bvandeusenandClaude Opus 5.5
755f997b0d
Sessions had no server-side expiry: only the web cookie's 30-day Max-Age limited them, and a bearer token (Android) lived until revoked by hand. GetSessionByTokenHash and ListSessionsForUser now ignore sessions idle for 30 days or older than a year, and the GC worker deletes them hourly. A password change was a plain UPDATE, so a session opened with the old password survived it. Now: - self-service change signs out every other device and keeps this one; - reset by email ends every session the account has; - an admin reset ends the target's sessions (keeping the admin's own when they reset themselves). The success copy on web and Android says the other devices were signed out. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
82 lines
2.6 KiB
Go
82 lines
2.6 KiB
Go
package api
|
|
|
|
import (
|
|
"encoding/json"
|
|
"net/http"
|
|
|
|
"golang.org/x/crypto/bcrypt"
|
|
|
|
"git.fabledsword.com/bvandeusen/minstrel/internal/apierror"
|
|
"git.fabledsword.com/bvandeusen/minstrel/internal/audit"
|
|
"git.fabledsword.com/bvandeusen/minstrel/internal/auth"
|
|
"git.fabledsword.com/bvandeusen/minstrel/internal/db/dbq"
|
|
)
|
|
|
|
type changePasswordReq struct {
|
|
CurrentPassword string `json:"current_password"`
|
|
NewPassword string `json:"new_password"`
|
|
}
|
|
|
|
// handleChangePassword implements PUT /api/me/password. Self-service:
|
|
// the caller proves they know their current password before they can
|
|
// set a new one. Distinct from the admin-driven reset path.
|
|
func (h *handlers) handleChangePassword(w http.ResponseWriter, r *http.Request) {
|
|
user, ok := requireUser(w, r)
|
|
if !ok {
|
|
return
|
|
}
|
|
var req changePasswordReq
|
|
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
|
writeErr(w, apierror.BadRequest("invalid_body", ""))
|
|
return
|
|
}
|
|
if len(req.NewPassword) < minPasswordLength {
|
|
writeErr(w, apierror.BadRequest("password_too_short", "password must be at least 8 chars"))
|
|
return
|
|
}
|
|
|
|
q := dbq.New(h.pool)
|
|
current, err := q.GetUserByID(r.Context(), user.ID)
|
|
if err != nil {
|
|
h.logger.Error("change password: lookup failed", "err", err)
|
|
writeErr(w, apierror.Internal(err))
|
|
return
|
|
}
|
|
if err := bcrypt.CompareHashAndPassword([]byte(current.PasswordHash), []byte(req.CurrentPassword)); err != nil {
|
|
writeErr(w, apierror.Unauthorized("wrong_password", ""))
|
|
return
|
|
}
|
|
|
|
hash, err := bcrypt.GenerateFromPassword([]byte(req.NewPassword), bcrypt.DefaultCost)
|
|
if err != nil {
|
|
h.logger.Error("change password: hash failed", "err", err)
|
|
writeErr(w, apierror.Internal(err))
|
|
return
|
|
}
|
|
if err := q.ChangeUserPassword(r.Context(), dbq.ChangeUserPasswordParams{
|
|
ID: user.ID,
|
|
PasswordHash: string(hash),
|
|
}); err != nil {
|
|
h.logger.Error("change password: update failed", "err", err)
|
|
writeErr(w, apierror.Internal(err))
|
|
return
|
|
}
|
|
|
|
// Sign out every other device. A password change is often the response
|
|
// to suspecting someone else has it, and their session would otherwise
|
|
// outlive the password it was opened with. The device making the change
|
|
// stays signed in.
|
|
if sessID, ok := auth.SessionIDFromContext(r.Context()); ok {
|
|
if _, err := q.DeleteOtherSessionsForUser(r.Context(), dbq.DeleteOtherSessionsForUserParams{
|
|
UserID: user.ID,
|
|
ID: sessID,
|
|
}); err != nil {
|
|
h.logger.Error("change password: revoke other sessions failed", "err", err)
|
|
}
|
|
}
|
|
|
|
audit.WriteOrLog(r.Context(), h.pool, h.logger, user.ID, user.ID, audit.ActionPasswordChangeSelf, nil)
|
|
|
|
w.WriteHeader(http.StatusNoContent)
|
|
}
|