public async Task ChangePassword__User_Can_Change_Password()
{
User user = Factory.UserFactory.GetModel();
user.Email = user.Email.ToLower();
await Context.Users.AddAsync(user);
await Context.SaveChangesAsync();
await LogInAs(user.Email);
AuthChangePasswordRequest changePasswordRequest = Factory.Auth.AuthChangePasswordRequest();
var response = await Client.PutAsJsonAsync(ApiRoutes.Auth.ChangePassword, changePasswordRequest);
response.StatusCode.Should().Be(HttpStatusCode.OK);
// AsNoTracking - Refresh User context to get changes after update update in controller
var updatedUser = await Context.Users.AsNoTracking().FirstOrDefaultAsync(x => x.Email == user.Email);
var authHelper = new AuthHelper();
updatedUser.PasswordHash.Should().NotEqual(user.PasswordHash);
updatedUser.PasswordSalt.Should().NotEqual(user.PasswordSalt);
bool valid = authHelper.VerifyPasswordHash(changePasswordRequest.NewPassword, updatedUser.PasswordHash, updatedUser.PasswordSalt);
valid.Should().BeTrue();
}
public async Task <IActionResult> ChangePassword([FromBody] AuthChangePasswordRequest request)
{
var authResponse = await _authService.ChangePasswordAsync(request);
if (!authResponse.Success)
{
return(BadRequest(new ErrorResponse(authResponse.Error)));
}
return(Ok());
}
public async Task <AuthenticationResult> ChangePasswordAsync(AuthChangePasswordRequest request)
{
var user = _context.Users.FirstOrDefault(x => x.Id == _authHelper.GetAuthenticatedUserId());
if (user == null)
{
return new AuthenticationResult {
Error = "Użytkownik nie istnieje"
}
}
;
if (!_authHelper.VerifyPasswordHash(request.OldPassword, user.PasswordHash, user.PasswordSalt))
{
return new AuthenticationResult {
Error = "Podano błędne stare hasło"
}
}
;
_authHelper.CreatePasswordHash(request.NewPassword, out byte[] passwordHash, out byte[] passwordSalt);
user.PasswordHash = passwordHash;
user.PasswordSalt = passwordSalt;
_context.Users.Update(user);
if (await _context.SaveChangesAsync() <= 0)
{
return new AuthenticationResult {
Error = "Zmiana hasła nie powiodła się"
}
}
;
return(new AuthenticationResult
{
Success = true,
Token = "",
RefreshToken = ""
});
}