Admins choose their own passwords: invite links, forgot password, change password

Author: adityakumar43

backend/middleware/activity.js

@@ -67,7 +67,8 @@ function describe(section, method, part, body = {}, last = '') {
             return null
         case 'admins':
             if (method === 'POST' && part === 'reset-2fa') return ['security', 'reset two-step login for']
-            if (method === 'POST') return ['create', 'added the team member']
+            if (method === 'POST' && part === 'send-link') return ['email', 'sent a set-password link to']
+            if (method === 'POST' && !part) return ['create', 'added the team member']
             if (method === 'DELETE') return ['delete', 'deleted the account of']
             if ((body.state || body.district) && !body.role) return ['role', 'changed the area of']
             if (body.role) return ['role', `changed the role to ${ROLE_NAMES[body.role] || 'another role'} for`]

backend/models/Admin.js

@@ -19,6 +19,12 @@ const adminSchema = new mongoose.Schema(
     twoFactorPending: { type: String, select: false },
     twoFactorLastStep: { type: Number, default: 0 },
     seenDonationsAt: Date,
+    // false while a new team member has not chosen their own password yet (they were sent a link)
+    passwordSet: { type: Boolean, default: true },
+    // A one-time link to choose a password (new account, or a forgotten password). Only a scrambled copy is kept.
+    setupTokenHash: { type: String, select: false, index: true, sparse: true },
+    setupTokenExpires: { type: Date, select: false },
+    setupLinkAt: { type: Date, select: false }, // when the last link was made (stops a flood of emails)
   },
   { timestamps: true }
 )

backend/routes/admins.js

@@ -7,6 +7,7 @@ import { ROLES, can } from '../config/roles.js'
 import { STATE_CODES } from '../config/states.js'
 import { canonicalDistrict } from '../config/districts.js'
 import LoginLock from '../models/LoginLock.js'
+import { makeLink, emailLink, INVITE_HOURS, RESET_HOURS } from '../services/passwordLinks.js'
 
 // Team & roles. Super admins manage everyone. A State admin manages only the District admins of their own state.
 const router = Router()
@@ -15,8 +16,18 @@ router.use(protect, requirePermission('team'))
 const view = (a) => ({
   id: a._id, name: a.name, email: a.email, role: a.role, active: a.active !== false, createdAt: a.createdAt,
   twoFactorEnabled: a.twoFactorEnabled === true, state: a.state || null, district: a.district || null,
+  passwordSet: a.passwordSet !== false, // false: invited, has not chosen a password yet
 })
 
+// Emails a set-password link. Also gives the link itself, so it can be sent on WhatsApp if the email does not arrive.
+async function sendLink(admin, kind) {
+  const hours = kind === 'invite' ? INVITE_HOURS : RESET_HOURS * 24 // a link sent by the team works for a day
+  const url = await makeLink(admin._id, hours)
+  let emailed = false
+  try { emailed = await emailLink(admin, url, kind, hours) } catch (err) { console.error('Password link email failed:', err.message) }
+  return { link: url, emailed, hours }
+}
+
 // A State admin needs a state; a District admin needs a state and one of its districts; every other role has neither
 const NEED_STATE = 'Choose the state this person will look after'
 const NEED_DISTRICT = 'Choose the district this District admin will look after'
@@ -57,16 +68,23 @@ router.post('/', async (req, res) => {
   const state = limited(req) ? req.admin.state : req.body?.state
   if (!name || !String(name).trim()) return res.status(400).json({ message: 'Enter a name' })
   if (!/^\S+@\S+\.\S+$/.test(email || '')) return res.status(400).json({ message: 'Enter a valid email address' })
-  if (!password || String(password).length < 8) {
+  // No password: the new member gets a link by email and chooses their own (nobody else ever knows it).
+  // A password typed here still works, for when email is not available.
+  const invite = password === undefined || password === null || password === ''
+  if (!invite && String(password).length < 8) {
     return res.status(400).json({ message: 'Password must be at least 8 characters' })
   }
   if (!ROLES[role]) return res.status(400).json({ message: 'Choose a role' })
   const where = area(role, state, req.body?.district)
   if (where.problem) return res.status(400).json({ message: where.problem })
 
   try {
-    const admin = await Admin.create({ name: String(name).trim(), email, password, role, state: where.state, district: where.district })
-    res.status(201).json(view(admin))
+    const admin = await Admin.create({
+      name: String(name).trim(), email, role, state: where.state, district: where.district,
+      // Until they choose one, the account has a long random password that nobody knows
+      password: invite ? crypto.randomBytes(32).toString('hex') : password, passwordSet: !invite,
+    })
+    res.status(201).json({ ...view(admin), ...(invite ? await sendLink(admin, 'invite') : {}) })
   } catch (err) {
     if (err.code === 11000) return res.status(409).json({ message: 'An account with this email already exists' })
     throw err
@@ -118,6 +136,15 @@ router.patch('/:id', ownPasswordTries, async (req, res) => {
   res.json(view(target))
 })
 
+// A new set-password link for someone in the team: a new member whose first link ran out, or someone who forgot their password
+router.post('/:id/send-link', async (req, res) => {
+  const target = await Admin.findById(req.params.id).catch(() => null)
+  if (!target || !mine(req, target)) return res.status(404).json({ message: 'Not found' })
+  if (target._id.equals(req.admin._id)) return res.status(400).json({ message: 'Change your own password on the Security page' })
+  if (target.active === false) return res.status(400).json({ message: 'Enable this account first' })
+  res.json({ ...view(target), ...(await sendLink(target, target.passwordSet === false ? 'invite' : 'reset')) })
+})
+
 router.post('/:id/reset-2fa', async (req, res) => {
   const target = await Admin.findById(req.params.id).catch(() => null)
   if (!target || !mine(req, target)) return res.status(404).json({ message: 'Not found' })

backend/routes/auth.js

@@ -13,6 +13,7 @@ import { recordLogin } from '../services/loginlog.js'
 import bcrypt from 'bcryptjs'
 import LoginLock from '../models/LoginLock.js'
 import KnownDevice from '../models/KnownDevice.js'
+import { makeLink, adminForToken, usePasswordLink, emailLink, RESET_HOURS } from '../services/passwordLinks.js'
 
 const router = Router()
 
@@ -216,4 +217,59 @@ router.post('/2fa/disable', limiter(10), protect, async (req, res) => {
   res.json({ ok: true })
 })
 
+// ----- Passwords -----
+
+// Change your own password (every admin, from the Security page): needs the current one
+router.post('/password', limiter(10), protect, async (req, res) => {
+  const { currentPassword, newPassword } = req.body || {}
+  if (String(newPassword || '').length < 8) return res.status(400).json({ message: 'The new password must be at least 8 characters' })
+  if (String(newPassword).length > 200) return res.status(400).json({ message: 'The new password is too long' })
+  const admin = await Admin.findById(req.admin._id).select('+password')
+  if (!(await admin.matchPassword(String(currentPassword || '')))) return res.status(400).json({ message: 'Your current password is not correct' })
+  if (await admin.matchPassword(String(newPassword))) return res.status(400).json({ message: 'The new password must be different from the current one' })
+  admin.password = String(newPassword)
+  admin.passwordSet = true
+  await admin.save() // the session in use stays: with one session per account, it is this one
+  recordLogin(req, { admin, success: true, reason: 'changed their own password' })
+  res.json({ ok: true })
+})
+
+// "Forgot password?" on the login page: emails a link to choose a new password.
+// The answer is the same whether or not the email belongs to an admin, and comes at once (the email is sent
+// afterwards), so this cannot be used to find out who the admins are.
+router.post('/forgot', limiter(5), async (req, res) => {
+  const email = String(req.body?.email || '').trim().toLowerCase().slice(0, 200)
+  res.json({ ok: true })
+  try {
+    if (!/^\S+@\S+\.\S+$/.test(email)) return
+    const admin = await Admin.findOne({ email }).select('+setupLinkAt')
+    if (!admin || admin.active === false) return
+    if (admin.setupLinkAt && Date.now() - admin.setupLinkAt < 2 * 60e3) return // one email every 2 minutes at most
+    const url = await makeLink(admin._id, RESET_HOURS)
+    await emailLink(admin, url, 'reset')
+    recordLogin(req, { admin, success: false, reason: 'asked for a "forgot password" link' })
+  } catch (err) {
+    console.error('Forgot-password email failed:', err.message)
+  }
+})
+
+// The set-password page checks its link first, to greet the person by name
+router.post('/set-password/check', limiter(20), async (req, res) => {
+  const admin = await adminForToken(req.body?.token)
+  if (!admin) return res.status(410).json({ message: 'This link has expired or was already used. Ask for a new one.' })
+  res.json({ name: admin.name, email: admin.email, isNew: admin.passwordSet === false })
+})
+
+// Saves the password chosen through the link. Two-step login (if on) is still asked for at the next login.
+router.post('/set-password', limiter(20), async (req, res) => {
+  const password = String(req.body?.password || '')
+  if (password.length < 8) return res.status(400).json({ message: 'The password must be at least 8 characters' })
+  if (password.length > 200) return res.status(400).json({ message: 'The password is too long' })
+  const admin = await adminForToken(req.body?.token)
+  if (!admin) return res.status(410).json({ message: 'This link has expired or was already used. Ask for a new one.' })
+  await usePasswordLink(admin, password)
+  recordLogin(req, { admin, success: true, reason: 'chose a password with an emailed link' })
+  res.json({ ok: true, email: admin.email })
+})
+
 export default router

backend/services/passwordLinks.js

@@ -0,0 +1,65 @@
+import crypto from 'crypto'
+import Admin from '../models/Admin.js'
+import LoginLock from '../models/LoginLock.js'
+import { sendMail } from './mailer.js'
+import { esc, button } from './emailLayout.js'
+import { ORG } from '../config/org.js'
+
+// One-time links to choose a password: for a new team member (instead of the super admin making up a password
+// and passing it on), and for an admin who forgot theirs. The link holds a long random code; only a scrambled
+// copy (sha256) is saved, so even someone who reads the database cannot use it. It works once, for a limited time.
+
+export const INVITE_HOURS = 72 // a new team member has 3 days to open their link
+export const RESET_HOURS = 1 // a "forgot password" link works for 1 hour
+
+export const hashToken = (token) => crypto.createHash('sha256').update(String(token)).digest('hex')
+const site = () => (process.env.CLIENT_URL || '').trim().replace(/\/+$/, '').replace('://www.', '://')
+
+// A new link for this admin (any older link stops working). Gives the address to open.
+export async function makeLink(adminId, hours) {
+    const token = crypto.randomBytes(32).toString('hex')
+    await Admin.updateOne({ _id: adminId }, {
+        $set: { setupTokenHash: hashToken(token), setupTokenExpires: new Date(Date.now() + hours * 3600e3), setupLinkAt: new Date() },
+    })
+    return `${site()}/admin/set-password?t=${token}`
+}
+
+// The admin a link belongs to, if it is still valid
+export async function adminForToken(token) {
+    if (!/^[a-f0-9]{64}$/.test(String(token || ''))) return null
+    const admin = await Admin.findOne({ setupTokenHash: hashToken(token), setupTokenExpires: { $gt: new Date() } })
+        .select('+password +setupTokenHash +setupTokenExpires')
+    return admin && admin.active !== false ? admin : null
+}
+
+// Saves the chosen password and uses up the link. Logs the account out everywhere and clears wrong-try locks.
+export async function usePasswordLink(admin, password) {
+    admin.password = password
+    admin.passwordSet = true
+    admin.sessionId = crypto.randomUUID()
+    admin.setupTokenHash = undefined
+    admin.setupTokenExpires = undefined
+    await admin.save()
+    await LoginLock.deleteMany({ $or: [{ _id: { $regex: `^${admin._id}:` } }, { _id: `acct:${admin._id}` }] })
+}
+
+// Emails the link. true when the mail server took it, false when email is not set up (throws if sending failed).
+export function emailLink(admin, url, kind, hours = kind === 'invite' ? INVITE_HOURS : RESET_HOURS) {
+    const invite = kind === 'invite'
+    const valid = hours >= 24 ? `${hours / 24} days` : `${hours} hour${hours === 1 ? '' : 's'}`
+    const subject = invite ? `You have been added to the ${ORG.name} admin team` : `Choose a new password for ${ORG.name}`
+    const intro = invite
+        ? `You have been added to the ${ORG.name} admin team. Choose your own password to start. Nobody else knows it, not even the person who added you.`
+        : 'Someone (hopefully you) asked to choose a new password for your admin account.'
+    const outro = invite ? '' : 'If you did not ask for this, ignore this email: your password stays as it is.'
+    return sendMail({
+        to: admin.email,
+        subject,
+        text: `Jai Bhim ${admin.name},\n\n${intro}\n\nChoose your password here (the link works for ${valid}, once):\n${url}\n\nYour login email: ${admin.email}\n\n${outro}\n\n— ${ORG.name}`.replace(/\n{3,}/g, '\n\n'),
+        html: `<p>जय भीम <b>${esc(admin.name)}</b>,</p>
+<p>${esc(intro)}</p>
+${button(invite ? 'Choose my password / अपना पासवर्ड चुनें' : 'Choose a new password / नया पासवर्ड चुनें', url)}
+<p style="color:#555;font-size:13px">The link works for ${valid}, once. Your login email: <b>${esc(admin.email)}</b></p>
+${outro ? `<p style="color:#555;font-size:13px">${esc(outro)}</p>` : ''}`,
+    })
+}

frontend/src/App.jsx

@@ -44,6 +44,7 @@ const Donate = page(() => import('./pages/Donate.jsx'))
 const Receipt = page(() => import('./pages/Receipt.jsx'))
 const Card = page(() => import('./pages/Card.jsx'))
 const Login = page(() => import('./pages/admin/Login.jsx'))
+const SetPassword = page(() => import('./pages/admin/SetPassword.jsx'))
 const AdminLayout = page(() => import('./pages/admin/AdminLayout.jsx'))
 const Overview = page(() => import('./pages/admin/Overview.jsx'))
 const Content = page(() => import('./pages/admin/Content.jsx'))
@@ -132,6 +133,7 @@ export default function App() {
             <Route path="/unsubscribe/:token" element={<Unsubscribe />} />
 
             <Route path="/admin/login" element={<Login />} />
+            <Route path="/admin/set-password" element={<SetPassword />} />
             <Route path="/admin" element={<ProtectedRoute><SessionWatch /><AdminLayout /></ProtectedRoute>}>
               <Route index element={<Overview />} />
               <Route path="news" element={<Perm perm="content"><Content key="news" kind="news" /></Perm>} />

frontend/src/pages/admin/Login.jsx

@@ -18,6 +18,23 @@ export default function Login() {
   const [busy, setBusy] = useState(false)
   const [show, setShow] = useState(false)
   const [notice] = useState(() => { try { return sessionStorage.getItem('loginNotice') || '' } catch { return '' } })
+  const [forgot, setForgot] = useState(false) // "Forgot password?": ask for a link by email
+  const [forgotSent, setForgotSent] = useState(false)
+
+  async function askLink(e) {
+    e.preventDefault()
+    setBusy(true)
+    setError('')
+    try {
+      await api.post('/auth/forgot', { email: form.email })
+      setForgotSent(true)
+    } catch (err) {
+      setError(err.message)
+    } finally {
+      setBusy(false)
+    }
+  }
+  const backToLogin = () => { setForgot(false); setForgotSent(false); setError('') }
 
   async function submit(e) {
     e.preventDefault()
@@ -64,8 +81,35 @@ export default function Login() {
           </div>
         </div>
 
-        {notice && <p role="status" className="mb-3 rounded-xl border border-gold/50 bg-gold/10 px-3 py-2 text-sm text-navy">{notice}</p>}
+        {notice && !forgot && <p role="status" className="mb-3 rounded-xl border border-gold/50 bg-gold/10 px-3 py-2 text-sm text-navy">{notice}</p>}
 
+        {forgot ? (
+          forgotSent ? (
+            <div role="status" className="flex flex-col gap-3">
+              <p className="rounded-xl border border-green-200 bg-green-50 p-3 text-green-900">
+                📧 If <b>{form.email}</b> belongs to an admin account, we have sent it a link to choose a new password. It works for 1 hour.
+              </p>
+              <p className="text-sm text-navy/70">No email after a few minutes? Check the spam folder, or ask a super admin to send you a link from the Team page.</p>
+              <button type="button" onClick={backToLogin} className="btn w-full rounded-xl border-2 border-brand text-brand hover:bg-mist">← Back to login</button>
+            </div>
+          ) : (
+            <form onSubmit={askLink} className="flex flex-col gap-3">
+              <p className="text-navy/80">Enter your login email. We will send you a link to choose a new password.</p>
+              <label className="flex flex-col gap-1 font-semibold">Email
+                <div className="relative">
+                  <Icon name="mail" size={18} className="pointer-events-none absolute top-1/2 left-3.5 -translate-y-1/2 text-navy/65" />
+                  <input type="email" required autoFocus autoComplete="username" value={form.email} placeholder="you@example.com"
+                    onChange={(e) => setForm({ ...form, email: e.target.value })} className="input pl-11" />
+                </div>
+              </label>
+              {error && <p role="alert" className="border border-red-300 bg-red-50 p-3 text-red-900">{error}</p>}
+              <button disabled={busy} className="btn w-full gap-2 rounded-xl bg-brand text-white shadow-md transition hover:bg-navy disabled:opacity-60">
+                {busy ? 'Please wait...' : <>Send me a link <Icon name="mail" size={18} /></>}
+              </button>
+              <button type="button" onClick={backToLogin} className="text-brand underline">Back to login</button>
+            </form>
+          )
+        ) : (
         <form onSubmit={submit} className="flex flex-col gap-3">
           {challenge ? (
             <label className="flex flex-col gap-1 font-semibold">
@@ -104,7 +148,13 @@ export default function Login() {
               Back
             </button>
           )}
+          {!challenge && (
+            <button type="button" onClick={() => { setForgot(true); setError('') }} className="text-sm font-semibold text-brand underline">
+              Forgot password?
+            </button>
+          )}
         </form>
+        )}
         <Link to="/" className="mt-3 flex items-center justify-center gap-1 text-sm font-semibold text-navy/65 hover:text-brand">← Back to the website</Link>
       </div>
     </div>