From 54bb4e9fe1c9819888b76c4703e02b8644821b68 Mon Sep 17 00:00:00 2001
From: Phillip Thelen <phillip@habitica.com>
Date: Wed, 9 Feb 2022 13:10:40 +0100
Subject: [PATCH] Let settings handle it when you don't have a password set but
 an email

---
 .../client/src/components/settings/site.vue   | 19 ++++++++++++-------
 website/common/locales/en/settings.json       |  1 +
 website/server/controllers/api-v3/auth.js     |  1 +
 website/server/libs/auth/index.js             | 16 +++++++++-------
 website/server/models/user/hooks.js           |  6 ++++++
 5 files changed, 29 insertions(+), 14 deletions(-)

diff --git a/website/client/src/components/settings/site.vue b/website/client/src/components/settings/site.vue
index 3b295ce290..30be04e1fd 100644
--- a/website/client/src/components/settings/site.vue
+++ b/website/client/src/components/settings/site.vue
@@ -291,14 +291,16 @@
             </li>
           </ul>
           <hr>
-          <div v-if="!user.auth.local.email">
-            <p>{{ $t('addLocalAuth') }}</p>
+          <div v-if="!user.auth.local.has_password">
+            <h5 v-if="!user.auth.local.email">{{ $t('addLocalAuth') }}</h5>
+            <h5 v-if="user.auth.local.email">{{ $t('addPasswordAuth') }}</h5>
             <div
               class="form"
               name="localAuth"
               novalidate="novalidate"
             >
-              <div class="form-group">
+              <div class="form-group"
+               v-if="!user.auth.local.email">
                 <input
                   v-model="localAuth.email"
                   class="form-control"
@@ -421,11 +423,11 @@
               {{ $t('saveAndConfirm') }}
             </button>
           </div>
-          <h5 v-if="user.auth.local.email">
+          <h5 v-if="user.auth.local.has_password">
             {{ $t('changeEmail') }}
           </h5>
           <div
-            v-if="user.auth.local.email"
+            v-if="user.auth.local.has_password"
             class="form"
             name="changeEmail"
             novalidate="novalidate"
@@ -455,11 +457,11 @@
               {{ $t('submit') }}
             </button>
           </div>
-          <h5 v-if="user.auth.local.email">
+          <h5 v-if="user.auth.local.has_password">
             {{ $t('changePass') }}
           </h5>
           <div
-            v-if="user.auth.local.email"
+            v-if="user.auth.local.has_password"
             class="form"
             name="changePassword"
             novalidate="novalidate"
@@ -865,6 +867,9 @@ export default {
       }
     },
     async addLocalAuth () {
+      if (this.localAuth.email === '') {
+        this.localAuth.email = this.user.auth.local.email;
+      }
       await axios.post('/api/v4/user/auth/local/register', this.localAuth);
       window.alert(this.$t('addedLocalAuth')); // eslint-disable-line no-alert
     },
diff --git a/website/common/locales/en/settings.json b/website/common/locales/en/settings.json
index ab305234a4..e57a90304f 100644
--- a/website/common/locales/en/settings.json
+++ b/website/common/locales/en/settings.json
@@ -134,6 +134,7 @@
     "saveCustomDayStart": "Save Custom Day Start",
     "registration": "Registration",
     "addLocalAuth": "Add Email and Password Login",
+    "addPasswordAuth": "Add Password Login",
     "generateCodes": "Generate Codes",
     "generate": "Generate",
     "getCodes": "Get Codes",
diff --git a/website/server/controllers/api-v3/auth.js b/website/server/controllers/api-v3/auth.js
index 6b7c16636e..54367c781d 100644
--- a/website/server/controllers/api-v3/auth.js
+++ b/website/server/controllers/api-v3/auth.js
@@ -343,6 +343,7 @@ api.resetPassword = {
     const email = req.body.email.toLowerCase();
     const user = await User.findOne({
       $or: [
+        { 'auth.local.username': email },
         { 'auth.local.email': email },
         { 'auth.apple.emails.value': email },
         { 'auth.google.emails.value': email },
diff --git a/website/server/libs/auth/index.js b/website/server/libs/auth/index.js
index 7d7822dfd4..6c15569276 100644
--- a/website/server/libs/auth/index.js
+++ b/website/server/libs/auth/index.js
@@ -128,12 +128,14 @@ async function registerLocal (req, res, { isV3 = false }) {
   }, { 'auth.local': 1 }).exec();
 
   if (user) {
-    if (email === user.auth.local.email) throw new NotAuthorized(res.t('emailTaken'));
-    // Check that the lowercase username isn't already used
-    if (existingUser) {
-      if (lowerCaseUsername === user.auth.local.lowerCaseUsername && existingUser._id !== user._id) throw new NotAuthorized(res.t('usernameTaken'));
-    } else if (lowerCaseUsername === user.auth.local.lowerCaseUsername) {
-      throw new NotAuthorized(res.t('usernameTaken'));
+    if (user._id !== existingUser._id) {
+      if (email === user.auth.local.email) throw new NotAuthorized(res.t('emailTaken'));
+      // Check that the lowercase username isn't already used
+      if (existingUser) {
+        if (lowerCaseUsername === user.auth.local.lowerCaseUsername && existingUser._id !== user._id) throw new NotAuthorized(res.t('usernameTaken'));
+      } else if (lowerCaseUsername === user.auth.local.lowerCaseUsername) {
+        throw new NotAuthorized(res.t('usernameTaken'));
+      }
     }
   }
 
@@ -166,7 +168,7 @@ async function registerLocal (req, res, { isV3 = false }) {
       }
       return false;
     });
-    if (!hasSocialAuth) throw new NotAuthorized(res.t('onlySocialAttachLocal'));
+    if (!hasSocialAuth && existingUser.auth.local.hashed_password) throw new NotAuthorized(res.t('onlySocialAttachLocal'));
     existingUser.auth.local = newUser.auth.local;
     newUser = existingUser;
   } else {
diff --git a/website/server/models/user/hooks.js b/website/server/models/user/hooks.js
index 6125f9e64b..62385a49fe 100644
--- a/website/server/models/user/hooks.js
+++ b/website/server/models/user/hooks.js
@@ -38,6 +38,12 @@ schema.plugin(baseModel, {
       plainObj.flags.newStuff = originalDoc.checkNewStuff();
     }
 
+    if (originalDoc.auth.local.hashed_password) {
+      plainObj.auth.local.has_password = true;
+    } else {
+      plainObj.auth.local.has_password = false;
+    }
+
     return plainObj;
   },
 });