From bd020d4aefa90d13a7f2113255d5ea6c9cdeeeca Mon Sep 17 00:00:00 2001 From: Gowtham M Date: Wed, 19 Nov 2025 14:17:48 +0530 Subject: [PATCH] forgot pw changes : GWM --- app/controllers/establishment.controller.js | 140 ++++++++++++++------ 1 file changed, 100 insertions(+), 40 deletions(-) diff --git a/app/controllers/establishment.controller.js b/app/controllers/establishment.controller.js index c5d02d2..a5effed 100644 --- a/app/controllers/establishment.controller.js +++ b/app/controllers/establishment.controller.js @@ -730,34 +730,62 @@ exports.createRequest = async (req, res) => { exports.forgotPasswordRequestOTP = async (req, res) => { try { - const { establishment_name, establishment_code, registered_email } = req.body; + const { user_type , establishment_name, establishment_code, registered_email } = req.body; - // Validate inputs - if (!establishment_name || !establishment_code || !registered_email) - return res.status(400).json({ status: "failed", message: "All fields are required" }); + if(user_type == 'establishment_user') + { - // Find establishment and user - const establishment = await Establishment.findOne({ where: { establishment_code } }); - if (!establishment) - return res.status(404).json({ status: "failed", message: "Establishment not found" }); + // Validate inputs + if (!establishment_name || !establishment_code || !registered_email) + return res.status(400).json({ status: "failed", message: "All fields are required" }); - const user = await EstablishmentUser.findOne({ - where: { email: registered_email, establishment_id: establishment.id }, - }); - if (!user) - return res.status(404).json({ status: "failed", message: "User not found for this establishment" }); + // Find establishment and user + const establishment = await Establishment.findOne({ where: { establishment_code } }); + if (!establishment) + return res.status(404).json({ status: "failed", message: "Establishment not found" }); - // Generate 6-digit OTP - const otp = Math.floor(100000 + Math.random() * 900000).toString(); + const user = await EstablishmentUser.findOne({ + where: { email: registered_email, establishment_id: establishment.id }, + }); + + if (!user) + return res.status(404).json({ status: "failed", message: "User not found for this establishment" }); + + // Generate 6-digit OTP + const otp = Math.floor(100000 + Math.random() * 900000).toString(); + + // Hash OTP before saving (security) + const hashedOtp = await bcrypt.hash(otp, 10); + + // Store OTP in user record + await user.update({ + reset_otp: hashedOtp, + reset_otp_expires_at: new Date(Date.now() + 10 * 60 * 1000), // valid for 10 mins + }); + + }else{ + + const adminUser = await user.findOne({where: { email: registered_email },}); + + if (!adminUser) + return res.status(404).json({ status: "failed", message: "Admin user not found" }); + + // Generate 6-digit OTP + const otp = Math.floor(100000 + Math.random() * 900000).toString(); + + // Hash OTP before saving (security) + const hashedOtp = await bcrypt.hash(otp, 10); + + // Store OTP in user record + await adminUser.update({ + reset_otp: hashedOtp, + reset_otp_expires_at: new Date(Date.now() + 10 * 60 * 1000), // valid for 10 mins + }); + + + } - // Hash OTP before saving (security) - const hashedOtp = await bcrypt.hash(otp, 10); - // Store OTP in user record - await user.update({ - reset_otp: hashedOtp, - reset_otp_expires_at: new Date(Date.now() + 10 * 60 * 1000), // valid for 10 mins - }); // Send OTP email await sendEmail( @@ -781,7 +809,8 @@ exports.forgotPasswordRequestOTP = async (req, res) => { exports.forgotPasswordVerifyOTP = async (req, res) => { try { - const { registered_email, otp, password, confirm_password } = req.body; + const { user_type , registered_email, otp, password, confirm_password } = req.body; + if (!registered_email || !otp || !password || !confirm_password) return res.status(400).json({ status: "failed", message: "All fields are required" }); @@ -789,26 +818,57 @@ exports.forgotPasswordVerifyOTP = async (req, res) => { if (password !== confirm_password) return res.status(400).json({ status: "failed", message: "Passwords do not match" }); - const user = await EstablishmentUser.findOne({ where: { email: registered_email } }); - if (!user || !user.reset_otp) - return res.status(404).json({ status: "failed", message: "verification code not found or invalid user" }); - // Check OTP expiry - if (new Date() > new Date(user.reset_otp_expires_at)) - return res.status(400).json({ status: "failed", message: "Verification code has expired. Please request a new one" }); + if(user_type == 'establishment_user') + { - // Compare OTP - const isOtpValid = await bcrypt.compare(otp, user.reset_otp); - if (!isOtpValid) - return res.status(400).json({ status: "failed", message: "Invalid verification code" }); + const user = await EstablishmentUser.findOne({ where: { email: registered_email } }); + if (!user || !user.reset_otp) + return res.status(404).json({ status: "failed", message: "verification code not found or invalid user" }); - // Update password - const hashedPassword = await bcrypt.hash(password, 10); - await user.update({ - password: hashedPassword, - reset_otp: null, - reset_otp_expires_at: null, - }); + // Check OTP expiry + if (new Date() > new Date(user.reset_otp_expires_at)) + return res.status(400).json({ status: "failed", message: "Verification code has expired. Please request a new one" }); + + // Compare OTP + const isOtpValid = await bcrypt.compare(otp, user.reset_otp); + if (!isOtpValid) + return res.status(400).json({ status: "failed", message: "Invalid verification code" }); + + // Update password + const hashedPassword = await bcrypt.hash(password, 10); + await user.update({ + password: hashedPassword, + reset_otp: null, + reset_otp_expires_at: null, + }); + + }else{ + + const adminUser = await user.findOne({ where: { email: registered_email } }); + if (!adminUser || !adminUser.reset_otp) + return res.status(404).json({ status: "failed", message: "verification code not found or invalid user" }); + + // Check OTP expiry + if (new Date() > new Date(adminUser.reset_otp_expires_at)) + return res.status(400).json({ status: "failed", message: "Verification code has expired. Please request a new one" }); + + // Compare OTP + const isOtpValid = await bcrypt.compare(otp, adminUser.reset_otp); + if (!isOtpValid) + return res.status(400).json({ status: "failed", message: "Invalid verification code" }); + + // Update password + const hashedPassword = await bcrypt.hash(password, 10); + await adminUser.update({ + password: hashedPassword, + reset_otp: null, + reset_otp_expires_at: null, + }); + + } + + logger.info(`Password reset successful for user=${registered_email}`);