coder · DanielleMaywood · Sep 27, 2024 · Sep 27, 2024 · Sep 27, 2024 · Sep 27, 2024
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
@@ -3677,6 +3677,20 @@ func (q *querier) UpdateUserLoginType(ctx context.Context, arg database.UpdateUs
 	return q.db.UpdateUserLoginType(ctx, arg)
 }
 
+func (q *querier) UpdateUserMustResetPassword(ctx context.Context, arg database.UpdateUserMustResetPasswordParams) error {
+	user, err := q.db.GetUserByID(ctx, arg.ID)
+	if err != nil {
+		return err
+	}
+
+	err = q.authorizeContext(ctx, policy.ActionUpdatePersonal, user)
+	if err != nil {
+		return err
+	}
+
+	return q.db.UpdateUserMustResetPassword(ctx, arg)
+}
+
 func (q *querier) UpdateUserNotificationPreferences(ctx context.Context, arg database.UpdateUserNotificationPreferencesParams) (int64, error) {
 	if err := q.authorizeContext(ctx, policy.ActionUpdate, rbac.ResourceNotificationPreference.WithOwner(arg.UserID.String())); err != nil {
 		return -1, err

diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
@@ -1187,6 +1187,13 @@ func (s *MethodTestSuite) TestUser() {
 			ID: u.ID,
 		}).Asserts(u, policy.ActionUpdatePersonal).Returns()
 	}))
+	s.Run("UpdateUserMustResetPassword", s.Subtest(func(db database.Store, check *expects) {
+		u := dbgen.User(s.T(), db, database.User{})
+		check.Args(database.UpdateUserMustResetPasswordParams{
+			ID:                u.ID,
+			MustResetPassword: true,
+		}).Asserts(u, policy.ActionUpdatePersonal).Returns()
+	}))
 	s.Run("UpdateUserQuietHoursSchedule", s.Subtest(func(db database.Store, check *expects) {
 		u := dbgen.User(s.T(), db, database.User{})
 		check.Args(database.UpdateUserQuietHoursScheduleParams{

diff --git a/coderd/database/dbmem/dbmem.go b/coderd/database/dbmem/dbmem.go
@@ -9186,6 +9186,27 @@ func (q *FakeQuerier) UpdateUserLoginType(_ context.Context, arg database.Update
 	return database.User{}, sql.ErrNoRows
 }
 
+func (q *FakeQuerier) UpdateUserMustResetPassword(_ context.Context, arg database.UpdateUserMustResetPasswordParams) error {
+	err := validateDatabaseType(arg)
+	if err != nil {
+		return err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for i, u := range q.users {
+		if u.ID == arg.ID {
+			u.MustResetPassword = arg.MustResetPassword
+			q.users[i] = u
+
+			return nil
+		}
+	}
+
+	return sql.ErrNoRows
+}
+
 func (q *FakeQuerier) UpdateUserNotificationPreferences(_ context.Context, arg database.UpdateUserNotificationPreferencesParams) (int64, error) {
 	err := validateDatabaseType(arg)
 	if err != nil {

diff --git a/coderd/database/dbmetrics/dbmetrics.go b/coderd/database/dbmetrics/dbmetrics.go
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
diff --git a/coderd/database/querier.go b/coderd/database/querier.go
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
diff --git a/coderd/database/queries/users.sql b/coderd/database/queries/users.sql
@@ -289,3 +289,12 @@ RETURNING id, email, last_seen_at;
 -- AllUserIDs returns all UserIDs regardless of user status or deletion.
 -- name: AllUserIDs :many
 SELECT DISTINCT id FROM USERS;
+
+-- name: UpdateUserMustResetPassword :exec
+UPDATE
+    users
+SET
+    must_reset_password = $2
+WHERE
+    id = $1
+;
diff --git a/coderd/users.go b/coderd/users.go
@@ -1076,6 +1076,14 @@ func (api *API) putUserPassword(rw http.ResponseWriter, r *http.Request) {
 			return xerrors.Errorf("delete api keys by user ID: %w", err)
 		}
 
+		err = tx.UpdateUserMustResetPassword(ctx, database.UpdateUserMustResetPasswordParams{
+			ID:                user.ID,
+			MustResetPassword: false,
+		})
+		if err != nil {
+			return xerrors.Errorf("update user must reset password: %w", err)
+		}
+
 		return nil
 	}, nil)
 	if err != nil {

diff --git a/coderd/users_test.go b/coderd/users_test.go
@@ -1211,6 +1211,36 @@ func TestUpdateUserPassword(t *testing.T) {
 		cerr := coderdtest.SDKError(t, err)
 		require.Equal(t, http.StatusBadRequest, cerr.StatusCode())
 	})
+
+	t.Run("OnUpdateUserPasswordMustResetPasswordIsSetToFalse", func(t *testing.T) {
+		t.Parallel()
+
+		client, db := coderdtest.NewWithDatabase(t, nil)
+		user := coderdtest.CreateFirstUser(t, client)
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		//nolint:gocritic // Unit test
+		err := db.UpdateUserMustResetPassword(dbauthz.AsSystemRestricted(ctx), database.UpdateUserMustResetPasswordParams{
+			ID:                user.UserID,
+			MustResetPassword: true,
+		})
+		require.Nil(t, err)
+
+		//nolint:gocritic // Unit test
+		dbUser, err := db.GetUserByID(dbauthz.AsSystemRestricted(ctx), user.UserID)
+		require.Nil(t, err)
+		require.True(t, dbUser.MustResetPassword)
+
+		err = client.UpdateUserPassword(ctx, "me", codersdk.UpdateUserPasswordRequest{
+			Password: "MyNewSecurePassword!",
+		})
+		require.Nil(t, err)
+
+		//nolint:gocritic // Unit test
+		dbUser, err = db.GetUserByID(dbauthz.AsSystemRestricted(ctx), user.UserID)
+		require.Nil(t, err)
+		require.False(t, dbUser.MustResetPassword)
+	})
 }
 
 // TestInitialRoles ensures the starting roles for the first user are correct.