Ryan/documenso
1
0
Fork 1
mirror of https://github.com/documenso/documenso.git synced 2025-11-12 15:53:02 +10:00
Code Issues Packages Projects Releases Wiki Activity

feat: require old password for password reset (#488)

Browse Source 
* feat: require old password for password reset
This commit is contained in:
Udit Takkar
2023-10-04 09:53:57 +05:30
committed by Mythie
parent 02bb7e4d68
commit 78d2401d44
4 changed files with 63 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
packages/lib/server-only/user/update-password.ts
View File

@ -7,9 +7,14 @@ import { SALT_ROUNDS } from '../../constants/auth';
export type UpdatePasswordOptions = {
userId: number;
password: string;
currentPassword: string;
};
export const updatePassword = async ({ userId, password }: UpdatePasswordOptions) => {
export const updatePassword = async ({
userId,
password,
currentPassword,
}: UpdatePasswordOptions) => {
// Existence check
const user = await prisma.user.findFirstOrThrow({
where: {
@ -17,23 +22,29 @@ export const updatePassword = async ({ userId, password }: UpdatePasswordOptions
},
});
const hashedPassword = await hash(password, SALT_ROUNDS);
if (user.password) {
// Compare the new password with the old password
const isSamePassword = await compare(password, user.password);
if (isSamePassword) {
throw new Error('Your new password cannot be the same as your old password.');
}
if (!user.password) {
throw new Error('User has no password');
}
const isCurrentPasswordValid = await compare(currentPassword, user.password);
if (!isCurrentPasswordValid) {
throw new Error('Current password is incorrect.');
}
// Compare the new password with the old password
const isSamePassword = await compare(password, user.password);
if (isSamePassword) {
throw new Error('Your new password cannot be the same as your old password.');
}
const hashedNewPassword = await hash(password, SALT_ROUNDS);
const updatedUser = await prisma.user.update({
where: {
id: userId,
},
data: {
password: hashedPassword,
password: hashedNewPassword,
},
});