fix: minor security issues

packages/server/src/api/auth/recover.ts

@@ -36,7 +36,7 @@ export default makeFastifyRoute(authRecoverPost, async ({ req, res }) => {
 
   const user = await getUserByEmail({ email })
   if (user === undefined) {
-    return res.badUnknownEmail()
+    return res.goodVerifySent()
   }
 
   const verifyUuid = uuidv4()

packages/server/src/providers/uploads/local/index.ts

@@ -27,7 +27,7 @@ export default class LocalProvider implements Provider {
       index: false,
       setHeaders: (res: ServerResponse) => {
         res.setHeader('cache-control', 'public, max-age=31557600, immutable')
-        res.setHeader('content-disposition', 'atttachment')
+        res.setHeader('content-disposition', 'attachment')
       },
     })
   }

packages/server/test/integration/auth.js

@@ -4,13 +4,13 @@ import * as database from '../../src/database'
 import config from '../../src/config/server'
 import {
   badEmail,
-  badUnknownEmail,
   badKnownEmail,
   badKnownName,
   goodRegister,
   goodToken,
   goodUserUpdate,
   badRegistrationsDisabled,
+  goodVerifySent,
 } from '@rctf/api-types/responses'
 
 import * as auth from '../../src/auth'
@@ -45,7 +45,7 @@ test('fails with badEmail', async () => {
   expect(resp.body.kind).toBe('badEmail')
 })
 
-test('fails with badUnknownEmail', async () => {
+test('fails with goodVerifySent', async () => {
   config.email = oldEmail
 
   const unknownEmail = 'non-existent-email' + Math.random() + '@gmail.com'
@@ -54,9 +54,9 @@ test('fails with badUnknownEmail', async () => {
     .send({
       email: unknownEmail,
     })
-    .expect(badUnknownEmail.status)
+    .expect(goodVerifySent.status)
 
-  expect(resp.body.kind).toBe('badUnknownEmail')
+  expect(resp.body.kind).toBe('goodVerifySent')
 })
 
 test('when not email, succeeds with goodRegister', async () => {