change response text to avoid reveal user's data (#161)

* change response text to avoid reveal user's data

* include log into forgot password

---------

Co-authored-by: p.souza <p.souza@cognigy.com>

lib/routes/api/forgot-password.js

@@ -55,13 +55,16 @@ router.post('/', async(req, res) => {
 
     const [r] = await promisePool.query({sql, nestTables: true}, email);
     if (0 === r.length) {
-      return res.status(400).json({error: 'email does not exist'});
+      logger.info('user not found');
+      return res.status(400).json({error: 'failed to reset your password'});
     }
     obj = r[0];
     if (!obj.user.is_active) {
-      return res.status(400).json({error: 'you may not reset the password of an inactive user'});
+      logger.info(obj.user.name, 'user is inactive');
+      return res.status(400).json({error: 'failed to reset your password'});
     } else if (obj.acc.account_sid !== null && !obj.acc.is_active) {
-      return res.status(400).json({error: 'you may not reset the password of an inactive account'});
+      logger.info(obj.acc.account_sid, 'account is inactive');
+      return res.status(400).json({error: 'failed to reset your password'});
     }
     res.sendStatus(204);
   } catch (err) {

lib/routes/api/users.js

@@ -453,12 +453,12 @@ router.post('/', async(req, res) => {
 
     if (name) {
       logger.debug({payload}, 'user with this username already exists');
-      return res.status(422).json({msg: 'user with this username already exists'});
+      return res.status(422).json({msg: 'invalid username or email'});
     }
 
     if (email) {
       logger.debug({payload}, 'user with this email already exists');
-      return res.status(422).json({msg: 'user with this email already exists'});
+      return res.status(422).json({msg: 'invalid username or email'});
     }
 
     if (req.user.hasAdminAuth) {