Add admin password change flow (closes #65)

internal/handlers/profile_test.go

@@ -4,12 +4,15 @@ import (
 	"context"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
+	"strings"
 	"testing"
 
 	"github.com/go-chi/chi"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"sneak.berlin/go/webhooker/internal/config"
+	"sneak.berlin/go/webhooker/internal/database"
 	"sneak.berlin/go/webhooker/internal/handlers"
 	"sneak.berlin/go/webhooker/internal/logger"
 	"sneak.berlin/go/webhooker/internal/middleware"
@@ -157,3 +160,134 @@ func TestUserRoute_Unauthenticated_RedirectedByMiddleware(t *testing.T) {
 	assert.Equal(t, http.StatusSeeOther, w.Code)
 	assert.Equal(t, "/pages/login", w.Header().Get("Location"))
 }
+
+// passwordChangeRequest builds a POST request to the password-change
+// endpoint for the given username, attaching the supplied cookies, an
+// urlencoded form body, and the chi URL parameter the handler reads.
+func passwordChangeRequest(
+	username string,
+	cookies []*http.Cookie,
+	form url.Values,
+) *http.Request {
+	req := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodPost,
+		"/user/"+username+"/password",
+		strings.NewReader(form.Encode()),
+	)
+	req.Header.Set(
+		"Content-Type", "application/x-www-form-urlencoded",
+	)
+
+	for _, c := range cookies {
+		req.AddCookie(c)
+	}
+
+	rctx := chi.NewRouteContext()
+	rctx.URLParams.Add("username", username)
+
+	return req.WithContext(
+		context.WithValue(req.Context(), chi.RouteCtxKey, rctx),
+	)
+}
+
+func TestHandlePasswordChange_Success(t *testing.T) {
+	t.Parallel()
+
+	var h *handlers.Handlers
+
+	var sess *session.Session
+
+	var db *database.Database
+
+	app := newTestApp(t, &h, &sess, &db)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	oldHash, err := database.HashPassword("oldpassword")
+	require.NoError(t, err)
+
+	user := &database.User{Username: "pwuser", Password: oldHash}
+	require.NoError(t, db.DB().Create(user).Error)
+
+	cookies := authenticatedCookies(t, sess, user.ID, "pwuser")
+
+	form := url.Values{}
+	form.Set("current_password", "oldpassword")
+	form.Set("new_password", "newpassword")
+	form.Set("confirm_password", "newpassword")
+
+	req := passwordChangeRequest("pwuser", cookies, form)
+	w := httptest.NewRecorder()
+
+	h.HandlePasswordChange().ServeHTTP(w, req)
+
+	assert.Equal(t, http.StatusOK, w.Code)
+	assert.Contains(
+		t, w.Body.String(), "Password changed successfully.",
+	)
+
+	var updated database.User
+
+	require.NoError(t,
+		db.DB().Where("username = ?", "pwuser").First(&updated).Error,
+	)
+	assert.NotEqual(t, oldHash, updated.Password)
+
+	valid, err := database.VerifyPassword(
+		"newpassword", updated.Password,
+	)
+	require.NoError(t, err)
+	assert.True(t, valid, "new password should verify against new hash")
+}
+
+func TestHandlePasswordChange_WrongCurrentPassword(t *testing.T) {
+	t.Parallel()
+
+	var h *handlers.Handlers
+
+	var sess *session.Session
+
+	var db *database.Database
+
+	app := newTestApp(t, &h, &sess, &db)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	oldHash, err := database.HashPassword("oldpassword")
+	require.NoError(t, err)
+
+	user := &database.User{Username: "pwuser2", Password: oldHash}
+	require.NoError(t, db.DB().Create(user).Error)
+
+	cookies := authenticatedCookies(t, sess, user.ID, "pwuser2")
+
+	form := url.Values{}
+	form.Set("current_password", "wrongpassword")
+	form.Set("new_password", "newpassword")
+	form.Set("confirm_password", "newpassword")
+
+	req := passwordChangeRequest("pwuser2", cookies, form)
+	w := httptest.NewRecorder()
+
+	h.HandlePasswordChange().ServeHTTP(w, req)
+
+	assert.Equal(t, http.StatusOK, w.Code)
+	assert.Contains(
+		t, w.Body.String(), "Current password is incorrect.",
+	)
+
+	var unchanged database.User
+
+	require.NoError(t,
+		db.DB().Where(
+			"username = ?", "pwuser2",
+		).First(&unchanged).Error,
+	)
+	assert.Equal(
+		t, oldHash, unchanged.Password,
+		"stored hash must be unchanged after a rejected change",
+	)
+}