Password Reset

Goal

This snapshot advances Copperline Journal by teaching you to issue expiring one-use password reset links.

Every numbered folder is a complete app. Run this stage independently, then compare it with the previous folder to see the new responsibility clearly.

Prerequisites

Use Node.js 20 or newer, npm, and a terminal. You should recognize basic JavaScript functions, objects, and HTTP requests.

Port 3000 must be available. MongoDB snapshots use Docker locally; copy the example environment file before starting them.

• Node.js and npm installed
• A code editor and terminal
• Docker from part 4 onward

Concepts

A secure flow stores only a hash of a random token, gives it a short expiry, and returns the same response for known and unknown emails.

Keep responsibilities visible: middleware prepares requests, routes choose handlers, models protect data rules, and EJS views present escaped values.

Walkthrough

Generate a token, store its SHA-256 digest and expiry, send the raw token through Mailpit, then clear it after changing the password.

Read the example from input to output, then inspect the matching snapshot. The repository includes the surrounding setup and error handling.

const token = crypto.randomBytes(32).toString("hex");
user.resetTokenHash = crypto.createHash("sha256").update(token).digest("hex");

Run and verify

Enter 11-Password-Reset, install its dependencies, copy .env.example when present, and start the server.

Open http://localhost:3000. Keep the terminal visible so route, validation, and database errors can be connected to the browser action that caused them.

docker compose up -d
git clone https://github.com/michaeldunga1/fcc-express-blog.git
cd fcc-express-blog/11-Password-Reset
npm install
cp .env.example .env
npm start
# optional: npm run seed

Troubleshooting

If mail does not arrive, check SMTP_HOST, port 1025, and Mailpit at port 8025 before changing token logic.

A missing-module error usually means npm install ran in another snapshot. For database failures, check the container and that this folder uses its own Copperline database name.

• Read the first error first
• Restart after environment changes
• Never commit .env or node_modules

Try this

Request two links and verify your latest-token policy invalidates the older link.

Test a happy path and one invalid or unauthorized request. Useful applications return clear feedback without exposing secrets or stack traces.

• Make one small change
• Test it in the browser
• Compare with the next snapshot only after it works