module.exports.resetPassword = async (req, res) => {
  const { token, password } = req.body

  if (!token || !password) {
    return res.status(400).json({
      message: 'Incomplete request'
    })
  }

  jwt.verify(token, config.cookieSecret, async (err, decoded) => {
    if (err || decoded.t !== 'r') {
      return res.status(400).json({
        message: 'Invalid token'
      })
    }

    const email = decoded.e

    try {
      const user = await User.findOneAndUpdate({ email }, { password }).exec()

      if (!user) {
        return res.status(400).json({
          message: 'Could not verify'
        })
      }

      res.status(200).end()
    } catch (err) {
      return res.status(500).end()
    }
  })
}