spee.ch/server/controllers/api/user/password/index.js

const { handleErrorResponse } = require('../../../utils/errorHandlers.js');
const logger = require('winston');
const db = require('../../../../models');
const { auth: { masterPassword } } = require('@config/siteConfig.json');

/*

  route to update a password

*/

const updateUserPassword = ({ ip, originalUrl, body }, res) => {
  let userRecord;
  const { userName, oldPassword, newPassword } = body;

  if (!masterPassword) {
    return res.status(400).json({
      success: false,
      message: 'no master password set in site config',
    });
  }

  if (!userName || !oldPassword || !newPassword) {
    return res.status(400).json({
      success: false,
      message: 'body should include userName (channel name without the @), oldPassword, & newPassword',
    });
  }

  db.User.findOne({
    where: {
      userName,
    },
  })
    .then(user => {
      userRecord = user;
      if (!userRecord) {
        throw new Error('no user found');
      }
      if (oldPassword === masterPassword) {
        logger.debug('master password provided');
        return true;
      } else {
        logger.debug('old password provided');
        return userRecord.comparePassword(oldPassword);
      }
    })
    .then(isMatch => {
      if (!isMatch) {
        throw new Error('Incorrect old password.');
      }
      logger.debug('Password was a match, updating password');
      return userRecord.changePassword(newPassword);
    })
    .then(() => {
      logger.debug('Password successfully updated');
      return res.status(200).json({
        success: true,
        message: 'Password successfully updated',
        oldPassword,
        newPassword,
      });
    })
    .catch((error) => {
      handleErrorResponse(originalUrl, ip, error, res);
    });
};

module.exports = updateUserPassword;