Check invalid email

Sending a mail with further instructions even if the email is invalid
seems to be a good practice: A potential attacker will not now if a user
has an account under that email address. If a user does not remember the
email address, but has control over the other mail account, she will get
feedback that this mail account is incorrect.

backend/src/schema/resolvers/passwordReset.spec.js

@@ -30,9 +30,25 @@ describe('passwordReset', () => {
   })
 
   describe('requestPasswordReset', () => {
-    const variables = { email: 'user@example.org' }
     const mutation = `mutation($email: String!) { requestPasswordReset(email: $email) }`
 
+    describe('with invalid email', () => {
+      const variables = { email: 'non-existent@example.org' }
+
+      it('resolves anyways', async () => {
+        await expect(client.request(mutation, variables)).resolves.toEqual({"requestPasswordReset": true})
+      })
+
+      it('creates no node', async () => {
+        await client.request(mutation, variables)
+        const resets = await getAllPasswordResets()
+        expect(resets).toHaveLength(0)
+      })
+    })
+
+    describe('with a valid email', () => {
+      const variables = { email: 'user@example.org' }
+
       it('resolves', async () => {
         await expect(client.request(mutation, variables)).resolves.toEqual({"requestPasswordReset": true})
       })
@@ -61,3 +77,4 @@ describe('passwordReset', () => {
       })
     })
   })
+})