From e76db4629ece6f66e14c07a12bb1ecd495acb178 Mon Sep 17 00:00:00 2001
From: Adam Soltys <adam@coinos.io>
Date: Thu, 6 Feb 2025 09:07:12 -0800
Subject: expire reset codes

---
 routes/users.ts | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/routes/users.ts b/routes/users.ts
index f088d011..16c2d407 100644
--- a/routes/users.ts
+++ b/routes/users.ts
@@ -541,12 +541,7 @@ export default {
 
     try {
       user.pin = null;
-
-      if (user.nsec) {
-        const sk = randomBytes(32);
-        user.pubkey = getPublicKey(sk);
-        user.nsec = nip49encrypt(sk, password);
-      }
+      user.nsec = null;
 
       user.password = await Bun.password.hash(password, {
         algorithm: "bcrypt",
@@ -651,7 +646,7 @@ export default {
       if (user) {
         const code = v4();
         const link = `${process.env.URL}/reset/${code}`;
-        await s(`reset:${code}`, uid);
+        await db.set(`reset:${code}`, uid, { EX: 300 });
 
         await mail(user, "Password reset", templates.passwordReset, {
           ...user,
-- 
cgit v1.2.3