feat: migrate /user/password to go

go/api/openapi.yaml

@@ -295,6 +295,30 @@ paths:
           description: >-
             Email verification email sent successfully
 
+  /user/password:
+    post:
+      summary: >-
+        Change user password. The user must be authenticated or provide a ticket
+      tags:
+        - user
+        - password
+      security:
+        - BearerAuthElevated: []
+        - {}
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/UserPasswordRequest'
+      responses:
+        '200':
+          description: >-
+            Password changed successfully
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/OKResponse'
+
   /user/password/reset:
     post:
       summary: >-
@@ -432,6 +456,7 @@ components:
             - user-not-anonymous
             - invalid-pat
             - invalid-refresh-token
+            - invalid-ticket
       required:
         - status
         - message
@@ -641,6 +666,23 @@ components:
       required:
         - email
 
+    UserPasswordRequest:
+      type: object
+      additionalProperties: false
+      properties:
+        newPassword:
+          description: A password of minimum 3 characters
+          example: Str0ngPassw#ord-94|%
+          minLength: 3
+          maxLength: 50
+          type: string
+        ticket:
+          type: string
+          pattern: ^passwordReset\:.*$
+          description: Ticket to reset the password, required if the user is not authenticated
+      required:
+        - newPassword
+
     OKResponse:
       type: string
       additionalProperties: false

go/controller/controller.go

@@ -45,6 +45,7 @@ type DBClientGetUser interface {
 	GetUserByRefreshTokenHash(
 		ctx context.Context, arg sql.GetUserByRefreshTokenHashParams,
 	) (sql.AuthUser, error)
+	GetUserByTicket(ctx context.Context, ticket pgtype.Text) (sql.AuthUser, error)
 }
 
 type DBClientInsertUser interface {
@@ -66,6 +67,9 @@ type DBClientUpdateUser interface {
 	UpdateUserDeanonymize(ctx context.Context, arg sql.UpdateUserDeanonymizeParams) error
 	UpdateUserLastSeen(ctx context.Context, id uuid.UUID) (pgtype.Timestamptz, error)
 	UpdateUserTicket(ctx context.Context, arg sql.UpdateUserTicketParams) (uuid.UUID, error)
+	UpdateUserChangePassword(
+		ctx context.Context, arg sql.UpdateUserChangePasswordParams,
+	) (uuid.UUID, error)
 	InsertUserWithSecurityKey(
 		ctx context.Context, arg sql.InsertUserWithSecurityKeyParams,
 	) (uuid.UUID, error)

go/controller/errors.go

@@ -36,6 +36,7 @@ var (
 	ErrUnverifiedUser                  = &APIError{api.UnverifiedUser}
 	ErrUserNotAnonymous                = &APIError{api.UserNotAnonymous}
 	ErrInvalidPat                      = &APIError{api.InvalidPat}
+	ErrInvalidTicket                   = &APIError{api.InvalidTicket}
 	ErrInvalidRequest                  = &APIError{api.InvalidRequest}
 	ErrSignupDisabled                  = &APIError{api.SignupDisabled}
 	ErrDisabledEndpoint                = &APIError{api.DisabledEndpoint}
@@ -77,6 +78,10 @@ func (response ErrorResponse) VisitPostUserEmailChangeResponse(w http.ResponseWr
 	return response.visit(w)
 }
 
+func (response ErrorResponse) VisitPostUserPasswordResponse(w http.ResponseWriter) error {
+	return response.visit(w)
+}
+
 func (response ErrorResponse) VisitPostUserPasswordResetResponse(w http.ResponseWriter) error {
 	return response.visit(w)
 }
@@ -119,7 +124,8 @@ func isSensitive(err api.ErrorResponseError) bool {
 		api.RoleNotAllowed,
 		api.SignupDisabled,
 		api.UnverifiedUser,
-		api.InvalidRefreshToken:
+		api.InvalidRefreshToken,
+		api.InvalidTicket:
 		return true
 	case
 		api.DefaultRoleMustBeInAllowedRoles,
@@ -259,6 +265,12 @@ func (ctrl *Controller) sendError( //nolint:funlen,cyclop
 			Error:   err.t,
 			Message: "Invalid or expired refresh token",
 		}
+	case api.InvalidTicket:
+		return ErrorResponse{
+			Status:  http.StatusUnauthorized,
+			Error:   err.t,
+			Message: "Invalid ticket",
+		}
 	}
 
 	return invalidRequest