From 986fe2fe23365cda118dc7c5741fd964eade505c Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Tue, 5 Aug 2025 22:04:54 +0400
Subject: [PATCH] fix: password resets not working

---
 backend/src/server/routes/v1/user-router.ts   |  4 ++-
 .../src/server/routes/v2/password-router.ts   | 28 ++++++++++++++++++-
 2 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/backend/src/server/routes/v1/user-router.ts b/backend/src/server/routes/v1/user-router.ts
index b519b8ac3..7ef2e0d33 100644
--- a/backend/src/server/routes/v1/user-router.ts
+++ b/backend/src/server/routes/v1/user-router.ts
@@ -19,7 +19,9 @@ export const registerUserRouter = async (server: FastifyZodProvider) => {
     schema: {
       response: {
         200: z.object({
-          user: UsersSchema
+          user: UsersSchema.extend({
+            encryptionVersion: z.number()
+          })
         })
       }
     },
diff --git a/backend/src/server/routes/v2/password-router.ts b/backend/src/server/routes/v2/password-router.ts
index 63b6d8aac..0f0747c3f 100644
--- a/backend/src/server/routes/v2/password-router.ts
+++ b/backend/src/server/routes/v2/password-router.ts
@@ -1,5 +1,6 @@
 import { z } from "zod";
 
+import { getConfig } from "@app/lib/config/env";
 import { authRateLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { validatePasswordResetAuthorization } from "@app/services/auth/auth-fns";
@@ -41,13 +42,38 @@ export const registerPasswordRouter = async (server: FastifyZodProvider) => {
       rateLimit: authRateLimit
     },
     onRequest: verifyAuth([AuthMode.JWT], { requireOrg: false }),
-    handler: async (req) => {
+    handler: async (req, res) => {
+      const appCfg = getConfig();
+
       await server.services.password.resetPasswordV2({
         type: ResetPasswordV2Type.LoggedInReset,
         userId: req.permission.id,
         newPassword: req.body.newPassword,
         oldPassword: req.body.oldPassword
       });
+
+      void res.cookie("jid", "", {
+        httpOnly: true,
+        path: "/",
+        sameSite: "strict",
+        secure: appCfg.HTTPS_ENABLED
+      });
+
+      void res.cookie("infisical-project-assume-privileges", "", {
+        httpOnly: true,
+        path: "/",
+        sameSite: "strict",
+        secure: appCfg.HTTPS_ENABLED,
+        maxAge: 0
+      });
+
+      void res.cookie("aod", "", {
+        httpOnly: false,
+        path: "/",
+        sameSite: "lax",
+        secure: appCfg.HTTPS_ENABLED,
+        maxAge: 0
+      });
     }
   });
 };