Method PasswordReset

pkg/server/controllers/users.go:356–434

PasswordReset renders password reset view

(w http.ResponseWriter, r *http.Request)

// PasswordReset renders password reset view
func (u *Users) PasswordReset(w http.ResponseWriter, r *http.Request) {
	vd := views.Data{}

	var params resetPasswordPayload
	if err := parseForm(r, &params); err != nil {
		handleHTMLError(w, r, err, "parsing params", u.NewView, vd)
		return
	}

	vd.Yield = map[string]interface{}{
		"Token": params.Token,
	}

	if params.Password != params.PasswordConfirmation {
		handleHTMLError(w, r, app.ErrPasswordConfirmationMismatch, "password mismatch", u.PasswordResetConfirmView, vd)
		return
	}

	var token database.Token
	err := u.app.DB.Where("value = ? AND type =? AND used_at IS NULL", params.Token, database.TokenTypeResetPassword).First(&token).Error
	if errors.Is(err, gorm.ErrRecordNotFound) {
		handleHTMLError(w, r, app.ErrInvalidToken, "invalid token", u.PasswordResetConfirmView, vd)
		return
	}
	if err != nil {
		handleHTMLError(w, r, err, "finding token", u.PasswordResetConfirmView, vd)
		return
	}

	if token.UsedAt != nil {
		handleHTMLError(w, r, app.ErrInvalidToken, "invalid token", u.PasswordResetConfirmView, vd)
		return
	}

	// Expire after 10 minutes
	if time.Since(token.CreatedAt).Minutes() > 10 {
		handleHTMLError(w, r, app.ErrPasswordResetTokenExpired, "expired token", u.PasswordResetConfirmView, vd)
		return
	}

	var user database.User
	if err := u.app.DB.Where("id = ?", token.UserID).First(&user).Error; err != nil {
		handleHTMLError(w, r, err, "finding user", u.PasswordResetConfirmView, vd)
		return
	}

	tx := u.app.DB.Begin()

	// Update the password
	if err := app.UpdateUserPassword(tx, &user, params.Password); err != nil {
		tx.Rollback()
		handleHTMLError(w, r, err, "updating password", u.PasswordResetConfirmView, vd)
		return
	}

	if err := tx.Model(&token).Update("used_at", time.Now()).Error; err != nil {
		tx.Rollback()
		handleHTMLError(w, r, err, "updating password reset token", u.PasswordResetConfirmView, vd)