chore: import upstream snapshot with attribution

apps/sim/app/api/auth/forget-password/route.test.ts

@@ -0,0 +1,170 @@
+/**
+ * Tests for forget password API route
+ *
+ * @vitest-environment node
+ */
+import { createMockRequest } from '@sim/testing'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockRequestPasswordReset, mockLogger } = vi.hoisted(() => {
+  const logger = {
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    debug: vi.fn(),
+    trace: vi.fn(),
+    fatal: vi.fn(),
+    child: vi.fn(),
+  }
+  return {
+    mockRequestPasswordReset: vi.fn(),
+    mockLogger: logger,
+  }
+})
+
+vi.mock('@/lib/core/utils/urls', () => ({
+  getBaseUrl: vi.fn(() => 'https://app.example.com'),
+}))
+vi.mock('@/lib/auth', () => ({
+  auth: {
+    api: {
+      requestPasswordReset: mockRequestPasswordReset,
+    },
+  },
+}))
+vi.mock('@sim/logger', () => ({
+  createLogger: vi.fn().mockReturnValue(mockLogger),
+  runWithRequestContext: <T>(_ctx: unknown, fn: () => T): T => fn(),
+  getRequestContext: () => undefined,
+}))
+
+import { POST } from '@/app/api/auth/forget-password/route'
+
+describe('Forget Password API Route', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockRequestPasswordReset.mockResolvedValue(undefined)
+  })
+
+  afterEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('should send password reset email successfully with same-origin redirectTo', async () => {
+    const req = createMockRequest('POST', {
+      email: 'test@example.com',
+      redirectTo: 'https://app.example.com/reset',
+    })
+
+    const response = await POST(req)
+    const data = await response.json()
+
+    expect(response.status).toBe(200)
+    expect(data.success).toBe(true)
+
+    expect(mockRequestPasswordReset).toHaveBeenCalledWith({
+      body: {
+        email: 'test@example.com',
+        redirectTo: 'https://app.example.com/reset',
+      },
+      method: 'POST',
+    })
+  })
+
+  it('should reject external redirectTo URL', async () => {
+    const req = createMockRequest('POST', {
+      email: 'test@example.com',
+      redirectTo: 'https://evil.com/phishing',
+    })
+
+    const response = await POST(req)
+    const data = await response.json()
+
+    expect(response.status).toBe(400)
+    expect(data.message).toBe('Redirect URL must be a valid same-origin URL')
+
+    expect(mockRequestPasswordReset).not.toHaveBeenCalled()
+  })
+
+  it('should send password reset email without redirectTo', async () => {
+    const req = createMockRequest('POST', {
+      email: 'test@example.com',
+    })
+
+    const response = await POST(req)
+    const data = await response.json()
+
+    expect(response.status).toBe(200)
+    expect(data.success).toBe(true)
+
+    expect(mockRequestPasswordReset).toHaveBeenCalledWith({
+      body: {
+        email: 'test@example.com',
+        redirectTo: undefined,
+      },
+      method: 'POST',
+    })
+  })
+
+  it('should handle missing email', async () => {
+    const req = createMockRequest('POST', {})
+
+    const response = await POST(req)
+    const data = await response.json()
+
+    expect(response.status).toBe(400)
+    expect(data.message).toBe('Email is required')
+
+    expect(mockRequestPasswordReset).not.toHaveBeenCalled()
+  })
+
+  it('should handle empty email', async () => {
+    const req = createMockRequest('POST', {
+      email: '',
+    })
+
+    const response = await POST(req)
+    const data = await response.json()
+
+    expect(response.status).toBe(400)
+    expect(data.message).toBe('Please provide a valid email address')
+
+    expect(mockRequestPasswordReset).not.toHaveBeenCalled()
+  })
+
+  it('should handle auth service error with message', async () => {
+    const errorMessage = 'User not found'
+
+    mockRequestPasswordReset.mockRejectedValue(new Error(errorMessage))
+
+    const req = createMockRequest('POST', {
+      email: 'nonexistent@example.com',
+    })
+
+    const response = await POST(req)
+    const data = await response.json()
+
+    expect(response.status).toBe(500)
+    expect(data.message).toBe(errorMessage)
+
+    expect(mockLogger.error).toHaveBeenCalledWith('Error requesting password reset:', {
+      error: expect.any(Error),
+    })
+  })
+
+  it('should handle unknown error', async () => {
+    mockRequestPasswordReset.mockRejectedValue('Unknown error')
+
+    const req = createMockRequest('POST', {
+      email: 'test@example.com',
+    })
+
+    const response = await POST(req)
+    const data = await response.json()
+
+    expect(response.status).toBe(500)
+    expect(data.message).toBe('Failed to send password reset email. Please try again later.')
+
+    expect(mockLogger.error).toHaveBeenCalled()
+  })
+})

apps/sim/app/api/auth/forget-password/route.ts

@@ -0,0 +1,78 @@
+import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
+import { db } from '@sim/db'
+import { user } from '@sim/db/schema'
+import { createLogger } from '@sim/logger'
+import { eq } from 'drizzle-orm'
+import { type NextRequest, NextResponse } from 'next/server'
+import { forgetPasswordContract } from '@/lib/api/contracts'
+import { getValidationErrorMessage, parseRequest } from '@/lib/api/server'
+import { auth } from '@/lib/auth'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+
+export const dynamic = 'force-dynamic'
+
+const logger = createLogger('ForgetPasswordAPI')
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  try {
+    const parsed = await parseRequest(
+      forgetPasswordContract,
+      request,
+      {},
+      {
+        validationErrorResponse: (error) => {
+          logger.warn('Invalid forget password request data', { errors: error.issues })
+          return NextResponse.json(
+            { message: getValidationErrorMessage(error, 'Invalid request data') },
+            { status: 400 }
+          )
+        },
+      }
+    )
+    if (!parsed.success) return parsed.response
+
+    const { email, redirectTo } = parsed.data.body
+
+    await auth.api.requestPasswordReset({
+      body: {
+        email,
+        redirectTo,
+      },
+      method: 'POST',
+    })
+
+    const [existingUser] = await db
+      .select({ id: user.id, name: user.name, email: user.email })
+      .from(user)
+      .where(eq(user.email, email))
+      .limit(1)
+
+    if (existingUser) {
+      recordAudit({
+        actorId: existingUser.id,
+        actorName: existingUser.name,
+        actorEmail: existingUser.email,
+        action: AuditAction.PASSWORD_RESET_REQUESTED,
+        resourceType: AuditResourceType.PASSWORD,
+        resourceId: existingUser.id,
+        resourceName: existingUser.email ?? undefined,
+        description: `Password reset requested for ${existingUser.email}`,
+        request,
+      })
+    }
+
+    return NextResponse.json({ success: true })
+  } catch (error) {
+    logger.error('Error requesting password reset:', { error })
+
+    return NextResponse.json(
+      {
+        message:
+          error instanceof Error
+            ? error.message
+            : 'Failed to send password reset email. Please try again later.',
+      },
+      { status: 500 }
+    )
+  }
+})