Add auth update endpoint

scripts/seed-database.ts

@@ -48,7 +48,7 @@ async function truncateTables (connection: Connection) {
 
 async function seedUsers (connection: Connection) {
   const usernames = ['basic', 'moderator', 'admin']
-  const hash = await scryptHash('password123$')
+  const hash = await scryptHash('Password123$')
 
   // The goal here is to create a role hierarchy
   // E.g. an admin should have all the roles

src/routes/api/users/index.ts

@@ -0,0 +1,74 @@
+import {
+  FastifyPluginAsyncTypebox,
+  Type
+} from '@fastify/type-provider-typebox'
+import { Auth } from '../../../schemas/auth.js'
+import { UpdateCredentialsSchema } from '../../../schemas/users.js'
+
+const plugin: FastifyPluginAsyncTypebox = async (fastify) => {
+  fastify.put(
+    '/update-password',
+    {
+      config: {
+        rateLimit: {
+          max: 3,
+          timeWindow: '1 minute'
+        }
+      },
+      schema: {
+        body: UpdateCredentialsSchema,
+        response: {
+          200: Type.Object({
+            message: Type.String()
+          }),
+          401: Type.Object({
+            message: Type.String()
+          })
+        },
+        tags: ['Users']
+      }
+    },
+    async function (request, reply) {
+      const { newPassword, currentPassword } = request.body
+      const username = request.session.user.username
+
+      try {
+        const user = await fastify.knex<Auth>('users')
+          .select('username', 'password')
+          .where({ username })
+          .first()
+
+        if (!user) {
+          return reply.code(401).send({ message: 'User does not exist.' })
+        }
+
+        const isPasswordValid = await fastify.compare(
+          currentPassword,
+          user.password
+        )
+
+        if (!isPasswordValid) {
+          return reply.code(401).send({ message: 'Invalid current password.' })
+        }
+
+        if (newPassword === currentPassword) {
+          reply.status(400)
+          return { message: 'New password cannot be the same as the current password.' }
+        }
+
+        const hashedPassword = await fastify.hash(newPassword)
+        await fastify.knex('users')
+          .update({
+            password: hashedPassword
+          })
+          .where({ username })
+
+        return { message: 'Password updated successfully' }
+      } catch (error) {
+        reply.internalServerError('An error occurred while updating the password.')
+      }
+    }
+  )
+}
+
+export default plugin

src/schemas/users.ts

@@ -0,0 +1,14 @@
+import { Type } from '@sinclair/typebox'
+
+const passwordPattern = '^(?=.*?[A-Z])(?=.*?[a-z])(?=.*?[0-9])(?=.*?[#?!@$%^&*-]).*$'
+
+const PasswordSchema = Type.String({
+  pattern: passwordPattern,
+  minLength: 8
+
+})
+
+export const UpdateCredentialsSchema = Type.Object({
+  currentPassword: PasswordSchema,
+  newPassword: PasswordSchema
+})

test/helper.ts

@@ -27,7 +27,7 @@ async function login (this: FastifyInstance, username: string) {
     url: '/api/auth/login',
     payload: {
       username,
-      password: 'password123$'
+      password: 'Password123$'
     }
   })
 

test/routes/api/auth/auth.test.ts

@@ -17,7 +17,7 @@ test('Transaction should rollback on error', async (t) => {
     url: '/api/auth/login',
     payload: {
       username: 'basic',
-      password: 'password123$'
+      password: 'Password123$'
     }
   })
 
@@ -39,7 +39,7 @@ test('POST /api/auth/login with valid credentials', async (t) => {
     url: '/api/auth/login',
     payload: {
       username: 'basic',
-      password: 'password123$'
+      password: 'Password123$'
     }
   })
 

test/routes/api/users/users.test.ts

@@ -0,0 +1,150 @@
+import { it, describe, beforeEach, afterEach } from 'node:test'
+import assert from 'node:assert'
+import { build } from '../../../helper.js'
+import { FastifyInstance } from 'fastify'
+import { scryptHash } from '../../../../src/plugins/custom/scrypt.js'
+
+async function createUser (app: FastifyInstance, userData: Partial<{ username: string; password: string }>) {
+  const [id] = await app.knex('users').insert(userData)
+  return id
+}
+
+async function deleteUser (app: FastifyInstance, username: string) {
+  await app.knex('users').delete().where({ username })
+}
+
+async function updatePasswordWithLoginInjection (app: FastifyInstance, username: string, payload: { currentPassword: string; newPassword: string }) {
+  return await app.injectWithLogin(username, {
+    method: 'PUT',
+    url: '/api/users/update-password',
+    payload
+  })
+}
+
+describe('Users API', async () => {
+  const hash = await scryptHash('Password123$')
+  let app: FastifyInstance
+
+  beforeEach(async () => {
+    app = await build()
+  })
+
+  afterEach(async () => {
+    await app.close()
+  })
+
+  it('Should update the password successfully', async () => {
+    await createUser(app, { username: 'random-user-0', password: hash })
+    const res = await updatePasswordWithLoginInjection(app, 'random-user-0', {
+      currentPassword: 'Password123$',
+      newPassword: 'NewPassword123$'
+    })
+
+    assert.strictEqual(res.statusCode, 200)
+    assert.deepStrictEqual(JSON.parse(res.payload), { message: 'Password updated successfully' })
+
+    await deleteUser(app, 'random-user-0')
+  })
+
+  it('Should return 400 if the new password is the same as current password', async () => {
+    await createUser(app, { username: 'random-user-1', password: hash })
+    const res = await updatePasswordWithLoginInjection(app, 'random-user-1', {
+      currentPassword: 'Password123$',
+      newPassword: 'Password123$'
+    })
+
+    assert.strictEqual(res.statusCode, 400)
+    assert.deepStrictEqual(JSON.parse(res.payload), { message: 'New password cannot be the same as the current password.' })
+
+    await deleteUser(app, 'random-user-1')
+  })
+
+  it('Should return 400 if the newPassword password not match the required pattern', async () => {
+    await createUser(app, { username: 'random-user-2', password: hash })
+    const res = await updatePasswordWithLoginInjection(app, 'random-user-2', {
+      currentPassword: 'Password123$',
+      newPassword: 'password123$'
+    })
+
+    assert.strictEqual(res.statusCode, 400)
+    assert.deepStrictEqual(JSON.parse(res.payload), { message: 'body/newPassword must match pattern "^(?=.*?[A-Z])(?=.*?[a-z])(?=.*?[0-9])(?=.*?[#?!@$%^&*-]).*$"' })
+
+    await deleteUser(app, 'random-user-2')
+  })
+
+  it('Should return 401 the current password is incorrect', async () => {
+    await createUser(app, { username: 'random-user-3', password: hash })
+    const res = await updatePasswordWithLoginInjection(app, 'random-user-3', {
+      currentPassword: 'WrongPassword123$',
+      newPassword: 'Password123$'
+    })
+
+    assert.strictEqual(res.statusCode, 401)
+    assert.deepStrictEqual(JSON.parse(res.payload), { message: 'Invalid current password.' })
+
+    await deleteUser(app, 'random-user-3')
+  })
+
+  it('Should return 401 if user does not exist in the database', async () => {
+    await createUser(app, { username: 'random-user-4', password: hash })
+    const loginResponse = await app.injectWithLogin('random-user-4', {
+      method: 'POST',
+      url: '/api/auth/login',
+      payload: {
+        username: 'random-user-4',
+        password: 'Password123$'
+      }
+    })
+
+    assert.strictEqual(loginResponse.statusCode, 200)
+
+    await deleteUser(app, 'random-user-4')
+
+    app.config = {
+      ...app.config,
+      COOKIE_SECRET: loginResponse.cookies[0].value
+    }
+
+    const res = await app.inject({
+      method: 'PUT',
+      url: '/api/users/update-password',
+      payload: {
+        currentPassword: 'Password123$',
+        newPassword: 'NewPassword123$'
+      },
+      cookies: {
+        [app.config.COOKIE_NAME]: loginResponse.cookies[0].value
+      }
+    })
+
+    assert.strictEqual(res.statusCode, 401)
+    assert.deepStrictEqual(JSON.parse(res.payload), { message: 'User does not exist.' })
+    await deleteUser(app, 'random-user-4')
+  })
+
+  it('Should enforce rate limiting by returning a 429 status after exceeding 3 password update attempts within 1 minute', async () => {
+    const updatePassword = async () => {
+      return await updatePasswordWithLoginInjection(app, 'random-user-5', {
+        currentPassword: 'WrongPassword123$',
+        newPassword: 'Password123$'
+      })
+    }
+
+    const performMultiplePasswordUpdates = async () => {
+      for (let i = 0; i < 3; i++) {
+        await updatePassword()
+      }
+    }
+
+    await createUser(app, { username: 'random-user-5', password: hash })
+
+    await performMultiplePasswordUpdates()
+
+    const res = await updatePassword()
+
+    assert.strictEqual(res.statusCode, 429)
+    assert.equal(res.payload, '{"message":"Rate limit exceeded, retry in 1 minute"}')
+
+    await deleteUser(app, 'random-user-5')
+  })
+})