fixup!

lnbits/core/views/auth_api.py

@@ -271,32 +271,33 @@ async def reset_password(data: ResetUserPassword) -> JSONResponse:
         raise HTTPException(
             HTTPStatus.UNAUTHORIZED, "Auth by 'Username and Password' not allowed."
         )
-
-    assert data.reset_key[:10] == "reset_key_", "This is not a reset key."
+    if not data.reset_key[:10].startswith("reset_key_"):
+        raise HTTPException(HTTPStatus.BAD_REQUEST, "This is not a reset key.")
 
     reset_data_json = decrypt_internal_message(
         base64.b64decode(data.reset_key[10:]).decode()
     )
-    assert reset_data_json, "Cannot process reset key."
+    if not reset_data_json:
+        raise HTTPException(HTTPStatus.BAD_REQUEST, "Cannot process reset key.")
 
     action, user_id, request_time = json.loads(reset_data_json)
-    assert action == "reset", "Expected reset action."
-    assert user_id is not None, "Missing user ID."
-    assert request_time is not None, "Missing reset time."
+    if not action:
+        raise HTTPException(HTTPStatus.BAD_REQUEST, "Missing action.")
+    if not user_id:
+        raise HTTPException(HTTPStatus.BAD_REQUEST, "Missing user ID.")
+    if not request_time:
+        raise HTTPException(HTTPStatus.BAD_REQUEST, "Missing reset time.")
 
-    user = await get_account(user_id)
-    assert user, "User not found."
+    _validate_auth_timeout(request_time)
 
-    update_pwd = UpdateUserPassword(
-        user_id=user.id,
-        username=user.username or "",
-        password=data.password,
-        password_repeat=data.password_repeat,
-    )
-    user = await update_user_password(update_pwd, request_time)
+    account = await get_account(user_id)
+    if not account:
+        raise HTTPException(HTTPStatus.NOT_FOUND, "User not found.")
 
+    account.hash_password(data.password)
+    await update_account(account)
     return _auth_success_response(
-        username=user.username, user_id=user_id, email=user.email
+        username=account.username, user_id=user_id, email=account.email
     )
 
 

lnbits/helpers.py

@@ -1,6 +1,6 @@
 import json
 import re
-from datetime import UTC, datetime, timedelta
+from datetime import datetime, timedelta, timezone
 from pathlib import Path
 from typing import Any, Optional, Type
 
@@ -184,7 +184,9 @@ def is_valid_username(username: str) -> bool:
 
 
 def create_access_token(data: dict):
-    expire = datetime.now(UTC) + timedelta(minutes=settings.auth_token_expire_minutes)
+    expire = datetime.now(timezone.utc) + timedelta(
+        minutes=settings.auth_token_expire_minutes
+    )
     to_encode = data.copy()
     to_encode.update({"exp": expire})
     return jwt.encode(to_encode, settings.auth_secret_key, "HS256")