Password reset flow

import { apiRoot } from '../../client'; // Assuming apiRoot is initialized and exported here
import { CustomerToken } from '@commercetools/platform-sdk'; // Import the type for the token response

// Function to request a password reset token
async function requestPasswordResetToken(email: string): Promise<string> {
  // Returns the token string
  try {
    const tokenResponse = await apiRoot
      .customers()
      .passwordToken()
      .post({
        body: {
          email: email,
          ttlMinutes: 60, // Token valid for 60 minutes (1 hour)
          invalidateOlderTokens: true, // Invalidate all password tokens previously issued for this Customer
        },
      })
      .execute();

    const customerToken: CustomerToken = tokenResponse.body;
    console.log(
      'Password reset token generated (but not sent to console for security):'
    );
    // For demonstration, we'll log, but in production, NEVER log the token directly.
    if (process.env.NODE_ENV !== 'production') {
      console.log('Token Value:', customerToken.value); // Access the value from the typed object
    }
    return customerToken.value;
  } catch (error: any) {
    // Type 'any' for caught error for now, as stricter typing for HTTP errors can be complex
    console.error('Error requesting password reset token:', error);
    // For security, always return a generic success message to the user,
    // regardless of whether the email exists or not.
    console.log(
      'If your email exists in our system, a password reset link has been sent.'
    );
    throw error;
  }
}

// Simulate Alice requesting a password reset
(async () => {
  const aliceEmail = 'alice.smith@example.com';
  console.log(`\n--- Initiating Password Reset Request for ${aliceEmail} ---`);
  try {
    const resetToken = await requestPasswordResetToken(aliceEmail);
    const resetLink = `https://www.example.com/reset-password?token=${resetToken}`;
    const emailData = {
      toName: 'Alice',
      toEmail: aliceEmail,
      subject: 'Password Reset for your Zen Electron Account',
      body: `
         Dear Alice,

         You have requested a password reset for your Zen Electron account.
         Please click on the following link to reset your password:
         ${resetLink}

         This link will expire in 1 hour.
         If you did not request a password reset, please ignore this email.
      `.trim(),
    };

    // Note to learner: Implement actual email sending logic inside sendPasswordResetEmail()
    sendPasswordResetEmail(emailData);
  } catch (err) {
    console.error('Failed to initiate password reset for Alice.');
  }
})();

import { apiRoot } from '../../client'; // Assuming apiRoot is initialized and exported here
import { Customer } from '@commercetools/platform-sdk'; // Import the Customer type for the response

// Assuming `tokenValue` is received from the URL parameter and `newPassword` from a form
const receivedResetTokenValue = 'GENERATED_RESET_TOKEN_FROM_EMAIL'; // Replace with actual token
const aliceNewPassword = 'VerySecureNewPassword!2025'; // Ensure it meets strong policy

// Function to reset customer password
async function resetCustomerPassword(
  token: string,
  newPass: string
): Promise<Customer> {
  try {
    const customerResponse = await apiRoot
      .customers()
      .passwordReset()
      .post({
        body: {
          tokenValue: token,
          newPassword: newPass,
        },
      })
      .execute();

    const customer: Customer = customerResponse.body;
    console.log('Password successfully reset for customer:', customer.email);
    // After successful password reset, you might want to immediately log the user in
    // or redirect them to the login page.
    return customer;
  } catch (error: any) {
    // Type 'any' for caught error for now, as stricter typing for HTTP errors can be complex
    console.error('Error resetting password:', error);
    // Provide a generic error message to the user, e.g., "The password reset link is invalid or has expired."
    throw error;
  }
}

// Execute password reset
(async () => {
  try {
    console.log("\n--- Attempting to reset Alice's password ---");
    const updatedCustomer = await resetCustomerPassword(
      receivedResetTokenValue,
      aliceNewPassword
    );
    // After successful reset, you might auto-login Alice or prompt her to log in
    console.log(
      `Password reset for Alice successful! Her account is ready. Customer ID: ${updatedCustomer.id}`
    );
    // Note: Consider having the customer log in with the new password before creating an authenticated session.
    // This adds an extra layer of verification, ensuring the user actually knows the new password.
  } catch (err) {
    console.error("Failed to reset Alice's password.");
  }
})();