Sayt ro'yxatda bor / yo'qligini yashirmasa — hujumchi barcha foydalanuvchilar ro'yxatini chiqaradi va keyingi bosqich (spray, parol tiklash) uchun nishonlar ro'yxati oladi.

# 1) ro'yxatdan o'tish / tiklash / login javoblari
grep -rniE "already|registered|exists|not found|topilmadi|ro'yxatda" src/ | head

# 2) vaqt farqi
for E in mavjud@site.uz yoq@site.uz; do
  for I in 1 2 3; do
    curl -s -o /dev/null -w "$E  %{time_total}\n" -X POST \
      https://site.uz/api/auth/forgot-password -H "Content-Type: application/json" \
      -d "{\"email\":\"$E\"}"
  done
done

# 1) login — xato matni farqi
curl -s -X POST https://site.uz/api/auth/login -H "Content-Type: application/json" \
  -d '{"email":"mavjud@site.uz","password":"X"}' | jq -r .message
curl -s -X POST https://site.uz/api/auth/login -H "Content-Type: application/json" \
  -d '{"email":"yoq@site.uz","password":"X"}' | jq -r .message

# 2) ro'yxatdan o'tish
curl -s -X POST https://site.uz/api/auth/register -H "Content-Type: application/json" \
  -d '{"email":"mavjud@site.uz","password":"Test1234!"}' | jq -c .
curl -s -X POST https://site.uz/api/auth/register -H "Content-Type: application/json" \
  -d '{"email":"yangi@site.uz","password":"Test1234!"}' | jq -c .

# 3) parol tiklash
for E in admin@site.uz random-nonexistent-99@site.uz; do
  echo "  $E → $(curl -s -X POST https://site.uz/api/auth/forgot-password \
    -H 'Content-Type: application/json' -d "{\"email\":\"$E\"}" | jq -c .)"
done

# 4) tizimli ro'yxat yig'ish (o'z domeningiz)
EMAILS="admin@ info@ support@ test@ demo@ user@ webmaster@ postmaster@ root@"
for E in $EMAILS; do
  R=$(curl -s -m 5 -X POST https://site.uz/api/auth/forgot-password \
      -H "Content-Type: application/json" -d "{\"email\":\"$E\"}" | jq -c .)
  echo "  $E → $R"
done

# 5) vaqt tahlili (eng ishonchli signal)
for E in bor@site.uz yoq@site.uz; do
  T=$(for I in 1 2 3 4 5; do
      curl -s -o /dev/null -w "%{time_total} " -X POST \
        https://site.uz/api/auth/forgot-password -H "Content-Type: application/json" \
        -d "{\"email\":\"$E\"}"
    done)
  echo "  $E: $T"
done
# 0.8s vs 0.04s → email yuborilmoqda = mavjud

# 6) nick bilan (agar mavjud bo'lsa)
for N in admin administrator test info; do
  echo "  $N → $(curl -s -o /dev/null -w '%{http_code}' https://site.uz/u/$N)"
done

1. Har doim bir xil javob

// BARCHA joylarda bitta matn:
res.json({ success: true,
  message: "Agar bu email ro'yxatda bo'lsa, biz sizga xabar yuboramiz." });

// HTTP kodi ham bir xil — 200

2. Vaqtni tekislash

// email bor ham, yo'q ham — har doim ~400 ms
const t0 = Date.now();
if (user) await sendMail(user.email, link);   // 350 ms
const wait = 400 - (Date.now() - t0);
if (wait > 0) await sleep(wait);

3. Profil yashirish

// 200 emas, lekin har doim bir xil sahifa ("profil topilmadi")
// yoki login talab qilish (ro'yxatdan o'tish uchun emas)

4. Rate limit

limit('enum', { points: 20, duration: 3600 });   // IP bo'yicha so'rovlar

5. Umumiy qoida

Login, ro'yxatdan o'tish, parol tiklash, username o'zgartirish — to'rtala endpoint ham bir xil javob va bir xil vaqt berishi kerak.

• Login va register bir xil javob beradi
• Parol tiklash har doim bir xil
• Vaqt farqi 100 ms dan kam
• Rate limit 20 so'rov/soat
• Profil URL'i mavjudlikni oshkor qilmaydi
• `mavjud@` va `yoq@` bilan vaqt solishtirildi