From c1a885602d1a0c0abff2aca099c714cfd1494dd2 Mon Sep 17 00:00:00 2001
From: limes <git@limes.pink>
Date: Sat, 29 Aug 2026 19:57:07 +0200
Subject: [PATCH] feat: send password change notice on every endpoint

---
 src/services/api/routes/v1/resetPassword.ts | 4 +++-
 src/services/grpc/api/v1/reset-password.ts  | 4 +++-
 src/services/grpc/api/v2/reset-password.ts  | 4 +++-
 src/services/nnas/routes/people.ts          | 3 ++-
 4 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/src/services/api/routes/v1/resetPassword.ts b/src/services/api/routes/v1/resetPassword.ts
index 1b1f1ce..5132ddd 100644
--- a/src/services/api/routes/v1/resetPassword.ts
+++ b/src/services/api/routes/v1/resetPassword.ts
@@ -2,7 +2,7 @@ import crypto from 'node:crypto';
 import express from 'express';
 import bcrypt from 'bcrypt';
 import { PasswordResetToken } from '@/models/password-reset-token';
-import { nintendoPasswordHash } from '@/util';
+import { nintendoPasswordHash, sendPasswordResetNoticeEmail } from '@/util';
 import { SystemType } from '@/types/common/system-types';
 import { TokenType } from '@/types/common/token-types';
 import { getPNIDByPID } from '@/database';
@@ -177,6 +177,8 @@ router.post('/', passwordResetRatelimit, async (request: express.Request, respon
 	await pnid.removeAllTokens();
 	await pnid.save();
 
+	await sendPasswordResetNoticeEmail(pnid);
+
 	response.json({
 		app: 'api',
 		status: 200
diff --git a/src/services/grpc/api/v1/reset-password.ts b/src/services/grpc/api/v1/reset-password.ts
index 2ed2e5c..a62047f 100644
--- a/src/services/grpc/api/v1/reset-password.ts
+++ b/src/services/grpc/api/v1/reset-password.ts
@@ -2,7 +2,7 @@ import crypto from 'node:crypto';
 import bcrypt from 'bcrypt';
 import { Status, ServerError } from 'nice-grpc';
 import { PasswordResetToken } from '@/models/password-reset-token';
-import { nintendoPasswordHash } from '@/util';
+import { nintendoPasswordHash, sendPasswordResetNoticeEmail } from '@/util';
 import { getPNIDByPID } from '@/database';
 import { SystemType } from '@/types/common/system-types';
 import { TokenType } from '@/types/common/token-types';
@@ -92,5 +92,7 @@ export async function resetPassword(request: ResetPasswordRequest): Promise<Empt
 	await pnid.removeAllTokens();
 	await pnid.save();
 
+	await sendPasswordResetNoticeEmail(pnid);
+
 	return {};
 }
diff --git a/src/services/grpc/api/v2/reset-password.ts b/src/services/grpc/api/v2/reset-password.ts
index 8984c1c..ceebe70 100644
--- a/src/services/grpc/api/v2/reset-password.ts
+++ b/src/services/grpc/api/v2/reset-password.ts
@@ -2,7 +2,7 @@ import crypto from 'node:crypto';
 import bcrypt from 'bcrypt';
 import { Status, ServerError } from 'nice-grpc';
 import { PasswordResetToken } from '@/models/password-reset-token';
-import { nintendoPasswordHash } from '@/util';
+import { nintendoPasswordHash, sendPasswordResetNoticeEmail } from '@/util';
 import { getPNIDByPID } from '@/database';
 import { SystemType } from '@/types/common/system-types';
 import { TokenType } from '@/types/common/token-types';
@@ -91,5 +91,7 @@ export async function resetPassword(request: ResetPasswordRequest): Promise<Rese
 	await pnid.removeAllTokens();
 	await pnid.save();
 
+	await sendPasswordResetNoticeEmail(pnid);
+
 	return {};
 }
diff --git a/src/services/nnas/routes/people.ts b/src/services/nnas/routes/people.ts
index 476ac9e..16d30b3 100644
--- a/src/services/nnas/routes/people.ts
+++ b/src/services/nnas/routes/people.ts
@@ -6,7 +6,7 @@ import moment from 'moment';
 import deviceCertificateMiddleware from '@/middleware/device-certificate';
 import { deviceRatelimit } from '@/middleware/ratelimit';
 import { connection as databaseConnection, doesPNIDExist, getPNIDProfileJSONByPID } from '@/database';
-import { getAgeFromDate, getValueFromHeaders, nintendoPasswordHash, sendConfirmationEmail, sendPNIDDeletedEmail } from '@/util';
+import { getAgeFromDate, getValueFromHeaders, nintendoPasswordHash, sendConfirmationEmail, sendPNIDDeletedEmail, sendPasswordResetNoticeEmail } from '@/util';
 import IP2LocationManager from '@/ip2location';
 import { PNID } from '@/models/pnid';
 import { NEXAccount } from '@/models/nex-account';
@@ -652,6 +652,7 @@ router.put('/@me', async (request: express.Request, response: express.Response):
 		pnid.password = passwordHash;
 
 		await pnid.removeAllTokens();
+		await sendPasswordResetNoticeEmail(pnid);
 	}
 
 	pnid.gender = gender;