diff --git a/index.js b/index.js index eec55af..841be60 100644 --- a/index.js +++ b/index.js @@ -573,6 +573,11 @@ app.post('/create_user', async (req, res) => { }); } + // Validate password length + if (!password || password.length < 8) { + return res.status(400).json({ error: 'Password must be at least 8 characters' }); + } + // Compute hash and token once for reuse const hashedPass = await hash(password); const token = crypto.randomBytes(32).toString('hex'); @@ -751,6 +756,52 @@ app.get('/account_info', authenticateToken, async (req, res) => { } }); +app.post('/change_password', authenticateToken, async (req, res) => { + try { + const { oldPassword, newPassword } = req.body; + + // Validate that both passwords are provided + if (!oldPassword || !newPassword) { + return res.status(400).json({ error: 'Old password and new password are required' }); + } + + // Validate new password length + if (newPassword.length < 8) { + return res.status(400).json({ error: 'New password must be at least 8 characters' }); + } + + // Get current password hash from database + const {rows} = await pool.query( + 'SELECT password_hash_string FROM users WHERE id = $1', + [req.user] + ); + + if (rows.length === 0) { + return res.status(404).json({ error: 'User not found' }); + } + + // Verify old password + const verified = await verify(rows[0].password_hash_string, oldPassword); + if (!verified) { + return res.status(401).json({ error: 'Current password is incorrect' }); + } + + // Hash the new password + const hashedNewPassword = await hash(newPassword); + + // Update password in database + await pool.query( + 'UPDATE users SET password_hash_string = $1 WHERE id = $2', + [hashedNewPassword, req.user] + ); + + res.status(200).json({ message: 'Password changed successfully' }); + } catch (err) { + console.error(err); + res.status(500).json({ error: 'Internal server error' }); + } +}); + app.get('/device_list', authenticateToken, async (req, res) => { try { console.log("device List request"); diff --git a/mailer.js b/mailer.js index 71373ec..a05ddff 100644 --- a/mailer.js +++ b/mailer.js @@ -24,12 +24,83 @@ async function sendVerificationEmail(toEmail, token, name) { to: toEmail, subject: "Verify your BlindMaster account", html: ` -
-

Welcome${name && name.trim() ? `, ${name.trim()}` : ''}!

-

Please verify your email address to complete your registration.

- Verify Email -

Link expires in 24 hours.

-
+ + + + + + + + + + + + +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+

BlindMaster

+

Smart Home Automation

+
+

+ Welcome${name && name.trim() ? `, ${name.trim()}` : ''}! +

+

+ Thank you for joining BlindMaster! To electrify your blinds, please verify your email address 🥹 +

+
+ + Verify Email Address + +
+
+
+

+ This verification link will expire in 24 hours. +

+

+ If you didn't create a BlindMaster account, please ignore this email!!! +

+
+

+ © 2026 BlindMaster. All rights reserved. +

+
+
+ + `, }); console.log("Email sent successfully:", info.messageId);