Change Password #602

rossaddison · 2023-10-28T13:36:29Z

Q	A
Is bugfix?	❌
New feature?	✔️
Breaks BC?	❌
Fixed issues	None

what-the-diff · 2023-10-28T13:37:12Z

PR Summary

Introduction of README File
A new README.md file has been added to the root directory. This file contains a description of the demo application.
Update on Blog README
The 'blog/README.md' file has been updated to include instructions for installing Bootstrap Node Modules while using WAMP. Furthermore, improvements have been made to the "Support the Project" section.
New Route Addition
A new route has been added to the 'blog/config/common/routes/routes.php' file. This route is for the ResetController and has the URL /reset.
Localization Updates
In the blog/resources/messages/en/app.php file, translations for 'layout.password-verify.new' and 'layout.password.new' have been added. This update also includes the new translation for 'menu.password.change'.
Addition of New Menu Item
A new menu item for changing the password has been put in the blog/resources/views/layout/main.php file. This menu item links to the URL /auth/reset.
Password Reset Functionality
Several new files have been introduced to handle password reset functionality. These include a file to display the password reset form (blog/resources/views/reset/reset.php), a file to control the password reset operation (blog/src/Auth/Controller/ResetController.php), and a file to handle the reset form and its validation (blog/src/Auth/Form/ResetForm.php).
Enhanced Login Protocol
The Identity class has been improved with new methods and logic for managing login keys using cookies.
New Identity Repository Functionality
A new file has been added as blog/src/Auth/IdentityRepository.php which is responsible for handling identity repository operations.

samdark · 2023-10-30T19:08:32Z

blog/README.md

@@ -67,6 +67,11 @@ The code is statically analyzed with [Psalm](https://psalm.dev/). To run static
 ./vendor/bin/psalm
 ```

+### Installing Bootstrap Node Modules with WAMP 
+
+1. Make a directory node_modules in the blog directory.


Isn't npm creating node_modules automatically?

Testing Demo Installation:
Step 1: Downloaded zip and extracted into demo2 folder
Step 2: composer update
Step 3: c:\wamp64\www\demo2\blog>yii serve

Step 4: Whilst running wampserver in url typed: 127.0.0.1:8080

Step 5: Removed blog from .env file path to remove above error.

blog/resources/views/layout/main.php

blog/resources/views/reset/reset.php

blog/src/Auth/Form/ResetForm.php

Functionally a change password and not a reset password form that is included in the main layout and not on the login form. (Change Password)[yiisoft#602]

Adopt suggestions in (#602)[yiisoft/demo#602]

blog/config/common/routes/routes.php

blog/src/Auth/Controller/ChangeController.php

rossaddison · 2023-12-05T22:08:48Z

Please review these changes

vjik

Added several comments, fix several errors and adapt PR to last changes in Yii Form.

blog/src/Auth/Controller/ChangePasswordController.php

vjik · 2023-12-06T07:47:18Z

blog/src/Auth/Form/ChangePasswordForm.php

+{
+    private string $login = '';
+    private string $password = '';
+    private string $passwordVerify = '';


Suggested change

private string $passwordVerify = '';

private string $passwordVerify = '';

Not need field for duplicate old password.

blog/config/common/routes/routes.php

Removved passwordVerify field in the form

samdark · 2024-04-08T18:08:53Z

@rossaddison would you please resolve conflicts? Thanks.

blog/resources/messages/en/app.php

vjik · 2024-04-13T05:51:18Z

blog/src/Auth/Controller/ChangePasswordController.php

+          return $this->redirectToMain();
+      }  
+      // permit an authenticated user, ie. not a guest, only and null!== current user
+      if (!$authService->isGuest()) {


if (!$authService->isGuest()) { already not need, we have this check above.

In the same way, you can remove "if" nesting in further code.

vjik · 2024-04-13T05:54:39Z

blog/resources/views/changepassword/change.php

+                        ->id('changeForm')
+                        ->open() ?>
+
+                    <?= Field::text($formModel, 'login')->addInputAttributes(['value'=> $login ?? '', 'readonly'=>'readonly']) ?>


Do you want add ability to change password for any user? Not only current?

Yes. I will need to add a permission to the readonly => readonly e.g.

!$this->currentUser->can('changePasswordForAnyUser',[]) ? 'readonly'=>'readonly' : '';

This will make sure that only administrators with the canChangePasswordForAnyUser permission can insert a username in the login textbox in place of the {login} in order to change the password.

...And remove the

if ($this->currentUser->can('viewInv',[])) {

since all authenticated users with a lesser permission (of viewInv) should be able to change their password.

changepassword.php

<?= $canChangePasswordForAnyUser ? Field::text($formModel, 'login')->addInputAttributes(['value'=> $login ?? '']) : Field::text($formModel, 'login')->addInputAttributes(['value'=> $login ?? '', 'readonly'=>'readonly']); ?>

Controller.php

public function change( AuthService $authService, Identity $identity, IdentityRepository $identityRepository, ServerRequestInterface $request, FormHydrator $formHydrator, ChangePasswordForm $changePasswordForm ): ResponseInterface { if ($authService->isGuest()) { return $this->redirectToMain(); } // readonly the login detail on the change form $identity_id = $this->currentUser->getIdentity()->getId(); if (null!==$identity_id) { $identity = $identityRepository->findIdentity($identity_id); if (null!==$identity) { // Identity and User are in a HasOne relationship so no null value $login = $identity->getUser()?->getLogin(); if ($request->getMethod() === Method::POST && $formHydrator->populate($changePasswordForm, $request->getParsedBody()) && $changePasswordForm->change() ) { // Identity implements CookieLoginIdentityInterface: ensure the regeneration of the cookie auth key by means of $authService->logout(); // @see vendor\yiisoft\user\src\Login\Cookie\CookieLoginIdentityInterface // Specific note: "Make sure to invalidate earlier issued keys when you implement force user logout, // PASSWORD CHANGE and other scenarios, that require forceful access revocation for old sessions. // The authService logout function will regenerate the auth key here => overwriting any auth key $authService->logout(); $this->flash_message('success', $this->translator->translate('validator.password.change')); return $this->redirectToMain(); } return $this->viewRenderer->render('change', [ 'formModel' => $changePasswordForm, 'login' => $login, 'canChangePasswordForAnyUser' => $this->currentUser->can('changePasswordForAnyUser') ]); } // identity } // identity_id } // r

samdark · 2024-04-13T22:10:35Z

blog/src/Auth/Controller/ChangePasswordController.php

+      }  
+      // permit an authenticated user, ie. not a guest, only and null!== current user
+      if (!$authService->isGuest()) {
+        if ($this->current_user->can('viewInv',[])) {


viewInv isn't a good name for permission. Let's not shorten names.

Ok. Any suggestions?

If a user (normally an administrator) has the permission 'changePasswordForAnyUser', the login form 'username' text box will be not readonly so that the administrator can change any username's password in the event of a user's personal request to change their password by typing in their username.

samdark · 2024-06-30T18:11:10Z

blog/composer.json

+        "rossaddison/mailer": "dev-master",
+        "rossaddison/mailer-symfony": "*",    


@rossaddison you can link your packages locally with yiisoft/yii-dev-tool
Take a look at it

I could not get the yiisoft/mailer to function at the time due to a compatability issue with yiisoft/view i think it was at the time. So used my temporary forks instead. I do not believe the blog/composer.json, which my invoice/composer.json is based on can be compiled at the moment with composer although I have managed to keep mine going with quite a few tweaks. I am definitely going to try and get the yiisoft/yii-dev-tool integrated.

samdark · 2024-06-30T18:11:31Z

blog/composer.json

+        "rossaddison/yii-swagger": "dev-master",               
+        "rossaddison/yii-view": "*"


This was a composer setup issue. Ignore.

samdark · 2024-06-30T18:12:05Z

blog/config/common/di/rbac.php

+ * @var array $params['yiisoft/aliases']
+ * @var array $params['yiisoft/aliases']['aliases']
+ * @var string $params['yiisoft/aliases']['aliases']['@root'] 


Does that work in PhpStorm? Elsewhere?

Just on wampserver at the moment now with windows 11. Have not tested on phpStorm yet.

I mean that is IDE annotation and, as far as I know, no IDE supports this style.

The following code gives no psalm level 1 errors and is reasonably explicit.

<?php declare(strict_types=1); use Yiisoft\Access\AccessCheckerInterface; use Yiisoft\Rbac\AssignmentsStorageInterface; use Yiisoft\Rbac\ItemsStorageInterface; use Yiisoft\Rbac\Manager; use Yiisoft\Rbac\Php\AssignmentsStorage; use Yiisoft\Rbac\Php\ItemsStorage; /** * @see $params['yiisoft/aliases']['aliases']['@root'] * @var array $params * @var string $root */ $root = array_search('@root', $params); return [ ItemsStorageInterface::class => [ 'class' => ItemsStorage::class, '__construct()' => [ 'directory' => $root . DIRECTORY_SEPARATOR . 'resources' . DIRECTORY_SEPARATOR . 'rbac', ], ], AssignmentsStorageInterface::class => [ 'class' => AssignmentsStorage::class, '__construct()' => [ 'directory' => $root . DIRECTORY_SEPARATOR . 'resources' . DIRECTORY_SEPARATOR . 'rbac', ], ], AccessCheckerInterface::class => Manager::class, ];

samdark · 2024-06-30T18:12:59Z

blog/config/common/di/router.php

+        'reset' => function (array $defaultArguments = []) {
+            $defaultArguments = ['_language', 'en'];
        },


Looks suspicious. What does it reset?

Psalm level 1 testing no longer has an issue with $defaultArguments. I have removed array $defaultArguments = [] initialization and it works fine as before. I will remove it also from rossaddison/invoice. I cannot remember the exact error unfortunately.

A question from my side is where does the parameter default_arguments get assigned outside of the function since it is prefixed with a $this. i.e

'reset' => function () { $this->defaultArguments = ['_language', 'en']; },

This is why Psalm had a problem with the current setting. There is no such parameter coming from anywhere else with a type associated with it unless it has been recently setup in a vendor/config and this is why I decided to initialize it as a function parameter since I could not find an occurance elsewhere.

samdark · 2024-06-30T18:13:54Z

blog/config/common/di/router.php

-            ->addGroup(
-                Group::create('/{_language}')->routes(...$config->get('app-routes')),
-            )
-            ->addGroup(
-                Group::create()->routes(...$config->get('routes')),


Was that created to exclude debug routes from language routing?

key 'app-routes' exists in the configuration.php file whereas key 'routes' does not. Just thought routes was a better naming convention for the ['common/routes/asterisk..php']. My configuration file key 'routes' in rossaddison/invoice {root}configuration.php points to ['common/routes/*.php' as well but I do not have an app-routes key instead I have 'routes'
]. So the package still picks up all php files in the routes folder for merging. So suggest condensing the two into one.

Where in the demo would I get('routes')? Then I could possibly interchange them.

samdark · 2024-06-30T18:20:52Z

blog/src/Auth/Controller/ChangePasswordController.php

+      $this->currentUser = $currentUser;
+      $this->session = $session;      
+      $this->flash = new Flash($session);
+      $this->translator = $translator;
+      $this->viewRenderer = $viewRenderer->withControllerName('changepassword');


Suggested change

$this->currentUser = $currentUser;

$this->session = $session;

$this->flash = new Flash($session);

$this->translator = $translator;

$this->viewRenderer = $viewRenderer->withControllerName('changepassword');

$this->flash = new Flash($session);

$this->viewRenderer = $viewRenderer->withControllerName('changepassword');

Get the following Psalm Level 1 errors: (8 in total)

with the following code:

<?php declare(strict_types=1); namespace App\Auth\Controller; use App\Auth\AuthService; use App\Auth\Identity; use App\Auth\IdentityRepository; use App\Auth\Form\ChangePasswordForm; use App\Service\WebControllerService; use Psr\Http\Message\ResponseInterface; use Psr\Http\Message\ServerRequestInterface; use Yiisoft\FormModel\FormHydrator; use Yiisoft\Http\Method; use Yiisoft\Session\SessionInterface as Session; use Yiisoft\Session\Flash\Flash; use Yiisoft\Translator\TranslatorInterface as Translator; use Yiisoft\User\CurrentUser; use Yiisoft\Yii\View\Renderer\ViewRenderer; final class ChangePasswordController { public function __construct( private Flash $flash, private Translator $translator, private WebControllerService $webService, private ViewRenderer $viewRenderer, ) { $this->flash = new Flash($session); $this->translator = $translator; $this->viewRenderer = $viewRenderer->withControllerName('changepassword'); } public function change( AuthService $authService, Identity $identity, IdentityRepository $identityRepository, ServerRequestInterface $request, FormHydrator $formHydrator, ChangePasswordForm $changePasswordForm ): ResponseInterface { if ($authService->isGuest()) { return $this->redirectToMain(); } $identityId = $this->currentUser->getIdentity()->getId(); if (null!==$identityId) { $identity = $identityRepository->findIdentity($identityId); if (null!==$identity) { // Identity and User are in a HasOne relationship so no null value $login = $identity->getUser()?->getLogin(); if ($request->getMethod() === Method::POST && $formHydrator->populate($changePasswordForm, $request->getParsedBody()) && $changePasswordForm->change() ) { // Identity implements CookieLoginIdentityInterface: ensure the regeneration of the cookie auth key by means of $authService->logout(); // @see vendor\yiisoft\user\src\Login\Cookie\CookieLoginIdentityInterface // Specific note: "Make sure to invalidate earlier issued keys when you implement force user logout, // PASSWORD CHANGE and other scenarios, that require forceful access revocation for old sessions. // The authService logout function will regenerate the auth key here => overwriting any auth key $authService->logout(); $this->flash_message('success', $this->translator->translate('validator.password.change')); return $this->redirectToMain(); } return $this->viewRenderer->render('change', [ 'formModel' => $changePasswordForm, 'login' => $login, /** * @see resources\rbac\items.php * @see https://github.com/yiisoft/demo/pull/602 */ 'changePasswordForAnyUser' => $this->currentUser->can('changePasswordForAnyUser') ]); } // identity } // identityId return $this->redirectToMain(); } // reset /** * @param string $level * @param string $message * @return Flash|null */ private function flash_message(string $level, string $message): Flash|null { if (strlen($message) > 0) { $this->flash->add($level, $message, true); return $this->flash; } return null; } private function redirectToMain(): ResponseInterface { return $this->webService->getRedirectResponse('site/index'); } }

And original code:

<?php declare(strict_types=1); namespace App\Auth\Controller; use App\Auth\AuthService; use App\Auth\Identity; use App\Auth\IdentityRepository; use App\Auth\Form\ChangePasswordForm; use App\Service\WebControllerService; use Psr\Http\Message\ResponseInterface; use Psr\Http\Message\ServerRequestInterface; use Yiisoft\FormModel\FormHydrator; use Yiisoft\Http\Method; use Yiisoft\Session\SessionInterface as Session; use Yiisoft\Session\Flash\Flash; use Yiisoft\Translator\TranslatorInterface as Translator; use Yiisoft\User\CurrentUser; use Yiisoft\Yii\View\Renderer\ViewRenderer; final class ChangePasswordController { public function __construct( private Session $session, private Flash $flash, private Translator $translator, private CurrentUser $currentUser, private WebControllerService $webService, private ViewRenderer $viewRenderer, ) { $this->currentUser = $currentUser; $this->session = $session; $this->flash = new Flash($session); $this->translator = $translator; $this->viewRenderer = $viewRenderer->withControllerName('changepassword'); } public function change( AuthService $authService, Identity $identity, IdentityRepository $identityRepository, ServerRequestInterface $request, FormHydrator $formHydrator, ChangePasswordForm $changePasswordForm ): ResponseInterface { if ($authService->isGuest()) { return $this->redirectToMain(); } $identityId = $this->currentUser->getIdentity()->getId(); if (null!==$identityId) { $identity = $identityRepository->findIdentity($identityId); if (null!==$identity) { // Identity and User are in a HasOne relationship so no null value $login = $identity->getUser()?->getLogin(); if ($request->getMethod() === Method::POST && $formHydrator->populate($changePasswordForm, $request->getParsedBody()) && $changePasswordForm->change() ) { // Identity implements CookieLoginIdentityInterface: ensure the regeneration of the cookie auth key by means of $authService->logout(); // @see vendor\yiisoft\user\src\Login\Cookie\CookieLoginIdentityInterface // Specific note: "Make sure to invalidate earlier issued keys when you implement force user logout, // PASSWORD CHANGE and other scenarios, that require forceful access revocation for old sessions. // The authService logout function will regenerate the auth key here => overwriting any auth key $authService->logout(); $this->flash_message('success', $this->translator->translate('validator.password.change')); return $this->redirectToMain(); } return $this->viewRenderer->render('change', [ 'formModel' => $changePasswordForm, 'login' => $login, /** * @see resources\rbac\items.php * @see https://github.com/yiisoft/demo/pull/602 */ 'changePasswordForAnyUser' => $this->currentUser->can('changePasswordForAnyUser') ]); } // identity } // identityId return $this->redirectToMain(); } // reset /** * @param string $level * @param string $message * @return Flash|null */ private function flash_message(string $level, string $message): Flash|null { if (strlen($message) > 0) { $this->flash->add($level, $message, true); return $this->flash; } return null; } private function redirectToMain(): ResponseInterface { return $this->webService->getRedirectResponse('site/index'); } }

With the code as it is I am getting no Psalm Level 1 errors.

rossaddison/invoice has the following psalm.xml file which incorporates the following:

<plugins><pluginClass class="Psalm\SymfonyPsalmPlugin\Plugin"/></plugins> <projectFiles> <directory name="config" /> <directory name="resources/views" /> <directory name="src" /> <file name="public/index.php"/> <file name="yii"/> <file name="autoload.php"/> <ignoreFiles> <directory name="vendor/yiisoft/requirements/src" /> </ignoreFiles> </projectFiles> </psalm>

The config directory is included.

blog/src/Auth/Controller/ChangePasswordController.php

samdark · 2024-06-30T18:24:40Z

blog/src/Auth/Form/ChangePasswordForm.php

+                function (mixed $value): Result {
+                    $result = new Result();
+                    if ($this->userRepository->findByLogin((string)$value) == null) {
+                        $result->addError($this->translator->translate('validator.user.exist.not'));
+                    }
+                    return $result;
+                },
+            ],


Ideally, that should be implemented by catching a database exception on inserting a record because SELECT and then INSERT aren't atomic and, thus, can cause an exception anyway if a value is inserted by another user in between.

samdark · 2024-06-30T18:25:41Z

blog/src/Auth/Form/ChangePasswordForm.php

+            'password' => $this->PasswordRules(),
+            'newPassword' => [
+                new Required(),
+                new Length(min: 8),


I'd not limit password length because it weakens security overall.

Apply: 1. Password Length should not be limited 2. Avoid Non Atomical ....$this->userRepository->findByLogin((string)$value...derived Rule with user not exist message. @see yiisoft/demo#602 The login field is derived from the $login value from the ChangePasswordController and is read only.

rossaddison · 2024-09-28T06:50:00Z

I have created a fork of yiisoft/demo at rossaddison/demo branch change_password and will present my changes more incrementally.

samdark requested changes Oct 30, 2023

View reviewed changes

vjik added the status:under development Someone is working on a pull request. label Nov 10, 2023

rossaddison requested a review from samdark November 15, 2023 17:38

rossaddison added a commit to rossaddison/invoice that referenced this pull request Nov 18, 2023

(#602)[yiisoft/demo#602]

33ccf37

Adopt suggestions in (#602)[yiisoft/demo#602]

samdark reviewed Dec 1, 2023

View reviewed changes

blog/config/common/routes/routes.php Outdated Show resolved Hide resolved

blog/src/Auth/Controller/ChangeController.php Outdated Show resolved Hide resolved

vjik requested changes Dec 6, 2023

View reviewed changes

vjik reviewed Dec 6, 2023

View reviewed changes

blog/config/common/routes/routes.php Outdated Show resolved Hide resolved

rossaddison added a commit to rossaddison/demo that referenced this pull request Apr 7, 2024

Remove passwordVerify field yiisoft#602

a71ea95

Removved passwordVerify field in the form

rossaddison requested a review from samdark April 9, 2024 23:14

rossaddison added a commit to rossaddison/demo that referenced this pull request Apr 10, 2024

Resolve yiisoft#602 conflicts

793d8c5

rossaddison added a commit to rossaddison/demo that referenced this pull request Apr 10, 2024

Resolve yiisoft#602 conflicts

e6eb950

rossaddison added a commit to rossaddison/demo that referenced this pull request Apr 10, 2024

Resolve yiisoft#602 conflicts

bf4d0de

vjik requested changes Apr 13, 2024

View reviewed changes

samdark reviewed Apr 13, 2024

View reviewed changes

rossaddison added a commit to rossaddison/demo that referenced this pull request May 5, 2024

Update Pull Request yiisoft#602

2b23069

samdark requested changes Jun 30, 2024

View reviewed changes

rossaddison requested review from samdark, vjik and xepozz August 25, 2024 15:46

rossaddison closed this Sep 27, 2024

rossaddison force-pushed the master branch from 6caf7e5 to e16af99 Compare September 27, 2024 11:55

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Change Password #602

Change Password #602

rossaddison commented Oct 28, 2023

what-the-diff bot commented Oct 28, 2023

samdark Oct 30, 2023

rossaddison Nov 15, 2023

rossaddison Nov 15, 2023

rossaddison commented Dec 5, 2023

vjik left a comment

vjik Dec 6, 2023

samdark commented Apr 8, 2024

vjik Apr 13, 2024

vjik Apr 13, 2024

rossaddison May 5, 2024 •

edited

Loading

samdark Apr 13, 2024

rossaddison Aug 20, 2024

samdark Jun 30, 2024

xepozz Jul 6, 2024

rossaddison Aug 20, 2024 •

edited

Loading

samdark Jun 30, 2024

rossaddison Aug 20, 2024

samdark Jun 30, 2024

rossaddison Aug 20, 2024

samdark Aug 23, 2024

rossaddison Sep 15, 2024

samdark Jun 30, 2024

rossaddison Aug 20, 2024 •

edited

Loading

samdark Jun 30, 2024

rossaddison Aug 20, 2024 •

edited

Loading

samdark Jun 30, 2024

rossaddison Aug 20, 2024 •

edited

Loading

rossaddison Aug 20, 2024

rossaddison Aug 20, 2024

samdark Jun 30, 2024

samdark Jun 30, 2024

rossaddison Aug 21, 2024

rossaddison commented Sep 28, 2024 •

edited

Loading

	private string $passwordVerify = '';
	private string $passwordVerify = '';

		"rossaddison/mailer": "dev-master",
		"rossaddison/mailer-symfony": "*",

		"rossaddison/yii-swagger": "dev-master",
		"rossaddison/yii-view": "*"

Change Password #602

Change Password #602

Conversation

rossaddison commented Oct 28, 2023

what-the-diff bot commented Oct 28, 2023

PR Summary

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rossaddison commented Dec 5, 2023

vjik left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

samdark commented Apr 8, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rossaddison May 5, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rossaddison Aug 20, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rossaddison Aug 20, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rossaddison Aug 20, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rossaddison Aug 20, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rossaddison commented Sep 28, 2024 • edited Loading

rossaddison May 5, 2024 •

edited

Loading

rossaddison Aug 20, 2024 •

edited

Loading

rossaddison Aug 20, 2024 •

edited

Loading

rossaddison Aug 20, 2024 •

edited

Loading

rossaddison Aug 20, 2024 •

edited

Loading

rossaddison commented Sep 28, 2024 •

edited

Loading