feat: forgot/reset password API (variant A). Fixes EventHub/EventHubBack#57

test/unit/admin_handler_user_password_reset_token_tests.erl

@@ -0,0 +1,83 @@
+-module(admin_handler_user_password_reset_token_tests).
+-include_lib("eunit/include/eunit.hrl").
+-include("records.hrl").
+
+-define(TABLES, [admin, admin_audit, user, password_reset, ticket]).
+-define(ADMIN_ID, <<"adm_pwreset_1">>).
+
+setup() ->
+  eh_test_support:start_mnesia(),
+  eh_test_support:ensure_tables(?TABLES),
+  eh_test_support:ensure_jwt(),
+  eh_test_support:seed_admin(#{id => ?ADMIN_ID}),
+  ok.
+
+cleanup(_) ->
+  eh_test_support:unload_cowboy(),
+  eh_test_support:delete_tables(?TABLES),
+  eh_test_support:stop_mnesia(),
+  ok.
+
+admin_user_password_reset_token_test_() ->
+  {foreach, fun setup/0, fun cleanup/1, [
+    {"GET – create token", {timeout, 60, fun test_create/0}},
+    {"GET – reuse valid token", {timeout, 60, fun test_reuse/0}},
+    {"GET – user not found", {timeout, 60, fun test_not_found/0}},
+    {"GET – unauthorized", {timeout, 60, fun test_unauthorized/0}}
+  ]}.
+
+seed_user() ->
+  User = eh_test_support:make_user(#{
+    id => <<"u_pwreset">>,
+    email => <<"pwreset@test.local">>,
+    nickname => <<"pwreset">>,
+    status => active
+  }),
+  ok = mnesia:dirty_write(User),
+  User.
+
+test_create() ->
+  User = seed_user(),
+  Id = User#user.id,
+  {Status, _, Body} = eh_test_support:call(admin_handler_user_password_reset_token, #{
+    method => <<"GET">>,
+    path => <<"/v1/admin/users/", Id/binary, "/password-reset-token">>,
+    bindings => #{id => Id},
+    auth => ?ADMIN_ID
+  }),
+  ?assertEqual(200, Status),
+  Result = jsx:decode(Body, [return_maps]),
+  ?assert(is_binary(maps:get(<<"token">>, Result))),
+  ?assert(is_binary(maps:get(<<"expires_at">>, Result))).
+
+test_reuse() ->
+  User = seed_user(),
+  Id = User#user.id,
+  {ok, Token1, _} = core_password_reset:create_token(Id),
+  {Status, _, Body} = eh_test_support:call(admin_handler_user_password_reset_token, #{
+    method => <<"GET">>,
+    path => <<"/v1/admin/users/", Id/binary, "/password-reset-token">>,
+    bindings => #{id => Id},
+    auth => ?ADMIN_ID
+  }),
+  ?assertEqual(200, Status),
+  Result = jsx:decode(Body, [return_maps]),
+  ?assertEqual(Token1, maps:get(<<"token">>, Result)).
+
+test_not_found() ->
+  {Status, _, _} = eh_test_support:call(admin_handler_user_password_reset_token, #{
+    method => <<"GET">>,
+    path => <<"/v1/admin/users/missing/password-reset-token">>,
+    bindings => #{id => <<"missing">>},
+    auth => ?ADMIN_ID
+  }),
+  ?assertEqual(404, Status).
+
+test_unauthorized() ->
+  {Status, _, _} = eh_test_support:call(admin_handler_user_password_reset_token, #{
+    method => <<"GET">>,
+    path => <<"/v1/admin/users/x/password-reset-token">>,
+    bindings => #{id => <<"x">>},
+    auth => none
+  }),
+  ?assertEqual(401, Status).

test/unit/eh_test_support.erl

@@ -168,6 +168,8 @@ table_opts(session) ->
   [{ram_copies, [node()]}, {attributes, record_info(fields, session)}];
 table_opts(verification) ->
   [{ram_copies, [node()]}, {attributes, record_info(fields, verification)}];
+table_opts(password_reset) ->
+  [{ram_copies, [node()]}, {attributes, record_info(fields, password_reset)}];
 table_opts(admin_session) ->
   [{ram_copies, [node()]}, {attributes, record_info(fields, admin_session)}];
 table_opts(auth_session) ->

test/unit/logic_password_reset_tests.erl

@@ -0,0 +1,82 @@
+-module(logic_password_reset_tests).
+-include_lib("eunit/include/eunit.hrl").
+-include("records.hrl").
+
+-define(TABLES, [user, password_reset, auth_session]).
+
+setup() ->
+  eh_test_support:start_mnesia(),
+  eh_test_support:ensure_tables(?TABLES),
+  catch ets:new(eventhub_counters, [named_table, public, set, {write_concurrency, true}]),
+  ok.
+
+cleanup(_) ->
+  catch ets:delete(eventhub_counters),
+  eh_test_support:delete_tables(?TABLES),
+  eh_test_support:stop_mnesia(),
+  ok.
+
+logic_password_reset_test_() ->
+  {foreach, fun setup/0, fun cleanup/1, [
+    {"request_reset – active sends token", {timeout, 60, fun test_request_active/0}},
+    {"request_reset – pending silent", {timeout, 60, fun test_request_pending/0}},
+    {"reset_password – happy path + revoke sessions", {timeout, 60, fun test_reset_ok/0}},
+    {"reset_password – expired", {timeout, 60, fun test_reset_expired/0}},
+    {"reset_password – short password", {timeout, 60, fun test_short_password/0}}
+  ]}.
+
+seed_active() ->
+  {ok, Hash} = logic_auth:hash_password(<<"OldPass123">>),
+  User = eh_test_support:make_user(#{
+    id => <<"u_active_pw">>,
+    email => <<"active-pw@test.local">>,
+    status => active,
+    password_hash => Hash
+  }),
+  ok = mnesia:dirty_write(User),
+  User.
+
+seed_pending() ->
+  User = eh_test_support:make_user(#{
+    id => <<"u_pending_pw">>,
+    email => <<"pending-pw@test.local">>,
+    status => pending
+  }),
+  ok = mnesia:dirty_write(User),
+  User.
+
+test_request_active() ->
+  User = seed_active(),
+  ?assertEqual({ok, sent}, logic_password_reset:request_reset(User#user.email)),
+  Matches = mnesia:dirty_match_object(#password_reset{user_id = User#user.id, _ = '_'}),
+  ?assertMatch([_], Matches).
+
+test_request_pending() ->
+  User = seed_pending(),
+  ?assertEqual({ok, sent}, logic_password_reset:request_reset(User#user.email)),
+  Matches = mnesia:dirty_match_object(#password_reset{user_id = User#user.id, _ = '_'}),
+  ?assertEqual([], Matches).
+
+test_reset_ok() ->
+  User = seed_active(),
+  {ok, Session} = core_auth_session:create(User#user.id, user, <<"web">>),
+  {ok, Token, _} = core_password_reset:create_token(User#user.id),
+  ?assertEqual(ok, logic_password_reset:reset_password(Token, <<"NewPass456">>)),
+  {ok, Updated} = core_user:get_by_id(User#user.id),
+  ?assertMatch({ok, true}, logic_auth:verify_password(<<"NewPass456">>, Updated#user.password_hash)),
+  {ok, Sess2} = core_auth_session:get(Session#auth_session.session_id),
+  ?assertEqual(true, Sess2#auth_session.revoked),
+  ?assertEqual({error, not_found}, core_password_reset:verify_token(Token)).
+
+test_reset_expired() ->
+  User = seed_active(),
+  Past = calendar:gregorian_seconds_to_datetime(
+    calendar:datetime_to_gregorian_seconds(calendar:universal_time()) - 10),
+  Token = <<"expired_tok">>,
+  mnesia:dirty_write(#password_reset{token = Token, user_id = User#user.id, expires_at = Past}),
+  ?assertEqual({error, expired}, logic_password_reset:reset_password(Token, <<"NewPass456">>)).
+
+test_short_password() ->
+  User = seed_active(),
+  {ok, Token, _} = core_password_reset:create_token(User#user.id),
+  ?assertEqual({error, invalid_password}, logic_password_reset:reset_password(Token, <<"short">>)).