Merge pull request #276 from Sea-Haven-Industries/fix/ab/sh-403-reset-code-hardening

fix(auth): send reset email and code in the request body

src/domain/auth/api/auth-api.ts

@@ -40,12 +40,14 @@ export async function changePassword(data: ChangePasswordPayload): Promise<unkno
   return apiPost(API_PATHS.authentication.changePassword, data);
 }
 
+// Email and code travel in the JSON body so they stay out of URLs, traces and proxy logs.
 export async function forgotPassword(email: string): Promise<unknown> {
-  return apiPost(`${API_PATHS.authentication.forgetPassword}?Email=${encodeURIComponent(email)}`);
+  return apiPost(API_PATHS.authentication.forgetPassword, { email });
 }
 
-export async function verifyResetCode(code: string): Promise<unknown> {
-  return apiPost(`${API_PATHS.authentication.verificationCode}?code=${encodeURIComponent(code)}`);
+// The server checks a code only against the email it was issued to.
+export async function verifyResetCode(email: string, code: string): Promise<unknown> {
+  return apiPost(API_PATHS.authentication.verificationCode, { email, code });
 }
 
 export async function resetPassword(data: ResetPasswordPayload): Promise<unknown> {

src/test/domain/auth/api/auth-api.test.ts

@@ -0,0 +1,45 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const apiPost = vi.fn();
+
+vi.mock("@/api/api", () => ({
+  apiPost: (...args: unknown[]) => apiPost(...args),
+}));
+
+import { forgotPassword, resetPassword, verifyResetCode } from "@/domain/auth/api/auth-api";
+
+describe("password reset API", () => {
+  beforeEach(() => {
+    apiPost.mockReset();
+    apiPost.mockResolvedValue({ status: "Success ", message: "ok" });
+  });
+
+  it("sends the email in the request body, never in the URL", async () => {
+    await forgotPassword("alice@example.com");
+
+    expect(apiPost).toHaveBeenCalledWith("Authentication/ForgetPassword", {
+      email: "alice@example.com",
+    });
+    expect(String(apiPost.mock.calls[0][0])).not.toContain("?");
+  });
+
+  it("verifies a code together with the email it was issued to", async () => {
+    await verifyResetCode("alice@example.com", "123456");
+
+    expect(apiPost).toHaveBeenCalledWith("Authentication/VerificationCode", {
+      email: "alice@example.com",
+      code: "123456",
+    });
+    expect(String(apiPost.mock.calls[0][0])).not.toContain("123456");
+  });
+
+  it("resets with email, code and the new password in the body", async () => {
+    await resetPassword({ Email: "alice@example.com", Code: "123456", Password: "New@67890" });
+
+    expect(apiPost).toHaveBeenCalledWith("Authentication/ResetPassword", {
+      Email: "alice@example.com",
+      Code: "123456",
+      Password: "New@67890",
+    });
+  });
+});