feat: Add update user password endpoint #1310
Conversation
|
I realized/remember the UI should be able to update the password for other users as well so I think we should skip the password verification when the user is admin and if it is trying to change another user's password. Or, to make it simple for BETA, I can just remove this verification or comment the block. Thoughts? |
Codecov Report
@@ Coverage Diff @@
## main #1310 +/- ##
==========================================
+ Coverage 66.10% 66.18% +0.07%
==========================================
Files 281 281
Lines 18424 18479 +55
Branches 220 220
==========================================
+ Hits 12180 12230 +50
- Misses 4982 4984 +2
- Partials 1262 1265 +3
Continue to review full report at Codecov.
|
Co-authored-by: Mathias Fredriksson <mafredri@gmail.com>
… bq/update-user-password
|
@f0ssel RBAC added! |
| @@ -287,6 +287,41 @@ func TestUpdateUserProfile(t *testing.T) { | |||
| }) | |||
| } | |||
|
|
|||
| func TestUpdateUserPassword(t *testing.T) { | |||
There was a problem hiding this comment.
Let's also add some tests to make sure the rbac is working here, I'd like to ensure that the user itself cannot perform this action, and neither can other non-admin users.
There was a problem hiding this comment.
So from what I'm understanding we want to test:
- A non-admin user can't update any password
- An admin can update another user's password
Is that?
Co-authored-by: Garrett Delfosse <garrett@coder.com>
| @@ -76,14 +76,6 @@ func ExtractUserParam(db database.Store) func(http.Handler) http.Handler { | |||
| } | |||
| } | |||
|
|
|||
| apiKey := APIKey(r) | |||
| if apiKey.UserID != user.ID { | |||
There was a problem hiding this comment.
I removed this because it was "overriding" RBAC roles. I know we don’t have the RBAC in place for all the user routes, but I can try to do that next. Probably I can send a PR on Monday. Thoughts? cc.: @f0ssel
There was a problem hiding this comment.
Discussion on Slack: https://codercom.slack.com/archives/CJURPL8DN/p1651843502606399
Closes #1309