Updating the right fields

kiesraad · Feb 11, 2025 · 86e7ad6 · 86e7ad6
1 parent ae34103
commit 86e7ad6
Show file tree

Hide file tree

Showing 5 changed files with 34 additions and 24 deletions.
diff --git a/...c5c987f68ba8541a3d8205f4feab2b4b5cd0.json → ...bb66ada8b71f819b759597a353d60f85a6c0.json b/...c5c987f68ba8541a3d8205f4feab2b4b5cd0.json → ...bb66ada8b71f819b759597a353d60f85a6c0.json
diff --git a/backend/openapi.json b/backend/openapi.json
@@ -2494,18 +2494,11 @@
       },
       "UpdateUserRequest": {
         "type": "object",
-        "required": [
-          "username",
-          "role"
-        ],
         "properties": {
           "fullname": {
             "type": "string"
           },
-          "role": {
-            "$ref": "#/components/schemas/Role"
-          },
-          "username": {
+          "temp_password": {
             "type": "string"
           }
         }

diff --git a/backend/src/authentication/api.rs b/backend/src/authentication/api.rs
@@ -308,11 +308,12 @@ pub struct CreateUserRequest {
 
 #[derive(Serialize, Deserialize, ToSchema)]
 pub struct UpdateUserRequest {
-    pub username: String,
     #[serde(skip_serializing_if = "Option::is_none")]
     #[schema(nullable = false)]
     pub fullname: Option<String>,
-    pub role: Role,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    #[schema(nullable = false)]
+    pub temp_password: Option<String>,
 }
 
 /// Create a new user
@@ -359,9 +360,8 @@ pub async fn user_update(
     let user = users_repo
         .update(
             user_id,
-            update_user_req.username,
             update_user_req.fullname.as_deref(),
-            update_user_req.role,
+            update_user_req.temp_password.as_deref(),
         )
         .await?;
     Ok(Json(user))

diff --git a/backend/src/authentication/mod.rs b/backend/src/authentication/mod.rs
@@ -688,9 +688,8 @@ mod tests {
                     .header(CONTENT_TYPE, "application/json")
                     .body(Body::from(
                         serde_json::to_vec(&UpdateUserRequest {
-                            username: "user".to_string(),
                             fullname: Some("Test Full Name".to_string()),
-                            role: Role::Administrator,
+                            temp_password: None,
                         })
                         .unwrap(),
                     ))

diff --git a/backend/src/authentication/user.rs b/backend/src/authentication/user.rs
@@ -189,19 +189,20 @@ impl Users {
     pub async fn update(
         &self,
         user_id: u32,
-        username: String,
         fullname: Option<&str>,
-        role: Role,
+        temp_password: Option<&str>,
     ) -> Result<User, AuthenticationError> {
+        if let Some(pw) = temp_password {
+            self.set_temporary_password(user_id, pw).await?;
+        }
+
         let updated_user = sqlx::query_as!(
             User,
             r#"
               UPDATE
                 users
               SET
-                username = ?,
-                fullname = ?,
-                role = ?
+                fullname = ?
               WHERE id = ?
             RETURNING
                 id as "id: u32",
@@ -213,9 +214,7 @@ impl Users {
                 updated_at as "updated_at: _",
                 created_at as "created_at: _"
             "#,
-            username,
             fullname,
-            role,
             user_id
         )
         .fetch_one(&self.0)
@@ -243,6 +242,25 @@ impl Users {
         Ok(())
     }
 
+    /// Set a temporary password for a user
+    pub async fn set_temporary_password(
+        &self,
+        user_id: u32,
+        temp_password: &str,
+    ) -> Result<(), AuthenticationError> {
+        let password_hash = hash_password(temp_password)?;
+
+        sqlx::query!(
+            r#"UPDATE users SET password_hash = ? WHERE id = ?"#,
+            password_hash,
+            user_id
+        )
+        .execute(&self.0)
+        .await?;
+
+        Ok(())
+    }
+
     /// Get a user by their username
     pub async fn get_by_username(
         &self,