Change Password #602

rossaddison · 2023-10-28T13:36:29Z

Q	A
Is bugfix?	❌
New feature?	✔️
Breaks BC?	❌
Fixed issues	None

Include a change password function in the demo.

what-the-diff · 2023-10-28T13:37:12Z

PR Summary

Introduction of README File
A new README.md file has been added to the root directory. This file contains a description of the demo application.
Update on Blog README
The 'blog/README.md' file has been updated to include instructions for installing Bootstrap Node Modules while using WAMP. Furthermore, improvements have been made to the "Support the Project" section.
New Route Addition
A new route has been added to the 'blog/config/common/routes/routes.php' file. This route is for the ResetController and has the URL /reset.
Localization Updates
In the blog/resources/messages/en/app.php file, translations for 'layout.password-verify.new' and 'layout.password.new' have been added. This update also includes the new translation for 'menu.password.change'.
Addition of New Menu Item
A new menu item for changing the password has been put in the blog/resources/views/layout/main.php file. This menu item links to the URL /auth/reset.
Password Reset Functionality
Several new files have been introduced to handle password reset functionality. These include a file to display the password reset form (blog/resources/views/reset/reset.php), a file to control the password reset operation (blog/src/Auth/Controller/ResetController.php), and a file to handle the reset form and its validation (blog/src/Auth/Form/ResetForm.php).
Enhanced Login Protocol
The Identity class has been improved with new methods and logic for managing login keys using cookies.
New Identity Repository Functionality
A new file has been added as blog/src/Auth/IdentityRepository.php which is responsible for handling identity repository operations.

samdark · 2023-10-30T19:08:32Z

blog/README.md

@@ -67,6 +67,11 @@ The code is statically analyzed with [Psalm](https://psalm.dev/). To run static
 ./vendor/bin/psalm
 ```

+### Installing Bootstrap Node Modules with WAMP 
+
+1. Make a directory node_modules in the blog directory.


Isn't npm creating node_modules automatically?

Testing Demo Installation:
Step 1: Downloaded zip and extracted into demo2 folder
Step 2: composer update
Step 3: c:\wamp64\www\demo2\blog>yii serve

Step 4: Whilst running wampserver in url typed: 127.0.0.1:8080

Step 5: Removed blog from .env file path to remove above error.

blog/resources/views/layout/main.php

blog/resources/views/reset/reset.php

blog/src/Auth/Form/ResetForm.php

Co-authored-by: Alexander Makarov <sam@rmcreative.ru>

Functionally a change password and not a reset password form that is included in the main layout and not on the login form. (Change Password)[yiisoft#602]

Adopt suggestions in (#602)[yiisoft/demo#602]

blog/config/common/routes/routes.php

blog/src/Auth/Controller/ChangeController.php

Co-authored-by: Alexander Makarov <sam@rmcreative.ru>

rossaddison · 2023-12-05T22:08:48Z

Please review these changes

vjik

Added several comments, fix several errors and adapt PR to last changes in Yii Form.

blog/src/Auth/Controller/ChangePasswordController.php

vjik · 2023-12-06T07:47:18Z

blog/src/Auth/Form/ChangePasswordForm.php

+{
+ private string $login = '';
+ private string $password = '';
+ private string $passwordVerify = '';


Suggested change

private string $passwordVerify = '';

private string $passwordVerify = '';

Not need field for duplicate old password.

blog/config/common/routes/routes.php

Removved passwordVerify field in the form

samdark · 2024-04-08T18:08:53Z

@rossaddison would you please resolve conflicts? Thanks.

blog/resources/messages/en/app.php

vjik · 2024-04-13T05:51:18Z

blog/src/Auth/Controller/ChangePasswordController.php

+ return $this->redirectToMain();
+ } 
+ // permit an authenticated user, ie. not a guest, only and null!== current user
+ if (!$authService->isGuest()) {


if (!$authService->isGuest()) { already not need, we have this check above.

In the same way, you can remove "if" nesting in further code.

vjik · 2024-04-13T05:54:39Z

blog/resources/views/changepassword/change.php

+ ->id('changeForm')
+ ->open() ?>
+
+ <?= Field::text($formModel, 'login')->addInputAttributes(['value'=> $login ?? '', 'readonly'=>'readonly']) ?>


Do you want add ability to change password for any user? Not only current?

Yes. I will need to add a permission to the readonly => readonly e.g.

!$this->currentUser->can('changePasswordForAnyUser',[]) ? 'readonly'=>'readonly' : '';

This will make sure that only administrators with the canChangePasswordForAnyUser permission can insert a username in the login textbox in place of the {login} in order to change the password.

...And remove the

if ($this->currentUser->can('viewInv',[])) {

since all authenticated users with a lesser permission (of viewInv) should be able to change their password.

changepassword.php

<?= $canChangePasswordForAnyUser ? Field::text($formModel, 'login')->addInputAttributes(['value'=> $login ?? '']) : Field::text($formModel, 'login')->addInputAttributes(['value'=> $login ?? '', 'readonly'=>'readonly']); ?>

Controller.php

public function change( AuthService $authService, Identity $identity, IdentityRepository $identityRepository, ServerRequestInterface $request, FormHydrator $formHydrator, ChangePasswordForm $changePasswordForm ): ResponseInterface { if ($authService->isGuest()) { return $this->redirectToMain(); } // readonly the login detail on the change form $identity_id = $this->currentUser->getIdentity()->getId(); if (null!==$identity_id) { $identity = $identityRepository->findIdentity($identity_id); if (null!==$identity) { // Identity and User are in a HasOne relationship so no null value $login = $identity->getUser()?->getLogin(); if ($request->getMethod() === Method::POST && $formHydrator->populate($changePasswordForm, $request->getParsedBody()) && $changePasswordForm->change() ) { // Identity implements CookieLoginIdentityInterface: ensure the regeneration of the cookie auth key by means of $authService->logout(); // @see vendor\yiisoft\user\src\Login\Cookie\CookieLoginIdentityInterface // Specific note: "Make sure to invalidate earlier issued keys when you implement force user logout, // PASSWORD CHANGE and other scenarios, that require forceful access revocation for old sessions. // The authService logout function will regenerate the auth key here => overwriting any auth key $authService->logout(); $this->flash_message('success', $this->translator->translate('validator.password.change')); return $this->redirectToMain(); } return $this->viewRenderer->render('change', [ 'formModel' => $changePasswordForm, 'login' => $login, 'canChangePasswordForAnyUser' => $this->currentUser->can('changePasswordForAnyUser') ]); } // identity } // identity_id } // r

samdark · 2024-04-13T22:10:35Z

blog/src/Auth/Controller/ChangePasswordController.php

+ } 
+ // permit an authenticated user, ie. not a guest, only and null!== current user
+ if (!$authService->isGuest()) {
+ if ($this->current_user->can('viewInv',[])) {


viewInv isn't a good name for permission. Let's not shorten names.

Co-authored-by: Sergei Predvoditelev <sergey.predvoditelev@gmail.com>

If a user (normally an administrator) has the permission 'changePasswordForAnyUser', the login form 'username' text box will be not readonly so that the administrator can change any username's password in the event of a user's personal request to change their password by typing in their username.

…ysis I am currently introducing Psalm Level 1 testing to other directories on an individual basis.

samdark · 2024-06-30T18:11:10Z

blog/composer.json

+ "rossaddison/mailer": "dev-master",
+ "rossaddison/mailer-symfony": "*", 


@rossaddison you can link your packages locally with yiisoft/yii-dev-tool
Take a look at it

samdark · 2024-06-30T18:11:31Z

blog/composer.json

+ "rossaddison/yii-swagger": "dev-master", 
+ "rossaddison/yii-view": "*"


samdark · 2024-06-30T18:12:05Z

blog/config/common/di/rbac.php

+ * @var array $params['yiisoft/aliases']
+ * @var array $params['yiisoft/aliases']['aliases']
+ * @var string $params['yiisoft/aliases']['aliases']['@root'] 


Does that work in PhpStorm? Elsewhere?

samdark · 2024-06-30T18:12:59Z

blog/config/common/di/router.php

+ 'reset' => function (array $defaultArguments = []) {
+ $defaultArguments = ['_language', 'en'];
 },


Looks suspicious. What does it reset?

samdark · 2024-06-30T18:13:54Z

blog/config/common/di/router.php

- ->addGroup(
- Group::create('/{_language}')->routes(...$config->get('app-routes')),
- )
- ->addGroup(
- Group::create()->routes(...$config->get('routes')),


Was that created to exclude debug routes from language routing?

samdark · 2024-06-30T18:20:52Z

blog/src/Auth/Controller/ChangePasswordController.php

+ $this->currentUser = $currentUser;
+ $this->session = $session; 
+ $this->flash = new Flash($session);
+ $this->translator = $translator;
+ $this->viewRenderer = $viewRenderer->withControllerName('changepassword');


Suggested change

$this->currentUser = $currentUser;

$this->session = $session;

$this->flash = new Flash($session);

$this->translator = $translator;

$this->viewRenderer = $viewRenderer->withControllerName('changepassword');

$this->flash = new Flash($session);

$this->viewRenderer = $viewRenderer->withControllerName('changepassword');

samdark · 2024-06-30T18:21:15Z

blog/src/Auth/Controller/ChangePasswordController.php

+ return $this->redirectToMain();
+ }
+
+ $identity_id = $this->currentUser->getIdentity()->getId();


Suggested change

$identity_id = $this->currentUser->getIdentity()->getId();

$identityId = $this->currentUser->getIdentity()->getId();

samdark · 2024-06-30T18:21:48Z

blog/src/Auth/Controller/ChangePasswordController.php

+ // PASSWORD CHANGE and other scenarios, that require forceful access revocation for old sessions.
+ // The authService logout function will regenerate the auth key here => overwriting any auth key
+ $authService->logout();
+ $this->flash_message('success', $this->translator->translate('validator.password.change'));


Suggested change

$this->flash_message('success', $this->translator->translate('validator.password.change'));

$this->flashMessage('success', $this->translator->translate('validator.password.change'));

samdark · 2024-06-30T18:24:40Z

blog/src/Auth/Form/ChangePasswordForm.php

+ function (mixed $value): Result {
+ $result = new Result();
+ if ($this->userRepository->findByLogin((string)$value) == null) {
+ $result->addError($this->translator->translate('validator.user.exist.not'));
+ }
+ return $result;
+ },
+ ],


Ideally, that should be implemented by catching a database exception on inserting a record because SELECT and then INSERT aren't atomic and, thus, can cause an exception anyway if a value is inserted by another user in between.

samdark · 2024-06-30T18:25:41Z

blog/src/Auth/Form/ChangePasswordForm.php

+ 'password' => $this->PasswordRules(),
+ 'newPassword' => [
+ new Required(),
+ new Length(min: 8),


I'd not limit password length because it weakens security overall.

rossaddison added 3 commits October 28, 2023 10:43

Create README.md

a55bb3d

Incorporate Change Password

bdff034

Include a change password function in the demo.

Update README.md

bc0ab84

samdark requested changes Oct 30, 2023

View reviewed changes

vjik added the status:under development Someone is working on a pull request. label Nov 10, 2023

rossaddison and others added 4 commits November 15, 2023 14:38

Update blog/src/Auth/Form/ResetForm.php

f19017e

Co-authored-by: Alexander Makarov <sam@rmcreative.ru>

Update blog/src/Auth/Form/ResetForm.php

b19c822

Co-authored-by: Alexander Makarov <sam@rmcreative.ru>

Update blog/src/Auth/Form/ResetForm.php

6dd2ed1

Co-authored-by: Alexander Makarov <sam@rmcreative.ru>

Rename from 'reset' to 'change' password

e67e7d0

Functionally a change password and not a reset password form that is included in the main layout and not on the login form. (Change Password)[yiisoft#602]

rossaddison requested a review from samdark November 15, 2023 17:38

rossaddison added a commit to rossaddison/invoice that referenced this pull request Nov 18, 2023

(#602)[yiisoft/demo#602]

33ccf37

Adopt suggestions in (#602)[yiisoft/demo#602]

samdark reviewed Dec 1, 2023

View reviewed changes

blog/config/common/routes/routes.php Outdated Show resolved Hide resolved

blog/src/Auth/Controller/ChangeController.php Outdated Show resolved Hide resolved

rossaddison and others added 5 commits December 5, 2023 15:27

Update blog/config/common/routes/routes.php

8a77ee4

Co-authored-by: Alexander Makarov <sam@rmcreative.ru>

Update blog/src/Auth/Controller/ChangeController.php

64aabee

Co-authored-by: Alexander Makarov <sam@rmcreative.ru>

Sync

cf9b601

Update ChangePasswordController.php

a0b49f5

Merge branch 'master' into master

c5afdaf

vjik added 2 commits December 6, 2023 10:30

Merge branch 'master' into master

a0e0fe6

Adapt

a1937a4

vjik requested changes Dec 6, 2023

View reviewed changes

vjik reviewed Dec 6, 2023

View reviewed changes

blog/config/common/routes/routes.php Show resolved Hide resolved

rossaddison added 3 commits April 7, 2024 15:04

Remove passwordVerify field yiisoft#602

a71ea95

Removved passwordVerify field in the form

Update ChangePasswordController.php

4d29d50

Update ChangePasswordForm

c672355

rossaddison requested a review from samdark April 9, 2024 23:14

rossaddison added 2 commits April 10, 2024 07:57

Resolve yiisoft#602 conflicts

793d8c5

Resolve yiisoft#602 conflicts

e6eb950

rossaddison and others added 2 commits April 10, 2024 08:23

Resolve yiisoft#602 conflicts

bf4d0de

Merge branch 'master' into master

48dbb0a

vjik requested changes Apr 13, 2024

View reviewed changes

samdark reviewed Apr 13, 2024

View reviewed changes

rossaddison and others added 2 commits April 19, 2024 22:23

Update blog/resources/messages/en/app.php

826a572

Co-authored-by: Sergei Predvoditelev <sergey.predvoditelev@gmail.com>

Update Pull Request yiisoft#602

2b23069

rossaddison added 11 commits June 23, 2024 19:54

Merge branch 'yiisoft:master' into master

251e300

Update blog_build.yml

d778cd3

Update composer.json

de0deba

Reduce Psalm Level to 1 and Introduce config directory for Psalm Anal…

6cc137e

…ysis I am currently introducing Psalm Level 1 testing to other directories on an individual basis.

Update blog_dependency.yml

39833bd

Update blog_dependency.yml

2ded430

Update blog_dependency.yml

90b313c

Update composer.json

f246626

Update blog_static.yml

8d67877

Update composer.json

9d41943

Update composer.json

c486fed

samdark requested changes Jun 30, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Change Password #602

Change Password #602

rossaddison commented Oct 28, 2023

what-the-diff bot commented Oct 28, 2023

samdark Oct 30, 2023

rossaddison Nov 15, 2023

rossaddison Nov 15, 2023

rossaddison commented Dec 5, 2023

vjik left a comment

vjik Dec 6, 2023

samdark commented Apr 8, 2024

vjik Apr 13, 2024

vjik Apr 13, 2024

rossaddison May 5, 2024 •

edited

Loading

samdark Apr 13, 2024

samdark Jun 30, 2024

xepozz Jul 6, 2024

samdark Jun 30, 2024

samdark Jun 30, 2024

samdark Jun 30, 2024

samdark Jun 30, 2024

samdark Jun 30, 2024

samdark Jun 30, 2024

samdark Jun 30, 2024

samdark Jun 30, 2024

samdark Jun 30, 2024

	private string $passwordVerify = '';
	private string $passwordVerify = '';

		"rossaddison/mailer": "dev-master",
		"rossaddison/mailer-symfony": "*",

		"rossaddison/yii-swagger": "dev-master",
		"rossaddison/yii-view": "*"

	$identity_id = $this->currentUser->getIdentity()->getId();
	$identityId = $this->currentUser->getIdentity()->getId();

	$this->flash_message('success', $this->translator->translate('validator.password.change'));
	$this->flashMessage('success', $this->translator->translate('validator.password.change'));

Change Password #602

Are you sure you want to change the base?

Change Password #602

Conversation

rossaddison commented Oct 28, 2023

what-the-diff bot commented Oct 28, 2023

PR Summary

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rossaddison commented Dec 5, 2023

vjik left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

samdark commented Apr 8, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rossaddison May 5, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rossaddison May 5, 2024 •

edited

Loading