From 8b838cb997771b473555d542ff2491c3b1eaa0db Mon Sep 17 00:00:00 2001
From: Weston Haught <whaught@google.com>
Date: Wed, 23 Sep 2020 12:12:06 -0700
Subject: [PATCH 1/2] Allow user to change password

---
 cmd/server/assets/login/_loginscripts.html   |  93 ++++++++++-
 cmd/server/assets/login/account.html         |   2 +-
 cmd/server/assets/login/change-password.html | 153 +++++++++++++++++++
 cmd/server/assets/login/select-password.html |  97 +-----------
 cmd/server/main.go                           |   5 +-
 pkg/controller/login/change_password.go      |  64 ++++++++
 pkg/controller/login/select_password.go      |   4 +-
 pkg/controller/middleware/emailverified.go   |   2 +-
 8 files changed, 322 insertions(+), 98 deletions(-)
 create mode 100644 cmd/server/assets/login/change-password.html
 create mode 100644 pkg/controller/login/change_password.go

diff --git a/cmd/server/assets/login/_loginscripts.html b/cmd/server/assets/login/_loginscripts.html
index ed39d2e16..6cba421f8 100644
--- a/cmd/server/assets/login/_loginscripts.html
+++ b/cmd/server/assets/login/_loginscripts.html
@@ -80,4 +80,95 @@
     </div>
   </div>
 </div>
-{{end}}
\ No newline at end of file
+{{end}}
+
+{{define "login/pwd-validate-js"}}
+  {{if .requirements.HasRequirements}}
+  let $lenReq = $('#length-req');
+  let $upperReq = $('#upper-req');
+  let $lowerReq = $('#lower-req');
+  let $numReq = $('#num-req');
+  let $specialReq = $('#special-req');
+  {{end}}
+
+  function checkPasswordValid(pwd) {
+    {{if .requirements.HasRequirements}}
+    let upper = 0;
+    let lower = 0;
+    let digit = 0;
+    let special = 0;
+    let specialPattern = new RegExp(/[~`!#$%\^&*+=\-\[\]\\';,/{}|\\":<>\?]/);
+    for (let i = 0; i < pwd.length; i++) {
+      let c = pwd.charAt(i);
+      if (!isNaN(parseInt(c, 10))) {
+        digit++;
+      } else if (specialPattern.test(c)) {
+        special++;
+      } else if (c == c.toUpperCase()) {
+        upper++;
+      } else if (c == c.toLowerCase()) {
+        lower++;
+      }
+    }
+
+    let errClass = "oi oi-circle-x pr-1";
+    let checkClass = "oi oi-circle-check pr-1";
+
+    {{if gt .requirements.Length 0}}
+    if (pwd.length < {{.requirements.Length}}) {
+      $lenReq.find("#icon").attr("class", errClass)
+      $lenReq.addClass("text-danger");
+      return false;
+    } else {
+      $lenReq.find("#icon").attr("class", checkClass)
+      $lenReq.addClass("text-muted");
+    }
+    {{end}}
+
+    {{if gt .requirements.Uppercase 0}}
+    if (upper < {{.requirements.Uppercase}}) {
+      $upperReq.find("#icon").attr("class", errClass);
+      $upperReq.addClass("text-danger");
+      return false;
+    } else {
+      $upperReq.find("#icon").attr("class", checkClass);
+      $upperReq.addClass("text-muted");
+    }
+    {{end}}
+
+    {{if gt .requirements.Lowercase 0}}
+    if (lower < {{.requirements.Lowercase}}) {
+      $lowerReq.find("#icon").attr("class", errClass);
+      $lowerReq.addClass("text-danger");
+      return false;
+    } else {
+      $lowerReq.find("#icon").attr("class", checkClass);
+      $lowerReq.addClass("text-muted");
+    }
+    {{end}}
+
+    {{if gt .requirements.Number 0}}
+    if (digit < {{.requirements.Number}}) {
+      $numReq.find("#icon").attr("class", errClass);
+      $numReq.addClass("text-danger");
+      return false;
+    } else {
+      $numReq.find("#icon").attr("class", checkClass);
+      $numReq.addClass("text-muted");
+    }
+    {{end}}
+
+    {{if gt .requirements.Special 0}}
+    if (special < {{.requirements.Special}}) {
+      $specialReq.find("#icon").attr("class", errClass);
+      $specialReq.addClass("text-danger");
+      return false;
+    } else {
+      $specialReq.find("#icon").attr("class", checkClass);
+      $specialReq.addClass("text-muted");
+    }
+    {{end}}
+    {{end}}
+    return true;
+  }
+{{end}}
diff --git a/cmd/server/assets/login/account.html b/cmd/server/assets/login/account.html
index 7c6904f53..411b045cc 100644
--- a/cmd/server/assets/login/account.html
+++ b/cmd/server/assets/login/account.html
@@ -52,7 +52,7 @@ <h6 class="card-title  mt-3">System admin</h6>
         <li class="list-group-item">
           <div class="card-text">Password was last changed <span class="text-info">{{$user.PasswordAgeString}}</span>
             ago</div>
-          <a href="/login/change-password" class="card-link">Reset password</a>
+          <a href="/login/change-password" class="card-link">Change password</a>
         </li>
       </ul>
     </div>
diff --git a/cmd/server/assets/login/change-password.html b/cmd/server/assets/login/change-password.html
new file mode 100644
index 000000000..244e32744
--- /dev/null
+++ b/cmd/server/assets/login/change-password.html
@@ -0,0 +1,153 @@
+{{define "login/change-password"}}
+<!doctype html>
+<html lang="en">
+
+<head>
+  {{template "floatingform" .}}
+  {{template "head" .}}
+  {{template "firebase" .}}
+</head>
+
+<body class="tab-content">
+  {{template "navbar" .}}
+
+  <main role="main" class="container">
+    {{template "flash" .}}
+
+    <div class="d-flex vh-100">
+      <div class="d-flex w-100 justify-content-center align-self-center">
+        <div class="col-sm-6">
+          <div class="card shadow-sm">
+            <div class="card-header">Change password</div>
+            <div class="card-body">
+              <form id="passwordForm" class="floating-form" action="/login/change-password" method="POST">
+                {{.csrfField}}
+                <div class="form-label-group">
+                  <input type="email" id="email" name="email" class="form-control" placeholder="Email address"
+                  value="{{.currentUser.Email}}" required autofocus disabled/>
+                  <label for="email">Email address</label>
+                </div>
+
+                <div class="form-label-group mb-2">
+                  <input type="password" id="password" class="form-control" placeholder="Password"
+                    autocomplete="new-password" required />
+                  <label for="password">Password</label>
+                </div>
+                <div class="form-label-group">
+                  <input type="password" id="retype" class="form-control" placeholder="Retype password"
+                    autocomplete="new-password" required />
+                  <label for="retype">Retype password</label>
+                </div>
+
+                {{if .requirements.HasRequirements}}
+                <p class="card-text ml-4">
+                  <small class="form-text text-muted">
+                    <span class="row">Password should be:</span>
+                    {{if gt .requirements.Length 0}}
+                    <span class="row ml-1" id="length-req">
+                      <span id="icon"></span>At least {{.requirements.Length}} characters long
+                    </span>
+                    {{end}}
+                    {{if gt .requirements.Uppercase 0}}
+                    <span class="row ml-1" id="upper-req">
+                      <span id="icon"></span>Contain {{.requirements.Uppercase}} uppercase letter
+                    </span>
+                    {{end}}
+                    {{if gt .requirements.Lowercase 0}}
+                    <span class="row ml-1" id="lower-req">
+                      <span id="icon"></span>Contain {{.requirements.Lowercase}} lowercase letter
+                    </span>
+                    {{end}}
+                    {{if gt .requirements.Number 0}}
+                    <span class="row ml-1" id="num-req">
+                      <span id="icon"></span>Contain {{.requirements.Number}} number
+                    </span>
+                    {{end}}
+                    {{if gt .requirements.Special 0}}
+                    <span class="row ml-1" id="special-req">
+                      <span id="icon"></span>Contain {{.requirements.Special}} special character
+                    </span>
+                    {{end}}
+                  </small>
+                </p>
+                {{end}}
+
+                <button type="submit" id="submit" class="btn btn-primary btn-block" disabled>Set password</button>
+              </form>
+            </div>
+            <div class="card-body">
+              <a class="card-link" href="/">&larr; Login</a>
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+  </main>
+
+  {{template "scripts" .}}
+  <script type="text/javascript">
+    $(function() {
+      let $form = $('#passwordForm');
+      let $submit = $('#submit');
+      let $email = $('#email');
+      let $password = $('#password');
+      let $retype = $('#retype');
+
+      firebase.auth().onAuthStateChanged(function(user) {
+          if (!user) {
+            window.location.assign("/signout");
+            return;
+          }
+
+          $submit.prop('disabled', false);
+        });
+
+      $password.keyup(function() {
+        $submit.prop('disabled', !checkPasswordValid($password.val()));
+      });
+
+      $form.on('submit', function(event) {
+        try {
+          return changePassword();
+        } catch(e) {
+          return false;
+        }
+      });
+
+      function changePassword() {
+        let email = $email.val();
+        let pwd = $password.val();
+        if (pwd != $retype.val()) {
+          flash.error("Password and retyped passwords must match.");
+          return false;
+        }
+
+        if (!checkPasswordValid(pwd)) {
+          return false;
+        }
+
+        // Disable the submit button so we only attempt once.
+        $submit.prop('disabled', true);
+
+        return firebase.auth().currentUser.updatePassword(pwd)
+          .then(function() {
+            return true;
+          }).catch(function(error) {
+            if (err.code == 'auth/requires-recent-login') {
+              window.location.assign('/login?redir=login/change-password');
+            }
+
+            flash.clear();
+            flash.error(error);
+            $submit.prop('disabled', false);
+            return false;
+          });
+      }
+
+      {{template "login/pwd-validate-js" .}}
+    });
+  </script>
+</body>
+
+</html>
+{{end}}
diff --git a/cmd/server/assets/login/select-password.html b/cmd/server/assets/login/select-password.html
index 4c907ee3b..b86975f6e 100644
--- a/cmd/server/assets/login/select-password.html
+++ b/cmd/server/assets/login/select-password.html
@@ -91,14 +91,6 @@
       let $password = $('#password');
       let $retype = $('#retype');
 
-      {{if .requirements.HasRequirements}}
-      let $lenReq = $('#length-req');
-      let $upperReq = $('#upper-req');
-      let $lowerReq = $('#lower-req');
-      let $numReq = $('#num-req');
-      let $specialReq = $('#special-req');
-      {{end}}
-
       let urlVars = getUrlVars();
       let code = urlVars["oobCode"];
       if (!code) {
@@ -114,7 +106,7 @@
            $submit.prop('disabled', true);
         });
 
-      $password.change(function() {
+      $password.keyup(function() {
         $submit.prop('disabled', !checkPasswordValid($password.val()));
       });
 
@@ -122,12 +114,13 @@
         let email = $email.val();
         let pwd = $password.val();
         if (pwd != $retype.val()) {
+          flash.clear();
           flash.error("Password and retyped passwords must match.");
           return false;
         }
 
         if (!checkPasswordValid(pwd)) {
-          return false
+          return false;
         }
 
         // Disable the submit button so we only attempt once.
@@ -137,92 +130,14 @@
           .then(function() {
             return true;
           }).catch(function(error) {
-            flash.error(error)
+            flash.clear();
+            flash.error(error);
             $submit.prop('disabled', false);
             return false;
           });
       });
 
-      function checkPasswordValid(pwd) {
-        {{if .requirements.HasRequirements}}
-          let upper = 0;
-          let lower = 0;
-          let digit = 0;
-          let special = 0;
-          let specialPattern = new RegExp(/[~`!#$%\^&*+=\-\[\]\\';,/{}|\\":<>\?]/);
-          for (let i = 0; i < pwd.length; i++) {
-            let c = pwd.charAt(i);
-            if (!isNaN(parseInt(c, 10))) {
-              digit++;
-            } else if (specialPattern.test(c)) {
-              special++;
-            } else if (c == c.toUpperCase()) {
-              upper++;
-            } else if (c == c.toLowerCase()) {
-              lower++;
-            }
-          }
-
-          let errClass = "oi oi-circle-x pr-1";
-          let checkClass = "oi oi-circle-check pr-1";
-
-          {{if gt .requirements.Length 0}}
-          if (pwd.length < {{.requirements.Length}}) {
-            $lenReq.find("#icon").attr("class", errClass)
-            $lenReq.addClass("text-danger");
-            return false;
-          } else {
-            $lenReq.find("#icon").attr("class", checkClass)
-            $lenReq.addClass("text-muted");
-          }
-          {{end}}
-
-          {{if gt .requirements.Uppercase 0}}
-          if (upper < {{.requirements.Uppercase}}) {
-            $upperReq.find("#icon").attr("class", errClass);
-            $upperReq.addClass("text-danger");
-            return false;
-          } else {
-            $upperReq.find("#icon").attr("class", checkClass);
-            $upperReq.addClass("text-muted");
-          }
-          {{end}}
-
-          {{if gt .requirements.Lowercase 0}}
-          if (lower < {{.requirements.Lowercase}}) {
-            $lowerReq.find("#icon").attr("class", errClass);
-            $lowerReq.addClass("text-danger");
-            return false;
-          } else {
-            $lowerReq.find("#icon").attr("class", checkClass);
-            $lowerReq.addClass("text-muted");
-          }
-          {{end}}
-
-          {{if gt .requirements.Number 0}}
-          if (digit < {{.requirements.Number}}) {
-            $numReq.find("#icon").attr("class", errClass);
-            $numReq.addClass("text-danger");
-            return false;
-          } else {
-            $numReq.find("#icon").attr("class", checkClass);
-            $numReq.addClass("text-muted");
-          }
-          {{end}}
-
-          {{if gt .requirements.Special 0}}
-          if (special < {{.requirements.Special}}) {
-            $specialReq.find("#icon").attr("class", errClass);
-            $specialReq.addClass("text-danger");
-            return false;
-          } else {
-            $specialReq.find("#icon").attr("class", checkClass);
-            $specialReq.addClass("text-muted");
-          }
-          {{end}}
-          {{end}}
-          return true;
-      }
+      {{template "login/pwd-validate-js" .}}
     });
 
     function getUrlVars() {
diff --git a/cmd/server/main.go b/cmd/server/main.go
index b502438d9..5bb612635 100644
--- a/cmd/server/main.go
+++ b/cmd/server/main.go
@@ -220,7 +220,7 @@ func realMain(ctx context.Context) error {
 
 			sub.Handle("/", loginController.HandleLogin()).Methods("GET")
 			sub.Handle("/login/reset-password", loginController.HandleResetPassword()).Methods("GET")
-			sub.Handle("/login/select-password", loginController.HandleSelectNewPassword()).Methods("GET")
+			sub.Handle("/login/select-password", loginController.HandleShowSelectNewPassword()).Methods("GET")
 			sub.Handle("/login/select-password", loginController.HandleSubmitNewPassword()).Methods("POST")
 			sub.Handle("/session", loginController.HandleCreateSession()).Methods("POST")
 			sub.Handle("/signout", loginController.HandleSignOut()).Methods("GET")
@@ -233,7 +233,8 @@ func realMain(ctx context.Context) error {
 			sub.Handle("/login", loginController.HandleReauth()).Methods("GET")
 			sub.Handle("/login", loginController.HandleReauth()).Queries("redir", "").Methods("GET")
 			sub.Handle("/login/select-realm", loginController.HandleSelectRealm()).Methods("GET", "POST")
-			sub.Handle("/login/change-password", loginController.HandleResetPassword()).Methods("GET")
+			sub.Handle("/login/change-password", loginController.HandleShowChangePassword()).Methods("GET")
+			sub.Handle("/login/change-password", loginController.HandleSubmitChangePassword()).Methods("POST")
 			sub.Handle("/account", loginController.HandleAccountSettings()).Methods("GET")
 
 			// Verifying email requires the user is logged in
diff --git a/pkg/controller/login/change_password.go b/pkg/controller/login/change_password.go
new file mode 100644
index 000000000..d8a9c0840
--- /dev/null
+++ b/pkg/controller/login/change_password.go
@@ -0,0 +1,64 @@
+// Copyright 2020 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package login defines the controller for the login page.
+package login
+
+import (
+	"net/http"
+	"time"
+
+	"github.com/google/exposure-notifications-verification-server/pkg/controller"
+)
+
+func (c *Controller) HandleShowChangePassword() http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		ctx := r.Context()
+
+		m := controller.TemplateMapFromContext(ctx)
+		m["firebase"] = c.config.Firebase
+		m["requirements"] = &c.config.PasswordRequirements
+		c.h.RenderHTML(w, "login/change-password", m)
+	})
+}
+
+func (c *Controller) HandleSubmitChangePassword() http.Handler {
+	logger := c.logger.Named("login.HandleSubmitNewPassword")
+
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		ctx := r.Context()
+
+		session := controller.SessionFromContext(ctx)
+		if session == nil {
+			controller.MissingSession(w, r, c.h)
+			return
+		}
+		flash := controller.Flash(session)
+
+		user := controller.UserFromContext(ctx)
+		if user == nil {
+			controller.MissingUser(w, r, c.h)
+			return
+		}
+
+		if err := c.db.PasswordChanged(user.Email, time.Now()); err != nil {
+			logger.Errorw("failed to mark password change time", "error", err)
+			controller.InternalError(w, r, c.h, err)
+			return
+		}
+
+		flash.Alert("Successfully changed password.")
+		http.Redirect(w, r, "/home", http.StatusSeeOther)
+	})
+}
diff --git a/pkg/controller/login/select_password.go b/pkg/controller/login/select_password.go
index 91985a859..f86b5dfad 100644
--- a/pkg/controller/login/select_password.go
+++ b/pkg/controller/login/select_password.go
@@ -23,7 +23,7 @@ import (
 	"github.com/google/exposure-notifications-verification-server/pkg/controller/flash"
 )
 
-func (c *Controller) HandleSelectNewPassword() http.Handler {
+func (c *Controller) HandleShowSelectNewPassword() http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		ctx := r.Context()
 
@@ -60,7 +60,7 @@ func (c *Controller) HandleSubmitNewPassword() http.Handler {
 		// There's no session yet, so make a one-time flash.
 		m := controller.TemplateMapFromContext(ctx)
 		f := flash.New(nil)
-		f.Alert("New password selected successfully.")
+		f.Alert("Successfully selected new password.")
 		m["flash"] = f
 
 		c.renderLogin(ctx, w)
diff --git a/pkg/controller/middleware/emailverified.go b/pkg/controller/middleware/emailverified.go
index 99e229bf4..f58eace9d 100644
--- a/pkg/controller/middleware/emailverified.go
+++ b/pkg/controller/middleware/emailverified.go
@@ -54,7 +54,7 @@ func RequireVerified(ctx context.Context, client *auth.Client, db *database.Data
 				logger.Debugw("no user found when checking email verification")
 				flash.Error("Log in first to verify email.")
 				controller.ClearSessionFirebaseCookie(session)
-				controller.Unauthorized(w, r, h)
+				controller.MissingUser(w, r, h)
 				return
 			}
 

From 7484282e074740999b86f9b341217e7f949a4529 Mon Sep 17 00:00:00 2001
From: Weston Haught <whaught@google.com>
Date: Wed, 23 Sep 2020 12:13:34 -0700
Subject: [PATCH 2/2] error

---
 cmd/server/assets/login/change-password.html |  3 ++-
 cmd/server/assets/login/select-password.html | 12 +++++++++++-
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/cmd/server/assets/login/change-password.html b/cmd/server/assets/login/change-password.html
index 244e32744..1849db96b 100644
--- a/cmd/server/assets/login/change-password.html
+++ b/cmd/server/assets/login/change-password.html
@@ -110,7 +110,8 @@
         try {
           return changePassword();
         } catch(e) {
-          return false;
+          flash.clear();
+          flash.error(error);
         }
       });
 
diff --git a/cmd/server/assets/login/select-password.html b/cmd/server/assets/login/select-password.html
index b86975f6e..a0d2f70cd 100644
--- a/cmd/server/assets/login/select-password.html
+++ b/cmd/server/assets/login/select-password.html
@@ -111,6 +111,16 @@
       });
 
       $form.on('submit', function(event) {
+        try {
+          return selectPassword();
+        } catch(error) {
+          flash.clear();
+          flash.error(error);
+          return false;
+        }
+      });
+
+      function selectPassword() {
         let email = $email.val();
         let pwd = $password.val();
         if (pwd != $retype.val()) {
@@ -135,7 +145,7 @@
             $submit.prop('disabled', false);
             return false;
           });
-      });
+      }
 
       {{template "login/pwd-validate-js" .}}
     });