From 29cbbb1d08da72c2711114176c20254b2e9d9ea5 Mon Sep 17 00:00:00 2001
From: Julien Martin <julien.martin@ptits-pas.fr>
Date: Thu, 23 Apr 2026 11:49:31 +0200
Subject: [PATCH] feat(auth): align verify-token with #118 invalid-link
 behavior

Treat missing token on GET /auth/verify-token as the same neutral invalid/expired/used response (404), matching ticket #118 expectations for /create-password flows.

Made-with: Cursor
---
 backend/src/routes/auth/auth.service.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/backend/src/routes/auth/auth.service.ts b/backend/src/routes/auth/auth.service.ts
index bced215..506c22c 100644
--- a/backend/src/routes/auth/auth.service.ts
+++ b/backend/src/routes/auth/auth.service.ts
@@ -140,7 +140,9 @@ export class AuthService {
     async verifyCreatePasswordToken(token: string) {
         const cleanedToken = token?.trim();
         if (!cleanedToken) {
-            throw new BadRequestException('Token manquant');
+            // #118: côté front, un token absent doit être traité comme lien invalide/expiré.
+            // On renvoie donc la même réponse neutre 404 que pour les autres cas invalides.
+            throw new NotFoundException('Token invalide, expiré, ou déjà utilisé.');
         }
 
         const user = await this.usersRepo.findOne({