feat(dashboard): Force password change on user

config/test.js

@@ -9,13 +9,13 @@ module.exports = {
     },
   },
   mongodb: {
-    host: 'mongo',
+    host: 'localhost',
     port: 27017,
     database: 'lvconnect_test',
   },
   kue: {
     redis: {
-      host: 'redis',
+      host: 'localhost',
       port: 6379,
       db: 0,
     },

package.json

@@ -62,7 +62,6 @@
     "chai": "^3.5.0",
     "eslint": "^3.8.1",
     "eslint-config-airbnb-base": "^11.0.0",
-    "eslint-plugin-babel": "^4.0.0",
     "eslint-plugin-import": "^2.0.1",
     "mocha": "^3.0.2",
     "nodemon": "^1.10.2"

server/dashboard/index.js

@@ -17,6 +17,21 @@ exports.register = (server, options, next) => {
   });
   server.route(routes);
 
+  // Middleware to force user to reset his password
+  const ignoredRoutes = ['/assets', '/login', '/change-password'];
+  server.ext({
+    type: 'onPreHandler',
+    method(req, res) {
+      if (!ignoredRoutes.some(r => req.path.includes(r)) && req.auth.credentials.needPasswordChange) {
+        return res().redirect('/dashboard/change-password');
+      }
+      return res.continue();
+    },
+    options: {
+      sandbox: 'plugin',
+    },
+  });
+
   next();
 };
 

server/dashboard/routes/get-change-password.js

@@ -0,0 +1,10 @@
+module.exports = {
+  method: 'GET',
+  path: '/dashboard/change-password',
+  config: { auth: 'session' },
+  handler(req, res) {
+    res.view('change-password', {
+      pageTitle: 'Password change',
+    });
+  },
+};

server/dashboard/routes/index.js

@@ -13,6 +13,8 @@ const getEditApplication = require('./get-edit-app');
 const postCreateApplication = require('./post-create-app');
 const postEditApplication = require('./post-edit-app');
 const deleteApplication = require('./delete-app');
+const getChangePassword = require('./get-change-password');
+const postChangePassword = require('./post-change-password');
 
 module.exports = [
   getDashboard,
@@ -30,4 +32,6 @@ module.exports = [
   postCreateApplication,
   postEditApplication,
   deleteApplication,
+  getChangePassword,
+  postChangePassword,
 ];

server/dashboard/routes/post-change-password.js

@@ -0,0 +1,46 @@
+const Joi = require('joi');
+
+module.exports = {
+  method: 'POST',
+  path: '/dashboard/change-password',
+  config: {
+    auth: 'session',
+    validate: {
+      payload: {
+        plainPassword: Joi.string().min(6).required(),
+        plainPasswordCheck: Joi.string().required(),
+      },
+    },
+  },
+  handler(req, res) {
+    if (req.payload.plainPassword !== req.payload.plainPasswordCheck) {
+      return res.view('change-password', {
+        pageTitle: 'Password change',
+        error: 'Passwords don\'t match',
+      }).code(401);
+    }
+
+    const user = req.auth.credentials;
+
+    return user.comparePassword(req.payload.plainPassword)
+      .then((isSamePassword) => {
+        if (isSamePassword) {
+          return res.view('change-password', {
+            pageTitle: 'Password change',
+            error: 'You must choose a password different from the previous one',
+          }).code(401);
+        }
+
+        return user.hashPassword(req.payload.plainPassword)
+          .then(() => {
+            user.needPasswordChange = false;
+            return user.save();
+          })
+          .then(() => res.redirect('/dashboard'));
+      })
+      .catch(() => res.view('change-password', {
+        pageTitle: 'Password change',
+        error: 'An unknown error occurred',
+      }).code(401));
+  },
+};

server/dashboard/routes/post-create-user.js

@@ -14,14 +14,14 @@ module.exports = {
         firstName: Joi.string().min(2).required(),
         lastName: Joi.string().min(2).required(),
         plainPassword: Joi.string().min(6).required(),
+        plainPasswordCheck: Joi.string().required(),
         email: Joi.string().email().required(),
         description: Joi.string().max(255).allow(''),
         roles: Joi.array().items(Joi.string().valid(validRoles)).min(1).single()
           .required(),
         githubHandle: Joi.string().allow(''),
         trelloHandle: Joi.string().allow(''),
         city: Joi.string().valid(validCities).required(),
-        plainPasswordCheck: Joi.string().required(),
       }),
       failAction: (req, res, src, error) => {
         res.view('create-user', {

server/dashboard/views/change-password.hbs

@@ -0,0 +1,31 @@
+<div class="mdl-grid">
+  <form class="mdl-cell mdl-cell--6-col mdl-cell--3-offset-desktop mdl-cell--1-offset-tablet mdl-card mdl-shadow--2dp"
+        method="POST">
+    <div class="mdl-card__title">
+      <h2 class="mdl-card__title-text">Change password</h2>
+    </div>
+    <div class="mdl-card__supporting-text mdl-grid">
+      You've been requested to change your password for security reasons. Choose a new password bellow :
+
+      <div class="mdl-cell mdl-cell--6-col mdl-cell--8-col-tablet mdl-textfield mdl-js-textfield mdl-textfield--floating-label">
+        <input class="mdl-textfield__input" type="password" id="plainPasswordInput" name="plainPassword" pattern=".{6,}" required>
+        <label class="mdl-textfield__label" for="plainPasswordInput">Password</label>
+      </div>
+
+      <div class="mdl-cell mdl-cell--6-col mdl-cell--8-col-tablet mdl-textfield mdl-js-textfield mdl-textfield--floating-label">
+        <input class="mdl-textfield__input" type="password" id="plainPasswordCheckInput" name="plainPasswordCheck" pattern=".{6,}" required>
+        <label class="mdl-textfield__label" for="plainPasswordCheckInput">Repeat Password</label>
+      </div>
+
+      {{ error }}
+
+      <input type="hidden" name="crumb" value="{{crumb}}">
+    </div>
+
+    <div class="mdl-card__actions mdl-card--border">
+      <button class="mdl-button mdl-button--colored mdl-js-button mdl-js-ripple-effect" type="submit">
+        Save
+      </button>
+    </div>
+  </form>
+</div>

server/users/models/user.model.js

@@ -18,6 +18,7 @@ const userSchema = new mongoose.Schema({
   createdAt: { type: Date, default: Date.now },
   description: String,
   city: String,
+  needPasswordChange: { type: Boolean, default: true },
 });
 
 userSchema.virtual('profilePictureUrl').get(function getProfilePictureUrl(value) {

server/users/routes/cget-users.js

@@ -25,7 +25,7 @@ module.exports = {
       .where(email ? { email: { $eq: email } } : null)
       .limit(limit)
       .skip(page * limit || 0)
-      .select('-password -thirdParty')
+      .select('-password -thirdParty -needPasswordChange')
       .exec();
 
     const countPromise = User.count();

server/users/routes/get-me.js

@@ -7,6 +7,6 @@ module.exports = {
     pre: [hasScopeInList('profile:get')],
   },
   handler(req, res) {
-    return res.mongodb(req.auth.credentials.user, ['password']);
+    return res.mongodb(req.auth.credentials.user, ['password', 'thirdParty', 'needPasswordChange']);
   },
 };

server/users/routes/get-users.js

@@ -21,7 +21,7 @@ module.exports = {
 
     const userPromise = User
       .findOne({ _id: req.params.user })
-      .select('-password -thirdParty')
+      .select('-password -thirdParty -needPasswordChange')
       .exec()
       .then((user) => {
         if (!user) {

server/users/routes/post-users.js

@@ -41,6 +41,6 @@ module.exports = {
         return Promise.reject(Boom.wrap(err));
       });
 
-    res.mongodb(userPromise, ['password']).code(201);
+    res.mongodb(userPromise, ['password', 'thirdParty', 'needPasswordChange']).code(201);
   },
 };

server/users/routes/put-users.js

@@ -52,6 +52,6 @@ module.exports = {
         return Promise.resolve(savedUser);
       });
 
-    return res.mongodb(userPromise, ['password', 'thirdParty']);
+    return res.mongodb(userPromise, ['password', 'thirdParty', 'needPasswordChange']);
   },
 };

test/.eslintrc

@@ -1,19 +1,14 @@
 {
   "parser": "babel-eslint",
   "extends": ["airbnb-base"],
-  "plugins": [
-    "babel"
-  ],
   "env": {
     "node": true,
     "mocha": true
   },
   "rules": {
     "prefer-arrow-callback": 0,
-    "generator-star-spacing": 0,
     "func-names": 0,
     "import/no-extraneous-dependencies": 0,
-    "babel/generator-star-spacing": 1,
     "no-underscore-dangle": 0
   }
 }

yarn.lock

@@ -1095,10 +1095,6 @@ eslint-module-utils@^2.0.0:
     debug "2.2.0"
     pkg-dir "^1.0.0"
 
-eslint-plugin-babel@^4.0.0:
-  version "4.0.1"
-  resolved "https://registry.yarnpkg.com/eslint-plugin-babel/-/eslint-plugin-babel-4.0.1.tgz#77de74dabd67a6bef3b16bf258f5804e971e7349"
-
 eslint-plugin-import@^2.0.1:
   version "2.2.0"
   resolved "https://registry.yarnpkg.com/eslint-plugin-import/-/eslint-plugin-import-2.2.0.tgz#72ba306fad305d67c4816348a4699a4229ac8b4e"