Password reset emails that work once and expire soon.

# 1. In your app: token = 32 random bytes, store sha256(token) + expiry
# 2. Send the link. The idempotency key names this token, so a retry
#    cannot produce a second email.
curl -X POST https://app.usenotix.dev/api/v1/emails \
  -H "Authorization: Bearer $NOTIX_API_KEY" \
  -H "Idempotency-Key: reset-usr_123-tok_9f2a" \
  -H "Content-Type: application/json" \
  -d '{
    "from": "Acme <no-reply@acme.com>",
    "to": "user@example.com",
    "subject": "Reset your Acme password",
    "text": "Someone asked to reset the password for this Acme account.\n\nReset it here (the link works once and expires in 30 minutes):\nhttps://acme.com/reset?token=3b1f...\n\nIf that was not you, ignore this email. Your password has not changed.",
    "html": "<p>Someone asked to reset the password for this Acme account.</p><p><a href=\"https://acme.com/reset?token=3b1f...\">Reset your password</a> (works once, expires in 30 minutes).</p><p>If that was not you, ignore this email. Your password has not changed.</p>"
  }'

# 200 { "emailId": "eml_abc123" }

import { createHash, randomBytes } from "node:crypto";
import { Notix } from "notix-js";

const notix = new Notix(process.env.NOTIX_API_KEY);
const RESET_TTL_MS = 30 * 60 * 1000;

export async function requestPasswordReset(email: string) {
  const user = await db.user.findUnique({ where: { email } });
  // Same reply either way; only the found account gets an email.
  if (!user) return;

  const token = randomBytes(32).toString("base64url");
  const reset = await db.passwordReset.create({
    data: {
      userId: user.id,
      tokenHash: createHash("sha256").update(token).digest("hex"),
      expiresAt: new Date(Date.now() + RESET_TTL_MS),
    },
  });

  const { data, error } = await notix.emails.send(
    {
      from: "Acme <no-reply@acme.com>",
      to: user.email,
      templateId: "tpl_password_reset",
      variables: {
        resetUrl: `https://acme.com/reset?token=${token}`,
        expiresMinutes: "30",
      },
    },
    { idempotencyKey: `reset-${user.id}-${reset.id}` },
  );

  if (error) {
    // Log it against the user; the request still returns the neutral reply.
    logger.error({ userId: user.id, error }, "reset email failed");
    return;
  }
  await db.passwordReset.update({ where: { id: reset.id }, data: { emailId: data.emailId } });
}

import hashlib
import os
import secrets
from datetime import datetime, timedelta, timezone

from notix import Notix

notix = Notix(os.environ["NOTIX_API_KEY"])
RESET_TTL = timedelta(minutes=30)


def request_password_reset(email: str) -> None:
    user = db.users.find_by_email(email)
    # Same reply either way; only the found account gets an email.
    if user is None:
        return

    token = secrets.token_urlsafe(32)
    reset = db.password_resets.create(
        user_id=user.id,
        token_hash=hashlib.sha256(token.encode()).hexdigest(),
        expires_at=datetime.now(timezone.utc) + RESET_TTL,
    )

    data, error = notix.emails.send(
        payload={
            "from": "Acme <no-reply@acme.com>",
            "to": user.email,
            "templateId": "tpl_password_reset",
            "variables": {
                "resetUrl": f"https://acme.com/reset?token={token}",
                "expiresMinutes": "30",
            },
        },
        options={"idempotency_key": f"reset-{user.id}-{reset.id}"},
    )

    if error:
        logger.error("reset email failed", user_id=user.id, error=error)
        return
    db.password_resets.update(reset.id, email_id=data["emailId"])

// POST /reset  { token, newPassword }
export async function completePasswordReset(token: string, newPassword: string) {
  const tokenHash = createHash("sha256").update(token).digest("hex");

  // One transaction: find a live token, spend it, change the password.
  const changed = await db.$transaction(async (tx) => {
    const reset = await tx.passwordReset.findFirst({
      where: { tokenHash, usedAt: null, expiresAt: { gt: new Date() } },
    });
    if (!reset) return false;

    await tx.passwordReset.update({ where: { id: reset.id }, data: { usedAt: new Date() } });
    await tx.user.update({
      where: { id: reset.userId },
      data: { passwordHash: await hashPassword(newPassword) },
    });
    // Every other session for this user ends here.
    await tx.session.deleteMany({ where: { userId: reset.userId } });
    return true;
  });

  if (!changed) throw new ResetError("This link has expired or was already used.");
}

# POST /reset  { token, newPassword }
def complete_password_reset(token: str, new_password: str) -> None:
    token_hash = hashlib.sha256(token.encode()).hexdigest()

    # One transaction: find a live token, spend it, change the password.
    with db.transaction():
        reset = db.password_resets.find_live(token_hash)  # used_at IS NULL AND expires_at > now()
        if reset is None:
            raise ResetError("This link has expired or was already used.")

        db.password_resets.mark_used(reset.id)
        db.users.set_password(reset.user_id, hash_password(new_password))
        # Every other session for this user ends here.
        db.sessions.delete_for_user(reset.user_id)