Overleaf/services/web/app/coffee/Features/PasswordReset/PasswordResetHandler.coffee

settings = require("settings-sharelatex")
async = require("async")
UserGetter = require("../User/UserGetter")
OneTimeTokenHandler = require("../Security/OneTimeTokenHandler")
EmailHandler = require("../Email/EmailHandler")
AuthenticationManager = require("../Authentication/AuthenticationManager")
logger = require("logger-sharelatex")
V1Api = require("../V1/V1Api")

module.exports = PasswordResetHandler =

	generateAndEmailResetToken:(email, callback = (error, status) ->)->
		PasswordResetHandler._getPasswordResetData email, (error, exists, data) ->
			if error?
				return callback(error, null)
			else if exists
				OneTimeTokenHandler.getNewToken 'password', data, (err, token)->
					if err then return callback(err)
					emailOptions =
						to : email
						setNewPasswordUrl : "#{settings.siteUrl}/user/password/set?passwordResetToken=#{token}&email=#{encodeURIComponent(email)}"
					EmailHandler.sendEmail "passwordResetRequested", emailOptions, (error) ->
						return callback(error) if error?
						callback null, 'primary'
			else
				UserGetter.getUserByAnyEmail email, (err, user) ->
					if !user
						return callback(error, null)
					else
						return callback(error, 'secondary')

	setNewUserPassword: (token, password, callback = (error, found, user_id) ->)->
		OneTimeTokenHandler.getValueFromTokenAndExpire 'password', token, (err, data)->
			if err then return callback(err)
			if !data?
				return callback null, false, null
			if typeof data == "string"
				# Backwards compatible with old format.
				# Tokens expire after 1h, so this can be removed soon after deploy.
				# Possibly we should keep this until we do an onsite release too.
				data = { user_id: data } 
			if data.user_id?
				AuthenticationManager.setUserPassword data.user_id, password, (err, reset) ->
					if err then return callback(err)
					callback null, reset, data.user_id
			else if data.v1_user_id?
				AuthenticationManager.setUserPasswordInV1 data.v1_user_id, password, (error, reset) ->
					return callback(error) if error?
					UserGetter.getUser { 'overleaf.id': data.v1_user_id }, {_id:1}, (error, user) ->
						return callback(error) if error?
						callback null, reset, user?._id

	_getPasswordResetData: (email, callback = (error, exists, data) ->) ->
		if settings.overleaf?
			# Overleaf v2
			V1Api.request {
				url: "/api/v1/sharelatex/user_emails"
				qs:
					email: email
				expectedStatusCodes: [404]
			}, (error, response, body) ->
				return callback(error) if error?
				if response.statusCode == 404
					return callback null, false
				else
					return callback null, true, { v1_user_id: body.user_id }
		else
			# ShareLaTeX
			UserGetter.getUserByMainEmail email, (err, user)->
				if err then return callback(err)
				if !user? or user.holdingAccount or user.overleaf?
					logger.err email:email, "user could not be found for password reset"
					return callback(null, false)
				return callback null, true, { user_id: user._id }