Method postChangePasswordWithOneTimePasscode

coderd/userauth.go:336–457

Change a users password with a one-time passcode. @Summary Change password with a one-time passcode @ID change-password-with-a-one-time-passcode @Accept json @Tags Authorization @Param request body codersdk.ChangePasswordWithOneTimePasscodeRequest true "Change password request" @Success 204 @Router

(rw http.ResponseWriter, r *http.Request)

// @Success 204
// @Router /api/v2/users/otp/change-password [post]
func (api *API) postChangePasswordWithOneTimePasscode(rw http.ResponseWriter, r *http.Request) {
	var (
		err               error
		ctx               = r.Context()
		auditor           = api.Auditor.Load()
		logger            = api.Logger.Named(userAuthLoggerName)
		aReq, commitAudit = audit.InitRequest[database.User](rw, &audit.RequestParams{
			Audit:   *auditor,
			Log:     api.Logger,
			Request: r,
			Action:  database.AuditActionWrite,
		})
	)
	defer commitAudit()

	if api.DeploymentValues.DisablePasswordAuth {
		httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{
			Message: "Password authentication is disabled.",
		})
		return
	}

	var req codersdk.ChangePasswordWithOneTimePasscodeRequest
	if !httpapi.Read(ctx, rw, r, &req) {
		return
	}

	if err := userpassword.Validate(req.Password); err != nil {
		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
			Message: "Invalid password.",
			Validations: []codersdk.ValidationError{
				{
					Field:  "password",
					Detail: err.Error(),
				},
			},
		})
		return
	}

	err = api.Database.InTx(func(tx database.Store) error {
		//nolint:gocritic // In order to change a user's password, we need to get the user first - and can only do that in the system auth context.
		user, err := tx.GetUserByEmailOrUsername(dbauthz.AsSystemRestricted(ctx), database.GetUserByEmailOrUsernameParams{
			Email: req.Email,
		})
		if err != nil && !errors.Is(err, sql.ErrNoRows) {
			logger.Error(ctx, "unable to fetch user by email", slog.F("email", req.Email), slog.Error(err))
			return xerrors.Errorf("get user by email: %w", err)
		}
		// We continue if err == sql.ErrNoRows to help prevent a timing-based attack.
		aReq.Old = user
		aReq.UserID = user.ID

		equal, err := userpassword.Compare(string(user.HashedOneTimePasscode), req.OneTimePasscode)
		if err != nil {
			logger.Error(ctx, "unable to compare one-time passcode", slog.Error(err))
			return xerrors.Errorf("compare one-time passcode: %w", err)
		}