fix: update old password hash (deprecated token strategy)

src/model/users.js

@@ -1,6 +1,7 @@
 'use strict'
 
 import {Schema} from 'mongoose'
+import * as crypto from 'crypto'
 
 import {PassportModelAPI, createPassport, updatePassport} from './passport'
 import {connectionAPI, connectionDefault} from '../config'
@@ -104,8 +105,23 @@ export const updateUser = async function (newUserData) {
   try {
     let password
     if (userToBeUpdated.password) {
+      // Compute passport new hash for local strategy
       password = await hashPassword(userToBeUpdated.password)
 
+      /* --- @deprecated : Update password hash for token strategy --- */
+      const passport = await PassportModelAPI.findOne({
+        protocol: 'token',
+        email: userToBeUpdated.email
+      })
+      if (passport) {
+        let shasum = crypto.createHash(passport.passwordAlgorithm || 'sha512')
+        shasum.update(passport.passwordSalt + userToBeUpdated.password)
+        const passhash = shasum.digest('hex')
+        passport.passwordHash = passhash
+        await PassportModelAPI.findByIdAndUpdate(passport.id, passport)
+      }
+      /* --- ----------- --- */
+
       delete userToBeUpdated.password
     }
 

test/unit/usersTest.js

@@ -364,5 +364,109 @@ describe('UserModel tests', () => {
       should.equal(user, null)
       error.should.have.property('message')
     })
+
+    it('should update both passwords if user have two passports token and local', async () => {
+      const userToBeUpdated = {
+        id: userId,
+        firstname: 'Elena',
+        surname: 'Smith',
+        email: '[email protected]',
+        password: 'new_password',
+        groups: ['group1']
+      }
+
+      const {error, user} = await model.updateUser(userToBeUpdated)
+
+      should.equal(error, null)
+
+      user.should.have.property('id')
+      user.should.have.property('firstname', userToBeUpdated.firstname)
+      user.should.have.property('surname', userToBeUpdated.surname)
+      user.should.have.property('email', userToBeUpdated.email)
+      user.should.not.have.property('password')
+
+      const localResult = await model.PassportModelAPI.find({
+        email: user.email,
+        protocol: 'local'
+      })
+        .limit(1)
+        .sort({$natural: -1})
+
+      localResult.length.should.equal(1)
+      const localPassportResult = localResult[0]._doc
+      localPassportResult.should.have.property('password')
+
+      const res = await model.PassportModelAPI.find({
+        email: user.email,
+        protocol: 'token'
+      })
+        .limit(1)
+        .sort({$natural: -1})
+
+      res.length.should.equal(1)
+      const tokenPassportResult = res[0]._doc
+      tokenPassportResult.should.not.have.property('password')
+      tokenPassportResult.should.have.property('passwordAlgorithm')
+      tokenPassportResult.should.have.property('passwordHash')
+      tokenPassportResult.should.have.property('passwordSalt')
+      tokenPassportResult.passwordHash.should.not.equal(
+        oldPassport.passwordHash
+      )
+    })
+
+    it('should update both passwords even if user do not have a passwordAlgorithm field', async () => {
+      const localUserToBeUpdated = {
+        id: userId,
+        firstname: 'Elena',
+        surname: 'Smith',
+        email: '[email protected]',
+        password: 'new_password',
+        groups: ['group1']
+      }
+
+      const passwordRes = await model.PassportModelAPI.find({
+        email: localUserToBeUpdated.email,
+        protocol: 'token'
+      })
+        .limit(1)
+        .sort({$natural: -1})
+
+      passwordRes.length.should.equal(1)
+      await model.PassportModelAPI.findByIdAndUpdate(passwordRes[0]._id, {
+        passwordAlgorithm: null
+      })
+
+      const {error, user} = await model.updateUser(localUserToBeUpdated)
+
+      should.equal(error, null)
+
+      const localResult = await model.PassportModelAPI.find({
+        email: user.email,
+        protocol: 'local'
+      })
+        .limit(1)
+        .sort({$natural: -1})
+
+      localResult.length.should.equal(1)
+      const localPassportResult = localResult[0]._doc
+      localPassportResult.should.have.property('password')
+
+      const res = await model.PassportModelAPI.find({
+        email: user.email,
+        protocol: 'token'
+      })
+        .limit(1)
+        .sort({$natural: -1})
+
+      res.length.should.equal(1)
+      const tokenPassportResult = res[0]._doc
+      tokenPassportResult.should.not.have.property('password')
+      tokenPassportResult.should.have.property('passwordAlgorithm')
+      tokenPassportResult.should.have.property('passwordHash')
+      tokenPassportResult.should.have.property('passwordSalt')
+      tokenPassportResult.passwordHash.should.not.equal(
+        oldPassport.passwordHash
+      )
+    })
   })
 })