Method TestUserUpdatePasswordViaRecovery

internal/api/user_test.go:405–497

()

}

func (ts *UserTestSuite) TestUserUpdatePasswordViaRecovery() {
	ts.Config.Security.UpdatePasswordRequireCurrentPassword = true
	ts.Config.SMTP.MaxFrequency = 60
	u, err := models.FindUserByEmailAndAudience(ts.API.db, "test@example.com", ts.Config.JWT.Aud)
	require.NoError(ts.T(), err)
	u.RecoverySentAt = &time.Time{}
	require.NoError(ts.T(), ts.API.db.Update(u))

	type expected struct {
		code            int
		isAuthenticated bool
	}

	var cases = []struct {
		desc            string
		newPassword     string
		currentPassword string
		recoveryType    models.AuthenticationMethod
		expected        expected
	}{
		{
			desc:         "Current password not required in OTP recovery flow",
			newPassword:  "newpassword123",
			recoveryType: models.OTP,
			expected:     expected{code: http.StatusOK, isAuthenticated: true},
		},
		{
			desc:         "Current password not required in magiclink recovery flow",
			newPassword:  "newpassword456",
			recoveryType: models.MagicLink,
			expected:     expected{code: http.StatusOK, isAuthenticated: true},
		},
		{
			desc:         "Current password not required in PKCE recovery flow",
			newPassword:  "newpassword789",
			recoveryType: models.Recovery,
			expected:     expected{code: http.StatusOK, isAuthenticated: true},
		},
		{
			desc:         "Current password required for any other claim",
			newPassword:  "newpassword456",
			recoveryType: models.EmailChange,
			expected:     expected{code: http.StatusBadRequest, isAuthenticated: false},
		},
	}

	for _, c := range cases {
		ts.Run(c.desc, func() {
			require.NoError(ts.T(), models.ClearAllOneTimeTokensForUser(ts.API.db, u.ID))

			// Create a session
			session, err := models.NewSession(u.ID, nil)
			require.NoError(ts.T(), err)
			require.NoError(ts.T(), ts.API.db.Create(session))

			// Add AMR claim to session to simulate recovery flow
			require.NoError(ts.T(), models.AddClaimToSession(ts.API.db, session.ID, c.recoveryType))