From 56f45288609d1628e112512c883e12c5eca4a5b5 Mon Sep 17 00:00:00 2001
From: Eric Mc Sween <5454374+emcsween@users.noreply.github.com>
Date: Thu, 3 Jul 2025 17:54:37 -0400
Subject: [PATCH] Migrate setNewUserPassword to zod

GitOrigin-RevId: 5f5b66baac696a36d4989de3b76e46279da8f53c
---
 .../Features/PasswordReset/PasswordResetController.mjs | 10 +++++++++-
 .../src/Features/PasswordReset/PasswordResetRouter.mjs |  7 -------
 2 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/services/web/app/src/Features/PasswordReset/PasswordResetController.mjs b/services/web/app/src/Features/PasswordReset/PasswordResetController.mjs
index 5bb172d46c..9e236e9d93 100644
--- a/services/web/app/src/Features/PasswordReset/PasswordResetController.mjs
+++ b/services/web/app/src/Features/PasswordReset/PasswordResetController.mjs
@@ -10,9 +10,17 @@ import EmailsHelper from '../Helpers/EmailHelper.js'
 import { expressify } from '@overleaf/promise-utils'
 import { z, validateReq } from '../../infrastructure/Validation.js'
 
+const setNewUserPasswordSchema = z.object({
+  body: z.object({
+    password: z.string(),
+    passwordResetToken: z.string(),
+  }),
+})
+
 async function setNewUserPassword(req, res, next) {
   let user
-  let { passwordResetToken, password, email } = req.body
+  const { body } = validateReq(req, setNewUserPasswordSchema)
+  let { passwordResetToken, password, email } = body
   if (!passwordResetToken || !password) {
     return res.status(400).json({
       message: {
diff --git a/services/web/app/src/Features/PasswordReset/PasswordResetRouter.mjs b/services/web/app/src/Features/PasswordReset/PasswordResetRouter.mjs
index c73631b591..ebb9997952 100644
--- a/services/web/app/src/Features/PasswordReset/PasswordResetRouter.mjs
+++ b/services/web/app/src/Features/PasswordReset/PasswordResetRouter.mjs
@@ -3,7 +3,6 @@ import AuthenticationController from '../Authentication/AuthenticationController
 import CaptchaMiddleware from '../../Features/Captcha/CaptchaMiddleware.mjs'
 import { RateLimiter } from '../../infrastructure/RateLimiter.js'
 import RateLimiterMiddleware from '../Security/RateLimiterMiddleware.js'
-import { Joi, validate } from '../../infrastructure/Validation.js'
 
 const rateLimiter = new RateLimiter('password_reset_rate_limit', {
   points: 6,
@@ -35,12 +34,6 @@ export default {
     )
     webRouter.post(
       '/user/password/set',
-      validate({
-        body: Joi.object({
-          password: Joi.string().required(),
-          passwordResetToken: Joi.string().required(),
-        }),
-      }),
       rateLimit,
       PasswordResetController.setNewUserPassword
     )