add /password endpoint

README.md

@@ -708,12 +708,13 @@ Below you find more information on each of the authentication types.
 
 The database authentication middleware defines three new routes:
 
-    method path       - parameters               - description
+    method path       - parameters                      - description
     ---------------------------------------------------------------------------------------------------
-    POST   /register  - username + password      - adds a user with given username and password
-    POST   /login     - username + password      - logs a user in by username and password
-    POST   /logout    -                          - logs out the currently logged in user
-    GET    /me        -                          - returns the user as which you're currently logged in
+    GET    /me        -                                 - returns the user that is currently logged in
+    POST   /register  - username, password              - adds a user with given username and password
+    POST   /login     - username, password              - logs a user in by username and password
+    POST   /password  - username, password, newPassword - updates the password of the logged in user
+    POST   /logout    -                                 - logs out the currently logged in user
 
 A user can be logged in by sending it's username and password to the login endpoint (in JSON format).
 The authenticated user (with all it's properties) will be stored in the `$_SESSION['user']` variable.

api.php

@@ -7558,48 +7558,80 @@ namespace Tqdev\PhpCrudApi\Middleware {
             }
             $path = RequestUtils::getPathSegment($request, 1);
             $method = $request->getMethod();
-            if ($method == 'POST' && in_array($path, ['login', 'register'])) {
+            if ($method == 'POST' && in_array($path, ['login', 'register', 'password'])) {
                 $body = $request->getParsedBody();
                 $username = isset($body->username) ? $body->username : '';
                 $password = isset($body->password) ? $body->password : '';
+                $newPassword = isset($body->newPassword) ? $body->newPassword : '';
                 $tableName = $this->getProperty('usersTable', 'users');
                 $table = $this->reflection->getTable($tableName);
                 $usernameColumnName = $this->getProperty('usernameColumn', 'username');
                 $usernameColumn = $table->getColumn($usernameColumnName);
                 $passwordColumnName = $this->getProperty('passwordColumn', 'password');
-                $passwordColumn = $table->getColumn($passwordColumnName);
+                $pkName = $table->getPk()->getName();
                 $registerUser = $this->getProperty('registerUser', '');
+                $condition = new ColumnCondition($usernameColumn, 'eq', $username);
+                $returnedColumns = $this->getProperty('returnedColumns', '');
+                if (!$returnedColumns) {
+                    $columnNames = $table->getColumnNames();
+                } else {
+                    $columnNames = array_map('trim', explode(',', $returnedColumns));
+                    $columnNames[] = $passwordColumnName;
+                    $columnNames[] = $pkName;
+                }
+                $columnOrdering = $this->ordering->getDefaultColumnOrdering($table);
                 if ($path == 'register') {
                     if (!$registerUser) {
                         return $this->responder->error(ErrorCode::AUTHENTICATION_FAILED, $username);
                     }
+                    $users = $this->db->selectAll($table, $columnNames, $condition, $columnOrdering, 0, 1);
+                    if (!empty($users)) {
+                        return $this->responder->error(ErrorCode::USER_ALREADY_EXIST, $username);
+                    }
                     $data = json_decode($registerUser, true);
                     $data = is_array($data) ? $data : [];
                     $data[$usernameColumnName] = $username;
                     $data[$passwordColumnName] = password_hash($password, PASSWORD_DEFAULT);
                     $this->db->createSingle($table, $data);
+                    $users = $this->db->selectAll($table, $columnNames, $condition, $columnOrdering, 0, 1);
+                    foreach ($users as $user) {
+                        unset($user[$passwordColumnName]);
+                        return $this->responder->success($user);
+                    }
+                    return $this->responder->error(ErrorCode::AUTHENTICATION_FAILED, $username);
                 }
-                $condition = new ColumnCondition($usernameColumn, 'eq', $username);
-                $returnedColumns = $this->getProperty('returnedColumns', '');
-                if (!$returnedColumns) {
-                    $columnNames = $table->getColumnNames();
-                } else {
-                    $columnNames = array_map('trim', explode(',', $returnedColumns));
-                    $columnNames[] = $passwordColumnName;
+                if ($path == 'login') {
+                    $users = $this->db->selectAll($table, $columnNames, $condition, $columnOrdering, 0, 1);
+                    foreach ($users as $user) {
+                        if (password_verify($password, $user[$passwordColumnName]) == 1) {
+                            if (!headers_sent()) {
+                                session_regenerate_id(true);
+                            }
+                            unset($user[$passwordColumnName]);
+                            $_SESSION['user'] = $user;
+                            return $this->responder->success($user);
+                        }
+                    }
+                    return $this->responder->error(ErrorCode::AUTHENTICATION_FAILED, $username);
                 }
-                $columnOrdering = $this->ordering->getDefaultColumnOrdering($table);
-                $users = $this->db->selectAll($table, $columnNames, $condition, $columnOrdering, 0, 1);
-                foreach ($users as $user) {
-                    if (password_verify($password, $user[$passwordColumnName]) == 1) {
-                        if (!headers_sent()) {
-                            session_regenerate_id(true);
+                if ($path == 'password') {
+                    if ($username != ($_SESSION['user'][$usernameColumnName] ?? '')) {
+                        return $this->responder->error(ErrorCode::AUTHENTICATION_FAILED, $username);
+                    }
+                    $users = $this->db->selectAll($table, $columnNames, $condition, $columnOrdering, 0, 1);
+                    foreach ($users as $user) {
+                        if (password_verify($password, $user[$passwordColumnName]) == 1) {
+                            if (!headers_sent()) {
+                                session_regenerate_id(true);
+                            }
+                            $data = [$passwordColumnName => password_hash($newPassword, PASSWORD_DEFAULT)];
+                            $this->db->updateSingle($table, $data, $user[$pkName]);
+                            unset($user[$passwordColumnName]);
+                            return $this->responder->success($user);
                         }
-                        unset($user[$passwordColumnName]);
-                        $_SESSION['user'] = $user;
-                        return $this->responder->success($user);
                     }
+                    return $this->responder->error(ErrorCode::AUTHENTICATION_FAILED, $username);
                 }
-                return $this->responder->error(ErrorCode::AUTHENTICATION_FAILED, $username);
             }
             if ($method == 'POST' && $path == 'logout') {
                 if (isset($_SESSION['user'])) {
@@ -9929,6 +9961,7 @@ namespace Tqdev\PhpCrudApi\Record {
         const BAD_OR_MISSING_XSRF_TOKEN = 1017;
         const ONLY_AJAX_REQUESTS_ALLOWED = 1018;
         const PAGINATION_FORBIDDEN = 1019;
+        const USER_ALREADY_EXIST = 1020;
 
         private $values = [
             9999 => ["%s", ResponseFactory::INTERNAL_SERVER_ERROR],
@@ -9952,6 +9985,7 @@ namespace Tqdev\PhpCrudApi\Record {
             1017 => ["Bad or missing XSRF token", ResponseFactory::FORBIDDEN],
             1018 => ["Only AJAX requests allowed for '%s'", ResponseFactory::FORBIDDEN],
             1019 => ["Pagination forbidden", ResponseFactory::FORBIDDEN],
+            1020 => ["User '%s' already exists", ResponseFactory::CONFLICT],
         ];
 
         public function __construct(int $code)

src/Tqdev/PhpCrudApi/Middleware/DbAuthMiddleware.php

@@ -42,48 +42,80 @@ class DbAuthMiddleware extends Middleware
         }
         $path = RequestUtils::getPathSegment($request, 1);
         $method = $request->getMethod();
-        if ($method == 'POST' && in_array($path, ['login', 'register'])) {
+        if ($method == 'POST' && in_array($path, ['login', 'register', 'password'])) {
             $body = $request->getParsedBody();
             $username = isset($body->username) ? $body->username : '';
             $password = isset($body->password) ? $body->password : '';
+            $newPassword = isset($body->newPassword) ? $body->newPassword : '';
             $tableName = $this->getProperty('usersTable', 'users');
             $table = $this->reflection->getTable($tableName);
             $usernameColumnName = $this->getProperty('usernameColumn', 'username');
             $usernameColumn = $table->getColumn($usernameColumnName);
             $passwordColumnName = $this->getProperty('passwordColumn', 'password');
-            $passwordColumn = $table->getColumn($passwordColumnName);
+            $pkName = $table->getPk()->getName();
             $registerUser = $this->getProperty('registerUser', '');
+            $condition = new ColumnCondition($usernameColumn, 'eq', $username);
+            $returnedColumns = $this->getProperty('returnedColumns', '');
+            if (!$returnedColumns) {
+                $columnNames = $table->getColumnNames();
+            } else {
+                $columnNames = array_map('trim', explode(',', $returnedColumns));
+                $columnNames[] = $passwordColumnName;
+                $columnNames[] = $pkName;
+            }
+            $columnOrdering = $this->ordering->getDefaultColumnOrdering($table);
             if ($path == 'register') {
                 if (!$registerUser) {
                     return $this->responder->error(ErrorCode::AUTHENTICATION_FAILED, $username);
                 }
+                $users = $this->db->selectAll($table, $columnNames, $condition, $columnOrdering, 0, 1);
+                if (!empty($users)) {
+                    return $this->responder->error(ErrorCode::USER_ALREADY_EXIST, $username);
+                }
                 $data = json_decode($registerUser, true);
                 $data = is_array($data) ? $data : [];
                 $data[$usernameColumnName] = $username;
                 $data[$passwordColumnName] = password_hash($password, PASSWORD_DEFAULT);
                 $this->db->createSingle($table, $data);
+                $users = $this->db->selectAll($table, $columnNames, $condition, $columnOrdering, 0, 1);
+                foreach ($users as $user) {
+                    unset($user[$passwordColumnName]);
+                    return $this->responder->success($user);
+                }
+                return $this->responder->error(ErrorCode::AUTHENTICATION_FAILED, $username);
             }
-            $condition = new ColumnCondition($usernameColumn, 'eq', $username);
-            $returnedColumns = $this->getProperty('returnedColumns', '');
-            if (!$returnedColumns) {
-                $columnNames = $table->getColumnNames();
-            } else {
-                $columnNames = array_map('trim', explode(',', $returnedColumns));
-                $columnNames[] = $passwordColumnName;
+            if ($path == 'login') {
+                $users = $this->db->selectAll($table, $columnNames, $condition, $columnOrdering, 0, 1);
+                foreach ($users as $user) {
+                    if (password_verify($password, $user[$passwordColumnName]) == 1) {
+                        if (!headers_sent()) {
+                            session_regenerate_id(true);
+                        }
+                        unset($user[$passwordColumnName]);
+                        $_SESSION['user'] = $user;
+                        return $this->responder->success($user);
+                    }
+                }
+                return $this->responder->error(ErrorCode::AUTHENTICATION_FAILED, $username);
             }
-            $columnOrdering = $this->ordering->getDefaultColumnOrdering($table);
-            $users = $this->db->selectAll($table, $columnNames, $condition, $columnOrdering, 0, 1);
-            foreach ($users as $user) {
-                if (password_verify($password, $user[$passwordColumnName]) == 1) {
-                    if (!headers_sent()) {
-                        session_regenerate_id(true);
+            if ($path == 'password') {
+                if ($username != ($_SESSION['user'][$usernameColumnName] ?? '')) {
+                    return $this->responder->error(ErrorCode::AUTHENTICATION_FAILED, $username);
+                }
+                $users = $this->db->selectAll($table, $columnNames, $condition, $columnOrdering, 0, 1);
+                foreach ($users as $user) {
+                    if (password_verify($password, $user[$passwordColumnName]) == 1) {
+                        if (!headers_sent()) {
+                            session_regenerate_id(true);
+                        }
+                        $data = [$passwordColumnName => password_hash($newPassword, PASSWORD_DEFAULT)];
+                        $this->db->updateSingle($table, $data, $user[$pkName]);
+                        unset($user[$passwordColumnName]);
+                        return $this->responder->success($user);
                     }
-                    unset($user[$passwordColumnName]);
-                    $_SESSION['user'] = $user;
-                    return $this->responder->success($user);
                 }
+                return $this->responder->error(ErrorCode::AUTHENTICATION_FAILED, $username);
             }
-            return $this->responder->error(ErrorCode::AUTHENTICATION_FAILED, $username);
         }
         if ($method == 'POST' && $path == 'logout') {
             if (isset($_SESSION['user'])) {

src/Tqdev/PhpCrudApi/Record/ErrorCode.php

@@ -31,6 +31,7 @@ class ErrorCode
     const BAD_OR_MISSING_XSRF_TOKEN = 1017;
     const ONLY_AJAX_REQUESTS_ALLOWED = 1018;
     const PAGINATION_FORBIDDEN = 1019;
+    const USER_ALREADY_EXIST = 1020;
 
     private $values = [
         9999 => ["%s", ResponseFactory::INTERNAL_SERVER_ERROR],
@@ -54,6 +55,7 @@ class ErrorCode
         1017 => ["Bad or missing XSRF token", ResponseFactory::FORBIDDEN],
         1018 => ["Only AJAX requests allowed for '%s'", ResponseFactory::FORBIDDEN],
         1019 => ["Pagination forbidden", ResponseFactory::FORBIDDEN],
+        1020 => ["User '%s' already exists", ResponseFactory::CONFLICT],
     ];
 
     public function __construct(int $code)

tests/functional/002_auth/003_db_auth.log

@@ -80,12 +80,72 @@ Content-Length: 49
 POST /register
 Content-Type: application/json; charset=utf-8
 
+{"username":"user2","password":"pass2"}
+===
+409
+Content-Type: application/json; charset=utf-8
+Content-Length: 53
+
+{"code":1020,"message":"User 'user2' already exists"}
+===
+POST /register
+Content-Type: application/json; charset=utf-8
+
 {"username":"user3","password":"pass3"}
 ===
 200
 Content-Type: application/json; charset=utf-8
 Content-Length: 27
 
+{"id":3,"username":"user3"}
+===
+POST /login
+Content-Type: application/json; charset=utf-8
+
+{"username":"user3","password":"pass3"}
+===
+200
+Content-Type: application/json; charset=utf-8
+Content-Length: 27
+
+{"id":3,"username":"user3"}
+===
+GET /me
+===
+200
+Content-Type: application/json; charset=utf-8
+Content-Length: 27
+
+{"id":3,"username":"user3"}
+===
+POST /password
+Content-Type: application/json; charset=utf-8
+
+{"username":"user3","password":"pass3","newPassword":"secret3"}
+===
+200
+Content-Type: application/json; charset=utf-8
+Content-Length: 27
+
+{"id":3,"username":"user3"}
+===
+POST /logout
+===
+200
+Content-Type: application/json; charset=utf-8
+Content-Length: 27
+
+{"id":3,"username":"user3"}
+===
+POST /login
+Content-Type: application/json; charset=utf-8
+
+{"username":"user3","password":"secret3"}
+===
+200
+Content-Type: application/json; charset=utf-8
+Content-Length: 27
+
 {"id":3,"username":"user3"}
 ===
 GET /me