Is there any way to access [email protected] reset password token?

secure-code-2.js

const express = require('express');
const { Sequelize, DataTypes } = require('sequelize');
const crypto = require('crypto');
const Joi = require('joi');
const bcrypt = require('bcrypt');
const sendResetEmail = require('./sendmail');

const app = express().use(express.json());

const sequelize = new Sequelize(process.env.DB_NAME, process.env.DB_USER, process.env.DB_PASS, { host: 'localhost', dialect: 'mysql' });
const User = sequelize.define('User', {
    email: { type: DataTypes.STRING, allowNull: false, unique: true },
    password: { type: DataTypes.STRING, allowNull: false },
    resetToken: { type: DataTypes.STRING },
    resetTokenExpiration: { type: DataTypes.DATE, allowNull: true }
});

sequelize.sync({ force: true }).then(async () => {
    const adminUser = await User.findOne({ where: { email: '[email protected]' } });

    if (!adminUser) {
        const hashedPassword = await bcrypt.hash(process.env.ADMIN_PASSWORD, 10);
        await User.create({ email: '[email protected]', password: hashedPassword });
    }
})

app.post('/forgot-password', async (req, res) => {
    const { error } = Joi.object({ email: Joi.string().required().min(1) }).validate(req.body, { presence: 'required' });
    if (error) return res.status(400).json({ error: error.details[0].message });

    try {
        const user = await User.findOne({ where: { email: req.body.email } });
        if (!user) return res.status(400).json({ message: 'User not found' });

        const [resetToken, resetTokenExpiration] = [crypto.randomBytes(20).toString('hex'), Date.now() + 180000];
        [user.resetToken, user.resetTokenExpiration] = [resetToken, resetTokenExpiration];
        await user.save();

        sendResetEmail(req.body.email, resetToken); // Basic email sending function

        res.json({ message: 'Reset email sent successfully' });
    } catch (error) {
        console.error(error);
        res.status(500).json({ message: 'Internal Server Error' });
    }
});

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => console.log(`Server is running on port ${PORT}`));

توى endpoint عه /forgot-password وريفاى نميكنه كه كسى كه ريكوست ميده درواقع صاحب ايميل عه پس هركى ميتونه درخواست بده.
پس درواقع ميتونن هى endpoint عه /forgot-password رو با {"email": "[email protected]"} call كنن و با هر ريكوست يه توكن جديد با اكسپايريشن بگيرن.

https://www.youtube.com/watch?v=pdhIX-vOTgw&t=69s