update username, password

test/api/v3/integration/user/POST-user_update_email.test.js

@@ -4,7 +4,7 @@ import {
 } from '../../../../helpers/api-v3-integration.helper';
 import { model as User } from '../../../../../website/src/models/user';
 
-describe('POST /email/update', () => {
+describe('POST /user/update-email', () => {
   let user;
   let fbUser;
   let endpoint = '/user/update-email';
@@ -20,7 +20,7 @@ describe('POST /email/update', () => {
       await expect(user.post(endpoint)).to.eventually.be.rejected.and.eql({
         code: 400,
         error: 'BadRequest',
-        message: 'Invalid request parameters.',
+        message: t('invalidReqParams'),
       });
     });
 
@@ -30,7 +30,7 @@ describe('POST /email/update', () => {
       })).to.eventually.be.rejected.and.eql({
         code: 400,
         error: 'BadRequest',
-        message: 'Invalid request parameters.',
+        message: t('invalidReqParams'),
       });
     });
 

test/api/v3/integration/user/POST-user_update_password.test.js

@@ -0,0 +1,53 @@
+import {
+  generateUser,
+  translate as t,
+} from '../../../../helpers/api-integration/v3';
+import { model as User } from '../../../../../website/src/models/user';
+
+describe('POST /user/update-password', async () => {
+  let endpoint = '/user/update-password';
+  let user;
+  let password = 'password';
+  let wrongPassword = 'wrong-password';
+  let newPassword = 'new-password';
+
+  beforeEach(async () => {
+    user = await generateUser();
+  });
+
+  it('successfully changes the password', async () => {
+    let previousHashedPassword = user.auth.local.hashed_password;
+    let response = await user.post(endpoint, {
+      password,
+      newPassword,
+      confirmPassword: newPassword,
+    });
+    expect(response).to.eql({});
+    user = await User.findOne({ _id: user._id });
+    expect(user.auth.local.hashed_password).to.not.eql(previousHashedPassword);
+  });
+
+  it('new passwords mismatch', async () => {
+    await expect(user.post(endpoint, {
+      password,
+      newPassword,
+      confirmPassword: `${newPassword}-wrong-confirmation`,
+    })).to.eventually.be.rejected.and.eql({
+      code: 401,
+      error: 'NotAuthorized',
+      message: t('passwordConfirmationMatch'),
+    });
+  });
+
+  it('existing password is wrong', async () => {
+    await expect(user.post(endpoint, {
+      password: wrongPassword,
+      newPassword,
+      confirmPassword: newPassword,
+    })).to.eventually.be.rejected.and.eql({
+      code: 401,
+      error: 'NotAuthorized',
+      message: t('wrongPassword'),
+    });
+  });
+});

test/api/v3/integration/user/POST-user_update_username.test.js

@@ -0,0 +1,82 @@
+import {
+  generateUser,
+  translate as t,
+} from '../../../../helpers/api-integration/v3';
+import { model as User } from '../../../../../website/src/models/user';
+
+describe('POST /user/update-username', async () => {
+  let endpoint = '/user/update-username';
+  let user;
+  let newUsername = 'new-username';
+  let existingUsername = 'existing-username';
+  let password = 'password'; // from habitrpg/test/helpers/api-integration/v3/object-generators.js
+  let wrongPassword = 'wrong-password';
+
+  beforeEach(async () => {
+    user = await generateUser();
+  });
+
+  it('successfully changes username', async () => {
+    let response = await user.post(endpoint, {
+      username: newUsername,
+      password,
+    });
+    expect(response).to.eql({ username: newUsername });
+    user = await User.findOne({ _id: user._id });
+    expect(user.auth.local.username).to.eql(newUsername);
+  });
+
+  context('errors', async () => {
+    describe('new username is unavailable', async () => {
+      beforeEach(async () => {
+        user = await generateUser();
+        await user.update({'auth.local.username': existingUsername, 'auth.local.lowerCaseUsername': existingUsername });
+      });
+      it('prevents username update', async () => {
+        await expect(user.post(endpoint, {
+          username: existingUsername,
+          password,
+        })).to.eventually.be.rejected.and.eql({
+          code: 400,
+          error: 'BadRequest',
+          message: t('usernameTaken'),
+        });
+      });
+    });
+    it('password is wrong', async () => {
+      await expect(user.post(endpoint, {
+        username: newUsername,
+        password: wrongPassword,
+      })).to.eventually.be.rejected.and.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('wrongPassword'),
+      });
+    });
+    describe('social-only user', async () => {
+      beforeEach(async () => {
+        user = await generateUser();
+        await user.update({ 'auth.local': { ok: true } });
+      });
+      it('prevents username update', async () => {
+        await expect(user.post(endpoint, {
+          username: newUsername,
+          password,
+        })).to.eventually.be.rejected.and.eql({
+          code: 400,
+          error: 'BadRequest',
+          message: t('userHasNoLocalRegistration'),
+        });
+      });
+    });
+    it('new username is not provided', async () => {
+      await expect(user.post(endpoint, {
+        password,
+      })).to.eventually.be.rejected.and.eql({
+        code: 400,
+        error: 'BadRequest',
+        message: t('invalidReqParams'),
+      });
+    });
+  });
+});