Inna
3573b7eb40
- lib/recover.ts: requestRecovery(type,email) -> password (crea token en home_passwordreset + email), accountname (email con las cuentas), activation (reenvía enlace); respuesta genérica anti-enumeración. resetPassword(token,pass) re-deriva el verifier SRP6 v2 (bnetMakeRegistration) y actualiza battlenet_accounts, marca el token usado. - Routes /api/auth/recover (Turnstile) y /api/auth/reset-password. - Páginas app/[locale]/recover (RecoverForm: selector de tipo + email + Turnstile) y reset-password (ResetForm con token de la URL). Catálogos Recover, Reset. Verificado: recover sin captcha -> captchaFailed; reset token inválido -> invalidLink; páginas 200. Reutiliza home_passwordreset de Django. Crypto de reset ya validada. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
19 lines
627 B
TypeScript
19 lines
627 B
TypeScript
import { resetPassword } from '@/lib/recover'
|
|
|
|
export async function POST(request: Request) {
|
|
let token = ''
|
|
let password = ''
|
|
let confPassword = ''
|
|
try {
|
|
const body = await request.json()
|
|
token = String(body.token ?? '')
|
|
password = String(body.password ?? '').trim()
|
|
confPassword = String(body.confPassword ?? '').trim()
|
|
} catch {
|
|
return Response.json({ success: false, error: 'invalidRequest' }, { status: 400 })
|
|
}
|
|
if (!token) return Response.json({ success: false, error: 'invalidLink' })
|
|
const result = await resetPassword(token, password, confPassword)
|
|
return Response.json(result)
|
|
}
|