Remove confirmation and fix lint issues

BrunoQuaresma · BrunoQuaresma · commit 2699445fac34 · 2022-05-05T14:25:34.000Z
diff --git a/coderd/users.go b/coderd/users.go
@@ -360,50 +360,33 @@ func (api *api) putUserSuspend(rw http.ResponseWriter, r *http.Request) {
 	httpapi.Write(rw, http.StatusOK, convertUser(suspendedUser, organizations))
 }
 
-func (api *api) putUserPassword(rw http.ResponseWriter, r *http.Request) {
+func (api *api) putUserPassword(rw http.ResponseWriter, r *http.Request) error {
 	user := httpmw.UserParam(r)
 
 	var params codersdk.UpdateUserPasswordRequest
 	if !httpapi.Read(rw, r, &params) {
-		return
-	}
-
-	// Check if the password is correct
-	equal, err := userpassword.Compare(string(user.HashedPassword), params.Password)
-	if err != nil {
-		httpapi.Write(rw, http.StatusInternalServerError, httpapi.Response{
-			Message: fmt.Sprintf("compare: %s", err.Error()),
-		})
-	}
-	if !equal {
-		// This message is the same as above to remove ease in detecting whether
-		// users are registered or not. Attackers still could with a timing attack.
-		httpapi.Write(rw, http.StatusUnauthorized, httpapi.Response{
-			Message: "invalid email or password",
-		})
-		return
+		return nil
 	}
 
 	// Check if the new password and the confirmation match
 	if params.NewPassword != params.ConfirmNewPassword {
-		errors := []httpapi.Error{
+		requestErrors := []httpapi.Error{
 			{
 				Field:  "confirm_new_password",
 				Detail: "The value does not match the new password",
 			},
 		}
 		httpapi.Write(rw, http.StatusBadRequest, httpapi.Response{
 			Message: fmt.Sprintf("The new password and the new password confirmation don't match"),
-			Errors:  errors,
+			Errors:  requestErrors,
 		})
-		return
+		return nil
 	}
 
 	// Hash password and update it in the database
 	hashedPassword, hashError := userpassword.Hash(params.NewPassword)
 	if hashError != nil {
-		xerrors.Errorf("hash password: %w", hashError)
-		return
+		return xerrors.Errorf("hash password: %w", hashError)
 	}
 	databaseError := api.Database.UpdateUserHashedPassword(r.Context(), database.UpdateUserHashedPasswordParams{
 		ID:             user.ID,
@@ -413,10 +396,11 @@ func (api *api) putUserPassword(rw http.ResponseWriter, r *http.Request) {
 		httpapi.Write(rw, http.StatusInternalServerError, httpapi.Response{
 			Message: fmt.Sprintf("put user password: %s", databaseError.Error()),
 		})
-		return
+		return nil
 	}
 
 	httpapi.Write(rw, http.StatusNoContent, nil)
+	return nil
 }
 
 func (api *api) userRoles(rw http.ResponseWriter, r *http.Request) {
diff --git a/coderd/users_test.go b/coderd/users_test.go
@@ -290,20 +290,6 @@ func TestUpdateUserProfile(t *testing.T) {
 func TestUpdateUserPassword(t *testing.T) {
 	t.Parallel()
 
-	t.Run("WrongPassword", func(t *testing.T) {
-		t.Parallel()
-		client := coderdtest.New(t, nil)
-		coderdtest.CreateFirstUser(t, client)
-		err := client.UpdateUserPassword(context.Background(), codersdk.Me, codersdk.UpdateUserPasswordRequest{
-			Password:           "wrongpassword",
-			NewPassword:        "newpassword",
-			ConfirmNewPassword: "newpassword",
-		})
-		var apiErr *codersdk.Error
-		require.ErrorAs(t, err, &apiErr)
-		require.Equal(t, http.StatusUnauthorized, apiErr.StatusCode())
-	})
-
 	t.Run("DifferentPasswordConfirmation", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, nil)
