public async Task resetpassword_command_should_fail_if_token_is_invalid()
{
var id = new AggregateId();
var email = "*****@*****.**";
var fullname = "fullname";
var updatedFullname = "updatedfullname";
var password = "******";
var newPassword = "******";
var pic = "test.nl/image";
var role = Role.User;
var securityStamp = Guid.NewGuid().ToString();
var invalidSecurityStamp = Guid.NewGuid().ToString();
// Add user
var user = new User(id, email, fullname, pic, password, role, securityStamp, 0, DateTime.MinValue, DateTime.UtcNow,
new string[] { });
await _mongoDbFixture.InsertAsync(user.AsDocument());
// generate reset token
var token = await _dataProtectorTokenProvider.GenerateAsync(Purpose, id, invalidSecurityStamp);
var command = new ResetPassword(id, newPassword, token);
_commandHandler
.Awaiting(c => c.HandleAsync(command))
.Should().Throw <InvalidTokenException>();
}
public async Task resetpassword_endpoint_should_return_error_when_token_is_invalid()
{
var id = new AggregateId();
var email = "*****@*****.**";
var fullname = "fullname";
var password = "******";
var newPassword = "******";
var pic = "test.nl/image";
var role = Role.User;
var securityStamp = Guid.NewGuid().ToString();
var invalidSecurityStamp = Guid.NewGuid().ToString();
// Add user
var user = new User(id, email, fullname, pic, password, role, securityStamp, 0, DateTime.MinValue, DateTime.UtcNow,
new string[] { });
await _mongoDbFixture.InsertAsync(user.AsDocument());
// generate reset token
var token = await _dataProtectorTokenProvider.GenerateAsync(Purpose, id, invalidSecurityStamp);
var command = new ResetPassword(id, newPassword, token);
var response = await Act(command);
response.Should().NotBeNull();
response.StatusCode.Should().Be(HttpStatusCode.BadRequest);
}
public async Task dataprotectortokenprovider_should_be_able_to_validate_given_token()
{
var id = new AggregateId();
var purpose = "purpose";
var securityStamp = new Guid().ToString();
var generatedToken = await _dataProtectorTokenProvider.GenerateAsync(purpose, id, securityStamp);
var result = await _dataProtectorTokenProvider.ValidateAsync(purpose, generatedToken, id, securityStamp);
result.Should().BeTrue();
}
public async Task HandleAsync(ForgotPassword command)
{
var user = await _userRepository.GetAsync(command.Email);
if (user is null)
{
_logger.LogError($"Email does not exist: {command.Email}");
throw new InvalidEmailException(command.Email);
}
var token = await _dataProtector.GenerateAsync(Purpose, user.Id, user.SecurityStamp);
await _messageBroker.PublishAsync(new PasswordForgotten(user.Id, user.Fullname, user.Email, token));
}