all repos

onasty @ 33a27b8fc7fbe906fbdf7a446a8104fa705eb43f

a one-time notes service
2 files changed, 8 insertions(+), 5 deletions(-)
fix(api): change password exposes internal error (#194)

If current user's password and provided ones didn't match, api
returned ErrUserInvalidPassword, now it's ErrUserWrongCredentials
Author: Olexandr Smirnov olexsmir@gmail.com
Committed by: GitHub noreply@github.com
Committed at: 2025-08-25 14:31:25 +0300
Parent: 673a1f7
M e2e/apiv1_auth_test.go
···
        347
        347
         }

      
        348
        348
         

      
        349
        349
         func (e *AppTestSuite) TestAuthV1_ChangePassword() {

      
        350
        
        -	password := e.uuid()

      
        351
        
        -	newPassword := e.uuid()

      
        
        350
        +	oldPassword, newPassword := e.uuid(), e.uuid()

      
        352
        351
         	email := e.uuid() + "@test.com"

      
        353
        
        -	_, toks := e.createAndSingIn(email, password)

      
        
        352
        +	_, toks := e.createAndSingIn(email, oldPassword)

      
        354
        353
         

      
        355
        354
         	httpResp := e.httpRequest(

      
        356
        355
         		http.MethodPost,

      
        357
        356
         		"/api/v1/auth/change-password",

      
        358
        357
         		e.jsonify(apiv1AuthChangePasswordRequest{

      
        359
        
        -			CurrentPassword: password,

      
        
        358
        +			CurrentPassword: oldPassword,

      
        360
        359
         			NewPassword:     newPassword,

      
        361
        360
         		}),

      
        362
        361
         		toks.AccessToken,

      ···
        385
        384
         	)

      
        386
        385
         

      
        387
        386
         	e.Equal(http.StatusBadRequest, httpResp.Code)

      
        
        387
        +

      
        
        388
        +	var body errorResponse

      
        
        389
        +	e.readBodyAndUnjsonify(httpResp.Body, &body)

      
        
        390
        +	e.Equal(models.ErrUserWrongCredentials.Error(), body.Message)

      
        388
        391
         

      
        389
        392
         	userDB := e.getUserByEmail(email)

      
        390
        393
         

      
M internal/service/usersrv/usersrv.go
···
        264
        264
         	}

      
        265
        265
         

      
        266
        266
         	if err = u.hasher.Compare(user.Password, inp.CurrentPassword); err != nil {

      
        267
        
        -		return errors.Join(err, models.ErrUserInvalidPassword)

      
        
        267
        +		return models.ErrUserWrongCredentials

      
        268
        268
         	}

      
        269
        269
         

      
        270
        270
         	newPass, err := u.hasher.Hash(inp.NewPassword)