apply security fix

2026-07-19 22:22:33 -04:00
parent ec03e783e5
commit a010ad6811
41 changed files with 626 additions and 224 deletions
@@ -1,5 +1,6 @@
 import bcrypt from 'bcryptjs'
 import crypto from 'crypto'
+import { hashPublicAccessToken } from '../../security/publicAccessTokens'
 import { authenticator } from 'otplib'
 import { signActorToken } from '../../security/tokens'
 import qrcode from 'qrcode'
@@ -144,7 +145,7 @@ export async function forgotPassword(email: string) {

  const rawToken = crypto.randomBytes(32).toString('hex')
  const expiresAt = new Date(Date.now() + ADMIN_RESET_TTL_MINUTES * 60 * 1000)
-  await repo.setAdminPasswordReset(admin.id, rawToken, expiresAt)
+  await repo.setAdminPasswordReset(admin.id, hashPublicAccessToken(rawToken), expiresAt)

  const adminUrl = ensureAdminBasePath(
    process.env.ADMIN_URL ?? process.env.NEXT_PUBLIC_ADMIN_URL ?? 'http://localhost:3000/admin',