confirmPasswordReset method

Future<AuthPasswordResetResult> confirmPasswordReset(EngineContext ctx, { required String token, required String newPassword, })

Consumes a password-reset token and revokes the user's sessions.

Implementation

Future<AuthPasswordResetResult> confirmPasswordReset(
  EngineContext ctx, {
  required String token,
  required String newPassword,
}) async {
  await enforceRateLimitForProviderId(
    ctx,
    'password-reset',
    action: AuthRateLimitAction.passwordResetConfirm,
  );
  final tokenStore = store.passwordResetTokens;
  final pending = await tokenStore.findActive(token);
  final user = pending == null
      ? null
      : await store.users.findById(pending.userId);
  if (user == null || !await _passwordResetAllowed(user)) {
    throw AuthFlowException('invalid_password_reset_token');
  }
  await runtime.registry.enforcePasswordPolicy(
    AuthPasswordPolicyRequest<EngineContext>(
      context: ctx,
      operation: AuthPasswordPolicyOperation.passwordReset,
      password: newPassword,
      user: user,
    ),
  );
  return resetAuthPasswordWithToken(
    store: store,
    passwordHasher: options.passwordHasher,
    token: token,
    newPassword: newPassword,
    trustedDeviceStore: twoFactor?.backend.trustedDeviceStore,
    passwordPolicy: options.passwordPolicy,
  );
}