From 67f2e4671a61a759af0a4b77b6cf8423b5b49822 Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Fri, 7 Mar 2025 19:59:29 +0400
Subject: [PATCH] requested changes

---
 .../services/auth/auth-password-service.ts    | 48 +++++++++----------
 .../auth/VerifyEmailPage/VerifyEmailPage.tsx  |  6 ++-
 2 files changed, 26 insertions(+), 28 deletions(-)

diff --git a/backend/src/services/auth/auth-password-service.ts b/backend/src/services/auth/auth-password-service.ts
index 4d01870f6..27d3bdf2d 100644
--- a/backend/src/services/auth/auth-password-service.ts
+++ b/backend/src/services/auth/auth-password-service.ts
@@ -119,35 +119,31 @@ export const authPaswordServiceFactory = ({
    * Email password reset flow via email. Step 1 send email
    */
   const sendPasswordResetEmail = async (email: string) => {
-    const startTime = Date.now();
+    const sendEmail = async () => {
+      const user = await userDAL.findUserByUsername(email);
 
-    const user = await userDAL.findUserByUsername(email);
+      if (user && user.isAccepted) {
+        const cfg = getConfig();
+        const token = await tokenService.createTokenForUser({
+          type: TokenType.TOKEN_EMAIL_PASSWORD_RESET,
+          userId: user.id
+        });
 
-    if (user && user.isAccepted) {
-      const cfg = getConfig();
-      const token = await tokenService.createTokenForUser({
-        type: TokenType.TOKEN_EMAIL_PASSWORD_RESET,
-        userId: user.id
-      });
+        await smtpService.sendMail({
+          template: SmtpTemplates.ResetPassword,
+          recipients: [email],
+          subjectLine: "Infisical password reset",
+          substitutions: {
+            email,
+            token,
+            callback_url: cfg.SITE_URL ? `${cfg.SITE_URL}/password-reset` : ""
+          }
+        });
+      }
+    };
 
-      await smtpService.sendMail({
-        template: SmtpTemplates.ResetPassword,
-        recipients: [email],
-        subjectLine: "Infisical password reset",
-        substitutions: {
-          email,
-          token,
-          callback_url: cfg.SITE_URL ? `${cfg.SITE_URL}/password-reset` : ""
-        }
-      });
-    }
-
-    const elapsedTime = Date.now() - startTime;
-    // daniel: ensure each request takes 8 seconds to prevent timing attacks
-    if (elapsedTime < 8_000) {
-      // eslint-disable-next-line no-promise-executor-return
-      await new Promise((resolve) => setTimeout(resolve, 8_000 - elapsedTime));
-    }
+    // note(daniel): run in background to prevent timing attacks
+    void sendEmail();
   };
 
   /*
diff --git a/frontend/src/pages/auth/VerifyEmailPage/VerifyEmailPage.tsx b/frontend/src/pages/auth/VerifyEmailPage/VerifyEmailPage.tsx
index bc0bdf1ff..47012e2cb 100644
--- a/frontend/src/pages/auth/VerifyEmailPage/VerifyEmailPage.tsx
+++ b/frontend/src/pages/auth/VerifyEmailPage/VerifyEmailPage.tsx
@@ -103,8 +103,10 @@ export const VerifyEmailPage = () => {
             Look for an email in your inbox.
           </p>
           <div className="mt-4 flex flex-row items-center justify-center md:mx-2 md:pb-4">
-            <p className="flex w-max justify-center text-center text-sm text-gray-400">
-              An email with instructions has been sent to {email}.
+            <p className="w-max text-center text-sm text-gray-400">
+              If the email is in our system, you will receive an email at{" "}
+              <span className="italic">{email}</span> with instructions on how to reset your
+              password.
             </p>
           </div>
         </div>