implement the actual resetting endpoint

app/controllers/auth.controller.js

@@ -100,7 +100,7 @@ exports.resetPasswordEmail = async (req, res, next) => {
 			user = await sequelize.query(
 				`
 			SELECT id FROM organizations
-			WHERE email = :email`,
+			WHERE primary_contact_email = :email`,
 				{
 					type: sequelize.QueryTypes.SELECT,
 					replacements: { email }
@@ -109,10 +109,7 @@ exports.resetPasswordEmail = async (req, res, next) => {
 		}
 		user = user[0];
 
-		if (!user)
-			return res.status(400).json({
-				message: 'User not found'
-			});
+		if (!user) return next(errorMaker(400, 'Not a valid user'));
 
 		const CODE = uuidv4();
 		const currDate = new Date();
@@ -146,7 +143,8 @@ exports.resetPasswordEmail = async (req, res, next) => {
 			}
 		);
 
-		sendgrid.passwordResetEmail(email, CODE);
+		await sendgrid.passwordResetEmail(email, CODE);
+
 		return res
 			.status(200)
 			.json({ message: 'Successfuly sent password reset email!' });
@@ -154,3 +152,70 @@ exports.resetPasswordEmail = async (req, res, next) => {
 		next(e);
 	}
 };
+
+exports.resetPassword = async (req, res, next) => {
+	try {
+		const { password, code } = req.query;
+
+		var passwordResetRow = await sequelize.query(
+			`
+			SELECT * FROM password_reset
+			WHERE code = :code`,
+			{
+				type: sequelize.QueryTypes.SELECT,
+				replacements: { code }
+			}
+		);
+
+		if (!passwordResetRow.length)
+			return next(errorMaker(400, 'Forbidden to reset password'));
+
+		passwordResetRow = passwordResetRow[0];
+
+		//TODO check the timestamp of the code creation
+		const createdDate = new Date(passwordResetRow.created_at);
+		const currDate = new Date();
+		const diffTime = Math.abs(currDate.getTime() - createdDate.getTime());
+		const diffDays = Math.ceil(diffTime / (1000 * 60 * 60 * 24));
+
+		if (diffDays > 3) return next(errorMaker(400, 'Code expired'));
+
+		const hashedPass = bcrypt.hashSync(password);
+
+		if (passwordResetRow.user_type == 'donor') {
+			await sequelize.query(
+				`
+				UPDATE donors
+				SET password = :password
+				WHERE id = :user_id
+				`,
+				{
+					type: sequelize.QueryTypes.UPDATE,
+					replacements: {
+						password: hashedPass,
+						user_id: passwordResetRow.user_id
+					}
+				}
+			);
+		} else {
+			await sequelize.query(
+				`
+				UPDATE organizations
+				SET password = :password
+				WHERE id = :user_id
+				`,
+				{
+					type: sequelize.QueryTypes.UPDATE,
+					replacements: {
+						password: hashedPass,
+						user_id: passwordResetRow.user_id
+					}
+				}
+			);
+		}
+
+		return res.status(200).json({ message: 'Successfuly reset password!' });
+	} catch (e) {
+		next(e);
+	}
+};

app/controllers/sendgrid.controller.js

@@ -86,17 +86,19 @@ exports.passwordResetEmail = async (receiver, code) => {
 			const msg = {
 				to: receiver,
 				from: { email: '[email protected]', name: 'UCharify Security' },
-				template_id: 'd-569f804f5e7749cba66bac1994607280',
+				template_id: 'd-f26ce08089914f3a983f8932913ed262',
 
 				substitutionWrappers: ['{{', '}}'],
 				dynamic_template_data: {
-					reset_link: `${process.env.WEB_CLIENT}/resetpassword/form`,
+					reset_link: `${
+						process.env.WEB_CLIENT
+					}/resetpassword/form?code=${code}`,
 					subject: 'Reset Your Password'
 				}
 			};
 			const sentRes = await sgMail.send(msg);
 
-			resolve();
+			resolve(sentRes);
 		} catch (e) {
 			reject(e);
 		}

app/routes/auth.route.js

@@ -14,6 +14,6 @@ router.post('/org/login', auth.orgLogin);
 router.get('/resetpassword', auth.resetPasswordEmail);
 
 // Reset password for either donor or charity after verifying code
-router.post('/resetpassword', auth.resetPasswordEmail);
+router.post('/resetpassword', auth.resetPassword);
 
 module.exports = router;

models/PasswordReset.js

@@ -4,24 +4,24 @@ module.exports = (sequelize, DataTypes) => {
 		'password_reset',
 		{
 			code: {
-				type: Sequelize.STRING,
+				type: DataTypes.STRING,
 				allowNull: false
 			},
 			user_id: {
-				type: Sequelize.UUID,
+				type: DataTypes.UUID,
 				allowNull: false
 			},
 			user_type: {
-				type: Sequelize.STRING,
+				type: DataTypes.STRING,
 				allowNull: false
 			},
 			created_at: {
 				allowNull: false,
-				type: Sequelize.DATE
+				type: DataTypes.DATE
 			},
 			updated_at: {
 				allowNull: false,
-				type: Sequelize.DATE
+				type: DataTypes.DATE
 			}
 		},
 		{}