feat: dashboard password recovery, and tighten free-tier limits

Author: yash-pouranik

apps/dashboard-api/src/__tests__/auth.controller.test.js

@@ -472,4 +472,55 @@ describe('auth.controller', () => {
             );
         });
     });
+
+    // -----------------------------------------------------------------------
+    describe('resetPassword', () => {
+        test('clears stored refresh token after successful password reset', async () => {
+            const mockOtpDoc = {
+                attempts: 0,
+                otp: 'hashed_otp',
+                deleteOne: jest.fn().mockResolvedValue(undefined),
+                save: jest.fn().mockResolvedValue(undefined),
+            };
+            const mockUser = {
+                _id: 'dev_id_1',
+                email: 'test@example.com',
+                password: 'old_hashed_password',
+                refreshToken: 'active_refresh_token',
+                save: jest.fn().mockResolvedValue(undefined),
+            };
+
+            Developer.findOne.mockResolvedValue(mockUser);
+            Otp.findOne.mockResolvedValue(mockOtpDoc);
+            bcrypt.compare.mockResolvedValue(true);
+            bcrypt.genSalt.mockResolvedValue('salt');
+            bcrypt.hash.mockResolvedValue('new_hashed_password');
+
+            const req = makeReq({
+                email: 'test@example.com',
+                otp: '123456',
+                newPassword: 'newpassword123',
+            });
+            const res = makeRes();
+
+            await authController.resetPassword(req, res);
+
+            expect(mockUser.refreshToken).toBeNull();
+            expect(mockUser.save).toHaveBeenCalled();
+            expect(res.cookie).toHaveBeenCalledWith(
+                'accessToken',
+                'none',
+                expect.objectContaining({ httpOnly: true })
+            );
+            expect(res.cookie).toHaveBeenCalledWith(
+                'refreshToken',
+                'none',
+                expect.objectContaining({ httpOnly: true })
+            );
+            expect(res.status).toHaveBeenCalledWith(200);
+            expect(res.json).toHaveBeenCalledWith({
+                message: 'Password reset successfully. Please log in with your new password.'
+            });
+        });
+    });
 });

apps/dashboard-api/src/controllers/auth.controller.js

@@ -263,9 +263,25 @@ module.exports.resetPassword = async (req, res) => {
         await otpDoc.deleteOne();
         const salt = await bcrypt.genSalt(10);
         dev.password = await bcrypt.hash(newPassword, salt);
+        // Invalidate existing dashboard refresh sessions after a successful reset.
+        dev.refreshToken = null;
         await dev.save();
 
-        res.status(200).json({ message: "Password reset successfully. Please log in with your new password." });
+        res
+            .status(200)
+            .cookie('accessToken', 'none', {
+                expires: new Date(Date.now() + 10 * 1000),
+                httpOnly: true,
+                secure: process.env.NODE_ENV === 'production',
+                sameSite: process.env.NODE_ENV === 'production' ? 'none' : 'lax'
+            })
+            .cookie('refreshToken', 'none', {
+                expires: new Date(Date.now() + 10 * 1000),
+                httpOnly: true,
+                secure: process.env.NODE_ENV === 'production',
+                sameSite: process.env.NODE_ENV === 'production' ? 'none' : 'lax'
+            })
+            .json({ message: "Password reset successfully. Please log in with your new password." });
     } catch (err) {
         if (err.status) return res.status(err.status).json({ error: err.message });
         if (err instanceof z.ZodError) return res.status(400).json({ error: err.errors });
@@ -323,7 +339,6 @@ module.exports.refreshToken = async (req, res) => {
 
         await sendTokenResponse(user, 200, res);
     } catch (err) {
-        console.error(err);
         res.status(403).json({ error: "Invalid or expired refresh token" });
     }
 };

apps/dashboard-api/src/controllers/project.controller.js

@@ -189,7 +189,7 @@ module.exports.createProject = async (req, res) => {
 
     // GET MAX PROJECTS
     const dev = await Developer.findById(req.user._id);
-    const MAX_PROJECTS = dev?.maxProjects || 3;
+    const MAX_PROJECTS = dev?.maxProjects || 1;
 
     const isUserAdmin = dev.email === ADMIN_EMAIL;
     const projectCount = await Project.countDocuments({ owner: req.user._id });

apps/web-dashboard/src/App.jsx

@@ -20,6 +20,7 @@ import Docs from './pages/Docs';
 import Auth from './pages/Auth';
 import AuthCallback from './pages/AuthCallback';
 import OtpVerification from './pages/OtpVerification';
+import ForgotPassword from './pages/ForgotPassword';
 import Settings from './pages/Settings';
 import ProjectSettings from './pages/ProjectSettings';
 
@@ -44,6 +45,7 @@ function App() {
         <Route path="/login" element={<Login />} />
         <Route path="/signup" element={<Signup />} />
         <Route path="/verify-otp" element={<OtpVerification />} />
+        <Route path="/forgot-password" element={<ForgotPassword />} />
         <Route path="/auth/callback" element={<AuthCallback />} />