feat: forgot/reset password API (variant A). Fixes EventHub/EventHubBack#57

src/handlers/admin/admin_handler_user_password_reset_token.erl

@@ -0,0 +1,35 @@
+-module(admin_handler_user_password_reset_token).
+-behaviour(cowboy_handler).
+-export([init/2]).
+-export([trails/0]).
+
+init(Req, _Opts) ->
+  case cowboy_req:method(Req) of
+    <<"GET">> -> get_token(Req);
+    _ -> handler_utils:send_error(Req, 405, <<"Method not allowed">>)
+  end.
+
+get_token(Req) ->
+  case handler_utils:auth_admin(Req) of
+    {ok, _AdminId, Req1} ->
+      UserId = cowboy_req:binding(id, Req1),
+      case core_password_reset:get_or_create_token(UserId) of
+        {ok, Token, ExpiresAt} ->
+          handler_utils:send_json(Req1, 200, #{
+            <<"token">> => Token,
+            <<"expires_at">> => handler_utils:datetime_to_iso8601(ExpiresAt)
+          });
+        {error, not_found} ->
+          handler_utils:send_error(Req1, 404, <<"User not found">>)
+      end;
+    {error, Code, Msg, Req1} ->
+      handler_utils:send_error(Req1, Code, Msg)
+  end.
+
+trails() ->
+  [#{path => <<"/v1/admin/users/:id/password-reset-token">>,
+    method => <<"GET">>,
+    description => <<"Get or create password reset token for user (admin)">>,
+    tags => [<<"Users">>],
+    parameters => [#{name => <<"id">>, in => <<"path">>, required => true, schema => #{type => string}}],
+    responses => #{200 => #{description => <<"Token">>}}}].

src/handlers/handler_forgot_password.erl

@@ -0,0 +1,62 @@
+%%%-------------------------------------------------------------------
+%%% @doc POST /v1/forgot-password — запрос сброса пароля по email.
+%%% Ответ всегда 200 (без enumeration).
+%%% @end
+%%%-------------------------------------------------------------------
+-module(handler_forgot_password).
+-behaviour(cowboy_handler).
+-export([init/2]).
+-export([trails/0]).
+
+init(Req, _Opts) ->
+  case cowboy_req:method(Req) of
+    <<"POST">> -> forgot(Req);
+    _ -> handler_utils:send_error(Req, 405, <<"Method not allowed">>)
+  end.
+
+forgot(Req) ->
+  case cowboy_req:has_body(Req) of
+    false ->
+      handler_utils:send_error(Req, 400, <<"Missing request body">>);
+    true ->
+      {ok, Body, Req1} = cowboy_req:read_body(Req),
+      try jsx:decode(Body, [return_maps]) of
+        #{<<"email">> := Email} when is_binary(Email), Email =/= <<>> ->
+          logic_password_reset:request_reset(Email),
+          handler_utils:send_json(Req1, 200, #{
+            <<"message">> => <<"If the account exists, a reset email was sent">>
+          });
+        _ ->
+          handler_utils:send_error(Req1, 400, <<"Missing email">>)
+      catch
+        _:_ -> handler_utils:send_error(Req1, 400, <<"Invalid JSON">>)
+      end
+  end.
+
+trails() ->
+  [
+    #{
+      path => <<"/v1/forgot-password">>,
+      method => <<"POST">>,
+      description => <<"Request password reset email (always 200; no email enumeration)">>,
+      tags => [<<"Auth">>],
+      requestBody => #{
+        required => true,
+        content => #{
+          <<"application/json">> => #{
+            schema => #{
+              type => object,
+              required => [<<"email">>],
+              properties => #{
+                email => #{type => string, format => <<"email">>}
+              }
+            }
+          }
+        }
+      },
+      responses => #{
+        200 => #{description => <<"Accepted (sent or silently ignored)">>},
+        400 => #{description => <<"Missing email or invalid JSON">>}
+      }
+    }
+  ].

src/handlers/handler_reset_password.erl

@@ -0,0 +1,76 @@
+%%%-------------------------------------------------------------------
+%%% @doc POST /v1/reset-password — установка нового пароля по токену.
+%%% @end
+%%%-------------------------------------------------------------------
+-module(handler_reset_password).
+-behaviour(cowboy_handler).
+-export([init/2]).
+-export([trails/0]).
+
+init(Req, _Opts) ->
+  case cowboy_req:method(Req) of
+    <<"POST">> -> reset(Req);
+    _ -> handler_utils:send_error(Req, 405, <<"Method not allowed">>)
+  end.
+
+reset(Req) ->
+  case cowboy_req:has_body(Req) of
+    false ->
+      handler_utils:send_error(Req, 400, <<"Missing request body">>);
+    true ->
+      {ok, Body, Req1} = cowboy_req:read_body(Req),
+      try jsx:decode(Body, [return_maps]) of
+        #{<<"token">> := Token, <<"password">> := Password}
+          when is_binary(Token), is_binary(Password) ->
+          case logic_password_reset:reset_password(Token, Password) of
+            ok ->
+              handler_utils:send_json(Req1, 200, #{<<"message">> => <<"Password updated">>});
+            {error, expired} ->
+              handler_utils:send_error(Req1, 410, <<"Token expired">>);
+            {error, not_found} ->
+              handler_utils:send_error(Req1, 404, <<"Token not found">>);
+            {error, invalid_password} ->
+              handler_utils:send_error(Req1, 400, <<"Invalid password">>);
+            {error, forbidden} ->
+              handler_utils:send_error(Req1, 403, <<"Account cannot reset password">>);
+            {error, _} ->
+              handler_utils:send_error(Req1, 500, <<"Internal server error">>)
+          end;
+        _ ->
+          handler_utils:send_error(Req1, 400, <<"Missing token or password">>)
+      catch
+        _:_ -> handler_utils:send_error(Req1, 400, <<"Invalid JSON">>)
+      end
+  end.
+
+trails() ->
+  [
+    #{
+      path => <<"/v1/reset-password">>,
+      method => <<"POST">>,
+      description => <<"Reset password using token from email">>,
+      tags => [<<"Auth">>],
+      requestBody => #{
+        required => true,
+        content => #{
+          <<"application/json">> => #{
+            schema => #{
+              type => object,
+              required => [<<"token">>, <<"password">>],
+              properties => #{
+                token => #{type => string},
+                password => #{type => string, format => <<"password">>, minLength => 8}
+              }
+            }
+          }
+        }
+      },
+      responses => #{
+        200 => #{description => <<"Password updated">>},
+        400 => #{description => <<"Missing fields or invalid password">>},
+        403 => #{description => <<"Account not eligible">>},
+        404 => #{description => <<"Token not found">>},
+        410 => #{description => <<"Token expired">>}
+      }
+    }
+  ].