data.user || !data.session) return res.redirect(`${env.FRONTEND_URL}/login?error=oauth_callback_failed`);
     await syncProfile(data.user);
     setSessionCookies(res, data.session);
+    clearPasswordRecoveryCookie(res);
     return res.redirect(safeRedirect(req.query.next));
   } catch (error) { next(error); }
 });
@@ -461,6 +522,7 @@ app.get("/api/auth/confirm", async (req, res, next) => {
 app.post("/api/auth/logout", async (req, res, next) => {
   try {
     clearSessionCookies(res);
+    clearPasswordRecoveryCookie(res);
     return res.status(204).send();
   } catch (error) { next(error); }
 });
@@ -545,6 +607,7 @@ app.delete("/api/auth/account", async (req, res, next) => {
     if (authError) return res.status(500).json({ error: "Unable to delete your account. Please try again." });
     const { error: profileError } = await supabaseAdmin.from("users").delete().eq("user_id", current.user.id);
     clearSessionCookies(res);
+    clearPasswordRecoveryCookie(res);
     if (profileError) throw new Error(`Account deleted but profile cleanup failed: ${profileError.message}`);
     return res.status(204).send();
   } catch (error) { next(error); }