feat: delete tokens when password is successfully reset

src/models/pnid.ts

@@ -12,6 +12,10 @@ import { DeviceSchema } from '@/models/device';
 import { uploadCDNAsset } from '@/util';
 import { LOG_ERROR, LOG_WARN } from '@/logger';
 import { config } from '@/config-manager';
+import { IndependentServiceToken } from '@/models/independent-service-token';
+import { NEXToken } from '@/models/nex-token';
+import { OAuthToken } from '@/models/oauth-token';
+import { PasswordResetToken } from '@/models/password-reset-token';
 import type { IPNID, IPNIDMethods, PNIDModel } from '@/types/mongoose/pnid';
 import type { PNIDPermissionFlag } from '@/types/common/permission-flags';
 
@@ -368,6 +372,15 @@ PNIDSchema.method('scrub', async function scrub() {
 	await this.save();
 });
 
+PNIDSchema.method('removeAllTokens', async function removeAllTokens() {
+	await Promise.all([
+		IndependentServiceToken.deleteMany({ pid: this.pid }),
+		NEXToken.deleteMany({ pid: this.pid }),
+		OAuthToken.deleteMany({ pid: this.pid }),
+		PasswordResetToken.deleteMany({ pid: this.pid })
+	]);
+});
+
 PNIDSchema.method('hasPermission', function hasPermission(flag: PNIDPermissionFlag): boolean {
 	return (this.permissions & flag) === flag;
 });

src/services/api/routes/v1/resetPassword.ts

@@ -173,6 +173,7 @@ router.post('/', async (request: express.Request, response: express.Response): P
 
 	pnid.password = passwordHash;
 
+	await pnid.removeAllTokens();
 	await pnid.save();
 
 	response.json({

src/services/grpc/api/v1/reset-password.ts

@@ -89,6 +89,7 @@ export async function resetPassword(request: ResetPasswordRequest): Promise<Empt
 
 	pnid.password = passwordHash;
 
+	await pnid.removeAllTokens();
 	await pnid.save();
 
 	return {};

src/services/grpc/api/v2/reset-password.ts

@@ -88,6 +88,7 @@ export async function resetPassword(request: ResetPasswordRequest): Promise<Rese
 
 	pnid.password = passwordHash;
 
+	await pnid.removeAllTokens();
 	await pnid.save();
 
 	return {};

src/services/nnas/routes/people.ts

@@ -650,6 +650,8 @@ router.put('/@me', async (request: express.Request, response: express.Response):
 		const passwordHash = await bcrypt.hash(primaryPasswordHash, 10);
 
 		pnid.password = passwordHash;
+
+		await pnid.removeAllTokens();
 	}
 
 	pnid.gender = gender;

src/types/mongoose/pnid.ts

@@ -85,6 +85,7 @@ export interface IPNIDMethods {
 	generateMiiImages(): Promise<void>;
 	markForDeletion(): void;
 	scrub(): Promise<void>;
+	removeAllTokens(): Promise<void>;
 	hasPermission(flag: PNIDPermissionFlag): boolean;
 	addPermission(flag: PNIDPermissionFlag): void;
 	clearPermission(flag: PNIDPermissionFlag): void;