Change password: Add check of old password, add validation

backend/src/routes/user.ts

@@ -72,11 +72,25 @@ router.post('/create', async (req, res) => {
 router.put('/password', async (req, res) => {
   if (!req.user) throw new AccessError()
   const { userId } = req.user
-  const { newPassword } = req.body
-  // TODO validate new password
-  const passwordHash = await createPasswordHash(newPassword as string)
+  const { newPassword, oldPassword } = req.body as { newPassword: string; oldPassword: string }
+
+  const foundUser = await nowDb.com_users.findFirst({
+    where: {
+      user_id: userId,
+    },
+    select: { newpassword: true },
+  })
+
+  // Confusing naming here, but newpassword in db refers to the password hash used by this application.
+  const passwordMatches = foundUser && (await bcrypt.compare(oldPassword, foundUser.newpassword as string))
+  if (!passwordMatches) return res.status(403).send()
+  if (newPassword.length < 8) return res.status(400).send('Password must be at least 8 characters long.')
+  if (!/^[0-9A-Za-z$%&~]+/.test(newPassword))
+    return res.status(400).send('Use only alphanumeric characters a-z, A-Z and 0-9 and symbols ^?$%&~ in the password')
+
+  const passwordHash = await createPasswordHash(newPassword)
   await nowDb.com_users.update({ where: { user_id: userId }, data: { newpassword: passwordHash } })
-  res.status(200).send()
+  return res.status(200).send()
 })
 
 export default router

frontend/src/components/Person/Tabs/ChangePasswordForm.tsx

@@ -14,7 +14,7 @@ export const ChangePasswordForm = () => {
       // TODO show notification on error
       return
     }
-    void changePasswordMutation(newPassword)
+    void changePasswordMutation({ newPassword, oldPassword })
     setOldPassword('')
     setNewPassword('')
     setVerifyPassword('')

frontend/src/redux/userReducer.ts

@@ -24,11 +24,12 @@ const userApi = api.injectEndpoints({
         method: 'POST',
       }),
     }),
-    changePassword: builder.mutation<void, string>({
-      query: (password: string) => ({
+    changePassword: builder.mutation<void, { newPassword: string; oldPassword: string }>({
+      query: ({ newPassword, oldPassword }: { newPassword: string; oldPassword: string }) => ({
         url: 'user/password',
         body: {
-          newPassword: password,
+          newPassword,
+          oldPassword,
         },
         method: 'PUT',
       }),