[Feat] Add password reset migration and related SQL script for users table

Author: chisa-dev

Backend/package-lock.json

@@ -24,6 +24,7 @@
     "@qdrant/js-client-rest": "^1.14.0",
     "bcryptjs": "^2.4.3",
     "cors": "^2.8.5",
+    "crypto": "^1.0.1",
     "date-fns": "^3.6.0",
     "dotenv": "^16.5.0",
     "express": "^4.21.2",
@@ -33,6 +34,7 @@
     "mammoth": "^1.9.0",
     "multer": "^1.4.5-lts.2",
     "mysql2": "^3.14.0",
+    "nodemailer": "^7.0.3",
     "openai": "^3.3.0",
     "pdf-parse": "^1.1.1",
     "sequelize": "^6.37.7",

Backend/package.json

@@ -0,0 +1,72 @@
+const mysql = require('mysql2/promise');
+const fs = require('fs');
+const path = require('path');
+require('dotenv').config();
+
+async function runPasswordResetMigration() {
+  let connection;
+  
+  try {
+    console.log('[LOG password_reset_migration] ========= Starting password reset fields migration');
+    
+    // Create connection
+    connection = await mysql.createConnection({
+      host: process.env.DB_HOST || 'localhost',
+      user: process.env.DB_USER || 'root',
+      password: process.env.DB_PASSWORD || 'root',
+      database: process.env.DB_NAME || 'unihub_db',
+      multipleStatements: true
+    });
+    
+    console.log('[LOG password_reset_migration] ========= Connected to database');
+    
+    // Check if users table exists
+    const [tables] = await connection.execute("SHOW TABLES LIKE 'users'");
+    if (tables.length === 0) {
+      throw new Error('Users table does not exist. Please run basic migrations first.');
+    }
+    
+    // Check if reset fields already exist
+    const [columns] = await connection.execute("SHOW COLUMNS FROM users LIKE 'reset_password_token'");
+    if (columns.length > 0) {
+      console.log('[LOG password_reset_migration] ========= Password reset fields already exist, skipping migration');
+      return;
+    }
+    
+    // Read and execute migration SQL
+    const migrationSQL = fs.readFileSync(
+      path.join(__dirname, 'src/migrations/add_password_reset_fields.sql'),
+      'utf8'
+    );
+    
+    await connection.query(migrationSQL);
+    console.log('[LOG password_reset_migration] ========= Password reset fields added successfully');
+    
+    // Verify fields were added
+    const [newColumns] = await connection.execute("SHOW COLUMNS FROM users WHERE Field IN ('reset_password_token', 'reset_password_expires')");
+    console.log('[LOG password_reset_migration] ========= Added fields:', newColumns.map(col => col.Field));
+    
+  } catch (error) {
+    console.error('[LOG password_reset_migration] ========= Migration failed:', error.message);
+    throw error;
+  } finally {
+    if (connection) {
+      await connection.end();
+    }
+  }
+}
+
+// Run if called directly
+if (require.main === module) {
+  runPasswordResetMigration()
+    .then(() => {
+      console.log('[LOG password_reset_migration] ========= Migration completed successfully!');
+      process.exit(0);
+    })
+    .catch((error) => {
+      console.error('[LOG password_reset_migration] ========= Migration failed:', error);
+      process.exit(1);
+    });
+}
+
+module.exports = { runPasswordResetMigration }; 

Backend/run_password_reset_migration.js

@@ -1,8 +1,10 @@
 const bcrypt = require('bcryptjs');
 const jwt = require('jsonwebtoken');
+const crypto = require('crypto');
 const { v4: uuidv4 } = require('uuid');
 const sequelize = require('../config/database');
 const { QueryTypes } = require('sequelize');
+const emailService = require('../services/emailService');
 
 const signup = async (req, res) => {
   const { username, email, password, fullName } = req.body;
@@ -159,7 +161,180 @@ const login = async (req, res) => {
   }
 };
 
+const forgotPassword = async (req, res) => {
+  const { email } = req.body;
+
+  try {
+    console.log(`[LOG forgot_password] ========= Password reset request for email: ${email}`);
+    
+    // Find user by email
+    const [user] = await sequelize.query(
+      'SELECT * FROM users WHERE email = ?',
+      {
+        replacements: [email],
+        type: QueryTypes.SELECT,
+      }
+    );
+
+    if (!user) {
+      // Don't reveal if email exists or not for security
+      return res.json({
+        success: true,
+        message: 'If an account with that email exists, we have sent a password reset link.'
+      });
+    }
+
+    // Generate reset token
+    const resetToken = crypto.randomBytes(32).toString('hex');
+    const resetTokenExpiry = new Date(Date.now() + 3600000); // 1 hour from now
+
+    // Save reset token to database
+    await sequelize.query(
+      'UPDATE users SET reset_password_token = ?, reset_password_expires = ? WHERE id = ?',
+      {
+        replacements: [resetToken, resetTokenExpiry, user.id],
+        type: QueryTypes.UPDATE
+      }
+    );
+
+    // Send reset email
+    try {
+      await emailService.sendPasswordResetEmail(email, resetToken, user.username || user.full_name || 'User');
+      console.log(`[LOG forgot_password] ========= Password reset email sent to ${email}`);
+    } catch (emailError) {
+      console.error(`[LOG forgot_password] ========= Failed to send email to ${email}:`, emailError);
+      // Clear the reset token if email fails
+      await sequelize.query(
+        'UPDATE users SET reset_password_token = NULL, reset_password_expires = NULL WHERE id = ?',
+        {
+          replacements: [user.id],
+          type: QueryTypes.UPDATE
+        }
+      );
+      return res.status(500).json({
+        success: false,
+        message: 'Failed to send password reset email. Please try again later.'
+      });
+    }
+
+    res.json({
+      success: true,
+      message: 'If an account with that email exists, we have sent a password reset link.'
+    });
+
+  } catch (error) {
+    console.error('[LOG forgot_password] ========= Error in forgot password:', error);
+    res.status(500).json({
+      success: false,
+      message: 'An error occurred while processing your request. Please try again later.'
+    });
+  }
+};
+
+const resetPassword = async (req, res) => {
+  const { token, newPassword } = req.body;
+
+  try {
+    console.log(`[LOG reset_password] ========= Password reset attempt with token: ${token?.substring(0, 8)}...`);
+    
+    // Find user by reset token and check if token is not expired
+    const [user] = await sequelize.query(
+      'SELECT * FROM users WHERE reset_password_token = ? AND reset_password_expires > NOW()',
+      {
+        replacements: [token],
+        type: QueryTypes.SELECT,
+      }
+    );
+
+    if (!user) {
+      return res.status(400).json({
+        success: false,
+        message: 'Invalid or expired reset token. Please request a new password reset.'
+      });
+    }
+
+    // Hash new password
+    const salt = await bcrypt.genSalt(10);
+    const hashedPassword = await bcrypt.hash(newPassword, salt);
+
+    // Update password and clear reset token
+    await sequelize.query(
+      'UPDATE users SET password_hash = ?, reset_password_token = NULL, reset_password_expires = NULL WHERE id = ?',
+      {
+        replacements: [hashedPassword, user.id],
+        type: QueryTypes.UPDATE
+      }
+    );
+
+    // Send confirmation email
+    try {
+      await emailService.sendPasswordChangeConfirmation(user.email, user.username || user.full_name || 'User');
+      console.log(`[LOG reset_password] ========= Password change confirmation sent to ${user.email}`);
+    } catch (emailError) {
+      console.error(`[LOG reset_password] ========= Failed to send confirmation email:`, emailError);
+      // Don't fail the request if confirmation email fails
+    }
+
+    console.log(`[LOG reset_password] ========= Password successfully reset for user ${user.username}`);
+
+    res.json({
+      success: true,
+      message: 'Password has been reset successfully. You can now log in with your new password.'
+    });
+
+  } catch (error) {
+    console.error('[LOG reset_password] ========= Error in reset password:', error);
+    res.status(500).json({
+      success: false,
+      message: 'An error occurred while resetting your password. Please try again later.'
+    });
+  }
+};
+
+const validateResetToken = async (req, res) => {
+  const { token } = req.params;
+
+  try {
+    console.log(`[LOG validate_token] ========= Validating reset token: ${token?.substring(0, 8)}...`);
+    
+    // Check if token exists and is not expired
+    const [user] = await sequelize.query(
+      'SELECT id, email, username FROM users WHERE reset_password_token = ? AND reset_password_expires > NOW()',
+      {
+        replacements: [token],
+        type: QueryTypes.SELECT,
+      }
+    );
+
+    if (!user) {
+      return res.status(400).json({
+        success: false,
+        message: 'Invalid or expired reset token.'
+      });
+    }
+
+    res.json({
+      success: true,
+      message: 'Token is valid.',
+      data: {
+        email: user.email,
+        username: user.username
+      }
+    });
+
+  } catch (error) {
+    console.error('[LOG validate_token] ========= Error validating token:', error);
+    res.status(500).json({
+      success: false,
+      message: 'An error occurred while validating the token.'
+    });
+  }
+};
+
 module.exports = {
   signup,
-  login
+  login,
+  forgotPassword,
+  resetPassword,
+  validateResetToken
 }; 

Backend/src/controllers/auth.controller.js

@@ -0,0 +1,7 @@
+-- Add password reset fields to users table
+ALTER TABLE users 
+ADD COLUMN reset_password_token VARCHAR(255) NULL,
+ADD COLUMN reset_password_expires DATETIME NULL;
+
+-- Add index for faster lookups
+CREATE INDEX idx_users_reset_token ON users(reset_password_token);