golem15/sm-user-plugin
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

test: change-password still requires the current password (PHP map)

Browse Source 
TestChangePassword/real_password_account_still_requires_current_password
ports the PHP OAuthPasswordBootstrapTest case: a missing or wrong
current_password is a 422 with the unchanged body, and the password stays.
This commit is contained in:
Jakub Zych
2026-10-21 01:23:13 +02:00
parent d6d8f117ea
commit c7635c56e3
1 changed files with 23 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
profile_test.go
View File

@@ -82,6 +82,29 @@ func TestChangePassword(t *testing.T) {
t.Fatalf("same password %d %s", same.Code, same.Body.String())
}
// PHP OAuthPasswordBootstrapTest::test_real_password_account_still_requires_current_password:
// a self-set password still needs current_password, and a wrong one is
// refused with the unchanged invalid_login body; the password stays.
t.Run("real_password_account_still_requires_current_password", func(t *testing.T) {
missing := bearerJSON(t, controllers.ChangePassword(app), "/_user/api/v1/change-password", token, `{"password":"another-password-2","password_confirmation":"another-password-2"}`)
var body map[string]any
if err := json.Unmarshal(missing.Body.Bytes(), &body); err != nil {
t.Fatal(err)
}
errs, _ := body["errors"].(map[string]any)
if missing.Code != http.StatusUnprocessableEntity || errs["current_password"] == nil {
t.Fatalf("missing current_password %d %s", missing.Code, missing.Body.String())
}
wrong := bearerJSON(t, controllers.ChangePassword(app), "/_user/api/v1/change-password", token, `{"current_password":"definitely-wrong","password":"another-password-2","password_confirmation":"another-password-2"}`)
if wrong.Code != http.StatusUnprocessableEntity || wrong.Body.String() != `{"error":"Invalid email or password","errors":{"current_password":["Invalid email or password"]}}` {
t.Fatalf("wrong current_password %d %s", wrong.Code, wrong.Body.String())
}
again := postJSON(t, controllers.Login(app), "/_user/api/v1/login", `{"email":"change@example.test","password":"brand-new-password"}`)
if again.Code != http.StatusOK {
t.Fatalf("the password changed: login %d %s", again.Code, again.Body.String())
}
})
locked := insertUser(t, gdb, "locked-password@example.test", "correct-horse")
if err := gdb.Model(locked).UpdateColumn("has_self_set_password", false).Error; err != nil {
t.Fatal(err)