Secure password reset endpoints (#5167)

fix: prevent sensitive data exposure in password reset

packages/server/src/utils/sanitize.util.ts

@@ -1,3 +1,5 @@
+import { User } from '../enterprise/database/entities/user.entity'
+
 export function sanitizeNullBytes(obj: any): any {
     const stack = [obj]
 
@@ -30,3 +32,11 @@ export function sanitizeNullBytes(obj: any): any {
 
     return obj
 }
+
+export function sanitizeUser(user: Partial<User>) {
+    delete user.credential
+    delete user.tempToken
+    delete user.tokenExpiry
+
+    return user
+}