ThreadCount Community edition

Uniform stock management for healthcare linen rooms: the coordinator app, the phone counter and the staff app, for your own server. Built from d947f89 on 2026-09-15. Licensed under the Functional Source License (FSL-1.1-ALv2).

scripts/reset-token.cjs

@@ -0,0 +1,27 @@
+/* Read the newest reset row for an address, for the e2e suite only.
+ *
+ * The suite needs to prove a token is single-use and expires, which means holding one — something
+ * an attacker cannot do, since the table stores only the SHA-256 and the raw token exists solely
+ * in the email. So this prints the hash, and the suite drives the API with a token it mints itself
+ * against a row it inserts. Nothing here weakens the running app.
+ *
+ *   node scripts/reset-token.cjs <email>        -> prints "<id> <tokenHash> <expiresAt> <usedAt>"
+ */
+require("dotenv/config");
+const { PrismaClient } = require("@prisma/client");
+const { PrismaPg } = require("@prisma/adapter-pg");
+
+const email = process.argv[2];
+if (!email) { console.error("usage: reset-token.cjs <email>"); process.exit(2); }
+
+const prisma = new PrismaClient({ adapter: new PrismaPg({ connectionString: process.env.DATABASE_URL, max: 1 }) });
+
+(async () => {
+  const row = await prisma.passwordReset.findFirst({
+    where: { user: { email } },
+    orderBy: { createdAt: "desc" },
+    select: { id: true, tokenHash: true, expiresAt: true, usedAt: true },
+  });
+  if (row) console.log(`${row.id} ${row.tokenHash} ${row.expiresAt.toISOString()} ${row.usedAt ? row.usedAt.toISOString() : "-"}`);
+  await prisma.$disconnect();
+})().catch(async (e) => { console.error(e.message); await prisma.$disconnect(); process.exit(1); });