feat: Refactor password reset flow to use async processing and improve token validation

imphnen-iam/src/v1/auth/auth_service.rs

@@ -9,13 +9,14 @@ use crate::{
 	AppState, ResourceEnum, ResponseSuccessDto, RolesEnum, RolesRepository,
 	UsersDetailItemDto, UsersRepository, UsersSchema, common_response,
 	decode_refresh_token, encode_access_token, encode_refresh_token,
-	encode_reset_password_token, extract_email_token, generate_otp, get_iso_date,
+	encode_reset_password_token, extract_email_token_async, generate_otp, get_iso_date,
 	hash_password, make_thing, send_email, success_response, validate_request,
 	verify_password,
 };
 use axum::{http::StatusCode, response::Response};
 use surrealdb::Uuid;
 use tracing::error;
+use tokio;
 
 
 pub trait AuthServiceTrait: Send + Sync + 'static {
@@ -463,56 +464,35 @@ impl AuthServiceTrait for AuthService {
         let payload = payload;
         let state = state.to_owned();
         Box::pin(async move {
-		if let Err((status, message)) = validate_request(&payload) {
+            if let Err((status, message)) = validate_request(&payload) {
-			return common_response(status, &message);
+                return common_response(status, &message);
-		}
+            }
-		let user_repo = UsersRepository::new(&state);
+
-		let user_result = user_repo.query_user_by_email(payload.email.clone()).await;
+            tokio::spawn(async move {
-		let user = match user_result {
+                let user_repo = UsersRepository::new(&state);
-			Ok(user) => user,
+                if let Ok(user) = user_repo.query_user_by_email(payload.email.clone()).await {
-			Err(err_find) if err_find.to_string().contains("User not found") => {
+                    let permissions: Vec<String> = user.role.permissions.iter().map(|p| p.name.clone()).collect();
-				return common_response(StatusCode::BAD_REQUEST, "User not found");
+                    let token = match encode_reset_password_token(user.email.clone(), user.id.id.to_raw(), permissions) {
-			}
+                        Ok(token) => token,
-			Err(err_other) => {
+                        Err(_e) => {
-				error!(
+                            error!("Failed to generate reset password token for {}: {}", user.email, _e);
-					"Error finding user for forgot password {}: {}",
+                            return;
-					payload.email, err_other
+                        }
-				);
+                    };
-				return common_response(
+
-					StatusCode::INTERNAL_SERVER_ERROR,
+                    let env = &crate::enviroment::ENV;
-					&err_other.to_string(),
+                    let fe_url = env.fe_url.clone();
-				);
+                    let message = format!(
-			}
+                        "You have requested a password reset. Please click the link below to continue: {fe_url}/auth/reset-password?token={token}"
-		};
+                    );
-		let permissions: Vec<String> = user.role.permissions.iter().map(|p| p.name.clone()).collect();
+
-        let token = match encode_reset_password_token(user.email.clone(), user.id.id.to_raw(), permissions) {
+                    if let Err(err_send) = send_email(&payload.email, "Reset Password Request", &message) {
-			Ok(token) => token,
+                        error!("Failed to send reset password email to {}: {}", payload.email, err_send);
-			Err(_e) => {
+                    }
-				error!(
+                }
-					"Failed to generate reset password token for {}: {}",
+            });
-					user.email, _e
+
-				);
+            common_response(StatusCode::OK, "If your email is registered, you will receive a password reset link.")
-				return common_response(
-					StatusCode::INTERNAL_SERVER_ERROR,
-					"Failed to generate access token",
-				);
-			}
-		};
-		let env = &crate::enviroment::ENV;
-		let fe_url = env.fe_url.clone();
-		let message = format!(
-			"You have requested a password reset. Please click the link below to continue: {fe_url}/auth/reset-password?token={token}"
-		);
-		match send_email(&payload.email, "Reset Password Request", &message) {
-			Ok(_) => common_response(StatusCode::OK, "Reset Password request send"),
-			Err(err_send) => {
-				error!(
-					"Failed to send reset password email to {}: {}",
-					payload.email, err_send
-				);
-				common_response(StatusCode::BAD_REQUEST, &err_send.to_string())
-			}
-		}
         })
 	}
 
@@ -584,7 +564,7 @@ impl AuthServiceTrait for AuthService {
 		}
 		let repo = UsersRepository::new(&state);
 		let user_repo = UsersRepository::new(&state);
-		let email = match extract_email_token(payload.token.clone()) {
+		let email = match extract_email_token_async(payload.token.clone()).await {
 			Some(email) => email,
 			None => {
 				return common_response(StatusCode::BAD_REQUEST, "Invalid or missing token");

imphnen-utils/src/extract_email.rs

@@ -143,18 +143,28 @@ pub fn extract_email_token(token: String) -> Option<String> {
     }
 }
 
+/// A simple helper to check if a token string looks like a JWT.
+fn is_jwt(token: &str) -> bool {
+    let parts: Vec<_> = token.split('.').collect();
+    parts.len() == 3
+}
+
 /// Async version of extract_email_token that can handle Google access tokens
 pub async fn extract_email_token_async(token: String) -> Option<String> {
     info!(token = %token, "extract_email_token_async called with token");
-    match decode_access_token(&token) {
+
-        Ok(data) => {
+    if is_jwt(&token) {
-            info!(email = %data.claims.sub, "Successfully decoded internal token in extract_email_token_async");
+        match decode_access_token(&token) {
-            Some(data.claims.sub)
+            Ok(data) => {
-        }
+                info!(email = %data.claims.sub, "Successfully decoded internal token in extract_email_token_async");
-        Err(_) => {
+                return Some(data.claims.sub);
-            info!("Failed to decode as internal JWT in extract_email_token_async, trying Google token validation");
+            }
-            // If it fails, try to validate as Google access token
+            Err(_) => {
-            extract_email_from_google_token(&token).await
+                info!("Failed to decode as internal JWT in extract_email_token_async, trying Google token validation");
+            }
         }
     }
-}
+    
+    // If it's not a valid internal JWT, try to validate as Google access token
+    extract_email_from_google_token(&token).await
+}