Terminate user sessions and send password change notification after password update to enhance security.

lib/insecurity.ts

@@ -199,3 +199,16 @@ export const updateAuthenticatedUsers = () => (req: Request, res: Response, next
   }
   next()
 }
+
+export const clearSessionsFor = (user: UserModel) => {
+  const token = authenticatedUsers.tokenOf(user)
+  if (token) {
+    delete authenticatedUsers.tokenMap[token]
+    delete authenticatedUsers.idMap[user.id]
+  }
+}
+
+export const sendPasswordResetNotification = (email: string) => {
+  // Placeholder: replace with real email dispatch
+  console.info(`Password reset notification sent to ${email}`)
+}

routes/resetPassword.ts

@@ -36,6 +36,8 @@ module.exports = function resetPassword () {
         if ((data != null) && security.hmac(answer) === data.answer) {
           UserModel.findByPk(data.UserId).then((user: UserModel | null) => {
             user?.update({ password: newPassword }).then((user: UserModel) => {
+              security.clearSessionsFor(user)
+              security.sendPasswordResetNotification(user.email)
               verifySecurityAnswerChallenges(user, answer)
               res.json({ user })
             }).catch((error: unknown) => {