copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Add functionality to set user passwords and related API route

Browse Source 
Introduce a `setPassword` method in the `users_o` class to hash and update user passwords in the database. Add a new `/superuser/user/password` API route that allows setting user passwords, with appropriate permission checks, validation, and logging.
This commit is contained in:
Jepp9350
2025-04-10 08:39:03 +02:00
parent 0a804b4d46
commit 9025f381df
2 changed files with 67 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/objects/users_o.php
+24 -5
View File
@@ -38,11 +38,6 @@ class users_o extends db
$this->setTable('users');
}
public function objectChanged(): void
{
// Since the user object is not cached, there is no need to invalidate the cache
}
public function edit(int $id, string $customer_number, string|null $role, string|null $password, string|null $display_name): void
{
global $db;
@@ -779,6 +774,30 @@ class users_o extends db
return $this->password->value();
}
/**
* Set the password for the user
* @throws Exception If the user is not selected
*/
public function setPassword(string $password = null): void
{
self::requireSelected();
global $db;
// Hash the password
$password = password_hash($password, PASSWORD_DEFAULT);
$password = $db->escape_string($password);
// Update the password in the database
$this->password->set(
$password,
);
// The object has changed, so we need to update the database
self::objectChanged();
}
public function objectChanged(): void
{
// Since the user object is not cached, there is no need to invalidate the cache
}
public function clearAllUsersEconomicCustomerDiscountsFromCache(): void
{
// Get all the cached results matching the pattern 'users_*_economic_customer_discount_percentage'
services/nginx/app/routes/userRoute.php
+43
View File
@@ -278,5 +278,48 @@ class userRoute
'set_user_keys' => 'Set a user\'s keys, they are stored in the database as key-value pairs. THIS IS STRICTLY FOR ADMINISTRATION PURPOSES!'
]
);
$this->post('/superuser/user/password', function () {
// Require the user to be logged in
global $response;
$this->requirePermission('set_user_password');
// Get the user object
$user = (new authentication())->get_user();
// Check if the request was successful
if ($user) {
// Log the incident
(new logs_o())->add('users', 'global', 1, $user->id, 'SET_USER_PASSWORD', 'Successfully set user password');
$targetUser = (new users_o())->automaticGetTargetUserFromRequest();
// Check if the user was found
if (!$targetUser->exists()) {
// Log the incident
(new logs_o())->add('users', 'global', 1, $user->id, 'SET_USER_PASSWORD', 'No user found');
// Return an error
$response->error('User not found', 404);
}
// Check if the request contains the password
if (!self::isParametersSet(['password'])) {
// Log the incident
(new logs_o())->add('users', 'global', 1, $user->id, 'SET_USER_PASSWORD', 'No password set');
// Return an error
$response->error('No password set', 400);
}
// Set the password
$targetUser->setPassword(
self::getParameter('password')
);
// Return a success message
$response->success('Successfully set user password');
} else {
// Log the incident
(new logs_o())->add('users', 'global', 1, 0, 'SET_USER_PASSWORD', 'No user found, or invalid session');
// Return an error
$response->error('Invalid session', 400);
}
},
[
'set_user_password' => 'Set a user\'s password'
]
);
}
}