Added password recovery and login attempt guards.

src/web/auth.js

@@ -9,7 +9,9 @@ import {
 	flushUserKeys,
 	login,
 	removeUserKey,
+	resetPassword,
 	sendEmailVerification,
+	sendPasswordReset,
 	signup,
 	updateSettings,
 	updateUser,
@@ -184,6 +186,20 @@ async function verifyEmailApi(req, res) {
 	res.status(204).send();
 }
 
+async function sendPasswordResetApi(req, res) {
+	await sendPasswordReset(req.body.credential);
+
+	res.status(204).send();
+}
+
+async function resetPasswordApi(req, res) {
+	const userId = Number(req.body.userId) || null;
+
+	await resetPassword(userId, req.body.token, req.body.password);
+
+	res.status(204).send();
+}
+
 async function updateSettingsApi(req, res) {
 	const updatedSettings = await updateSettings(req.body, req.user);
 
@@ -234,6 +250,8 @@ authRouter.patch('/api/me/settings', updateSettingsApi);
 // EMAIL VERIFICATION
 authRouter.post('/api/me/email_verification', sendEmailVerificationApi);
 authRouter.post('/api/emails/verify', verifyEmailApi); // usable without session
+authRouter.post('/api/passwords/request', sendPasswordResetApi);
+authRouter.post('/api/passwords/reset', resetPasswordApi);
 
 // API KEYS
 authRouter.get('/api/me/keys', fetchUserKeysApi);