generate unique onetime token

src/server/models/password-reset-order.js

@@ -21,6 +21,19 @@ class PasswordResetOrder {
     return token;
   }
 
+  static async generateUniqueOneTimeToken() {
+    let token;
+    let duplicateToken;
+
+    do {
+      token = this.generateOneTimeToken();
+      // eslint-disable-next-line no-await-in-loop
+      duplicateToken = await this.findOne({ token });
+    } while (duplicateToken != null);
+
+    return token;
+  }
+
   static isExpired() {
     return this.expiredAt.getTime() < new Date().getTime();
   }

src/server/routes/forgot-password.js

@@ -30,7 +30,7 @@ module.exports = function(crowi, app) {
   }
 
   api.post = async function(req, res) {
-    const oneTimeToken = await PasswordResetOrder.generateOneTimeToken();
+    const oneTimeToken = await PasswordResetOrder.generateUniqueOneTimeToken();
     await sendPasswordResetEmail();
     return;
   };