always return 204 for password reset. update swagger file

models/user.js

@@ -423,7 +423,9 @@ UserService.createPasswordResetToken = function (email) {
     .then(user => {
 
       if (user === null) {
-        return Promise.reject(`Uh oh! We've never heard of ${email}. Maybe there's a typo in there?`);
+        // since we don't want to reveal that the email does/doesn't exist
+        // just go ahead and resolve the Promise with null and check in the endpoint
+        return Promise.resolve(null);
       }
 
       const payload = {email, jti: uuid.v4(), userId: user.id, version: user.__v};

routes/api/user/index.js

@@ -93,6 +93,10 @@ router.post('/request-password-reset', (req, res, next) => {
   User
     .createPasswordResetToken(email)
     .then(token => {
+      if (token === null) {
+        return Promise.resolve('the email was not found in the db.');
+      }
+
       const options = {
         subject: 'Password Reset Requested - Talk',
         from: 'noreply@coralproject.net',
@@ -106,7 +110,9 @@ router.post('/request-password-reset', (req, res, next) => {
       return mailer.sendSimple(options);
     })
     .then(() => {
-      res.json({success: true});
+      // we want to send a 204 regardless of the user being found in the db
+      // if we fail on missing emails, it would reveal if people are registered or not.
+      res.status(204).send('OK');
     })
     .catch(error => {
       const errorMsg = typeof error === 'string' ? error : error.message;

swagger.yaml

@@ -162,6 +162,36 @@ paths:
       responses:
         204:
           description: OK
+
+  /user/request-password-reset:
+    post:
+      tags:
+        - Users
+      description: trigger a reset password email. sends a success code whether email was found or no.
+      responses:
+        204:
+          description: OK
+
+  /user/update-password:
+    post:
+      tags:
+        - Users
+      description: Update existing user password
+      parameters:
+        - name: token
+          type: string
+          in: body
+          description: JSON Web token taken taken from emailed link
+          required: true
+        - name: password
+          type: string
+          in: body
+          description: new password to be settings
+          required: true
+      responses:
+        204:
+          description: OK
+
   /asset:
     get:
       tags:
@@ -276,7 +306,7 @@ definitions:
         description: A summary of the asset, inferred on initial load.
       section:
         type: string
-        description: The section the asset is in. 
+        description: The section the asset is in.
       subsection:
         type: string
         description: The subsection that the asset is in.