From 6a02c328bc9f4df395ab95c157a032b8dc1faca8 Mon Sep 17 00:00:00 2001
From: Jonathan Barrow <jonbarrow1998@gmail.com>
Date: Wed, 15 Jul 2026 16:58:46 -0400
Subject: [PATCH] feat: delete tokens when password is successfully reset

---
 src/models/pnid.ts                          | 13 +++++++++++++
 src/services/api/routes/v1/resetPassword.ts |  1 +
 src/services/grpc/api/v1/reset-password.ts  |  1 +
 src/services/grpc/api/v2/reset-password.ts  |  1 +
 src/services/nnas/routes/people.ts          |  2 ++
 src/types/mongoose/pnid.ts                  |  1 +
 6 files changed, 19 insertions(+)

diff --git a/src/models/pnid.ts b/src/models/pnid.ts
index 142de96..e15dcf8 100644
--- a/src/models/pnid.ts
+++ b/src/models/pnid.ts
@@ -12,6 +12,10 @@ import { DeviceSchema } from '@/models/device';
 import { uploadCDNAsset } from '@/util';
 import { LOG_ERROR, LOG_WARN } from '@/logger';
 import { config } from '@/config-manager';
+import { IndependentServiceToken } from '@/models/independent-service-token';
+import { NEXToken } from '@/models/nex-token';
+import { OAuthToken } from '@/models/oauth-token';
+import { PasswordResetToken } from '@/models/password-reset-token';
 import type { IPNID, IPNIDMethods, PNIDModel } from '@/types/mongoose/pnid';
 import type { PNIDPermissionFlag } from '@/types/common/permission-flags';
 
@@ -368,6 +372,15 @@ PNIDSchema.method('scrub', async function scrub() {
 	await this.save();
 });
 
+PNIDSchema.method('removeAllTokens', async function removeAllTokens() {
+	await Promise.all([
+		IndependentServiceToken.deleteMany({ pid: this.pid }),
+		NEXToken.deleteMany({ pid: this.pid }),
+		OAuthToken.deleteMany({ pid: this.pid }),
+		PasswordResetToken.deleteMany({ pid: this.pid })
+	]);
+});
+
 PNIDSchema.method('hasPermission', function hasPermission(flag: PNIDPermissionFlag): boolean {
 	return (this.permissions & flag) === flag;
 });
diff --git a/src/services/api/routes/v1/resetPassword.ts b/src/services/api/routes/v1/resetPassword.ts
index 5d83a88..5d4ebdf 100644
--- a/src/services/api/routes/v1/resetPassword.ts
+++ b/src/services/api/routes/v1/resetPassword.ts
@@ -173,6 +173,7 @@ router.post('/', async (request: express.Request, response: express.Response): P
 
 	pnid.password = passwordHash;
 
+	await pnid.removeAllTokens();
 	await pnid.save();
 
 	response.json({
diff --git a/src/services/grpc/api/v1/reset-password.ts b/src/services/grpc/api/v1/reset-password.ts
index 39058d8..2ed2e5c 100644
--- a/src/services/grpc/api/v1/reset-password.ts
+++ b/src/services/grpc/api/v1/reset-password.ts
@@ -89,6 +89,7 @@ export async function resetPassword(request: ResetPasswordRequest): Promise<Empt
 
 	pnid.password = passwordHash;
 
+	await pnid.removeAllTokens();
 	await pnid.save();
 
 	return {};
diff --git a/src/services/grpc/api/v2/reset-password.ts b/src/services/grpc/api/v2/reset-password.ts
index f43cc90..8984c1c 100644
--- a/src/services/grpc/api/v2/reset-password.ts
+++ b/src/services/grpc/api/v2/reset-password.ts
@@ -88,6 +88,7 @@ export async function resetPassword(request: ResetPasswordRequest): Promise<Rese
 
 	pnid.password = passwordHash;
 
+	await pnid.removeAllTokens();
 	await pnid.save();
 
 	return {};
diff --git a/src/services/nnas/routes/people.ts b/src/services/nnas/routes/people.ts
index 933ece1..7c1c614 100644
--- a/src/services/nnas/routes/people.ts
+++ b/src/services/nnas/routes/people.ts
@@ -650,6 +650,8 @@ router.put('/@me', async (request: express.Request, response: express.Response):
 		const passwordHash = await bcrypt.hash(primaryPasswordHash, 10);
 
 		pnid.password = passwordHash;
+
+		await pnid.removeAllTokens();
 	}
 
 	pnid.gender = gender;
diff --git a/src/types/mongoose/pnid.ts b/src/types/mongoose/pnid.ts
index c288f4b..17a9194 100644
--- a/src/types/mongoose/pnid.ts
+++ b/src/types/mongoose/pnid.ts
@@ -85,6 +85,7 @@ export interface IPNIDMethods {
 	generateMiiImages(): Promise<void>;
 	markForDeletion(): void;
 	scrub(): Promise<void>;
+	removeAllTokens(): Promise<void>;
 	hasPermission(flag: PNIDPermissionFlag): boolean;
 	addPermission(flag: PNIDPermissionFlag): void;
 	clearPermission(flag: PNIDPermissionFlag): void;