test: one-time passcode becomes invalid after use

DanielleMaywood · DanielleMaywood · commit 25581c2a5d49 · 2024-10-02T18:40:54.000Z
diff --git a/coderd/database/dbmem/dbmem.go b/coderd/database/dbmem/dbmem.go
@@ -9110,6 +9110,8 @@ func (q *FakeQuerier) UpdateUserHashedPassword(_ context.Context, arg database.U
 			continue
 		}
 		user.HashedPassword = arg.HashedPassword
+		user.HashedOneTimePasscode = nil
+		user.OneTimePasscodeExpiresAt = sql.NullTime{}
 		q.users[i] = user
 		return nil
 	}
diff --git a/coderd/userauth_test.go b/coderd/userauth_test.go
@@ -1715,6 +1715,14 @@ func TestUserForgotPassword(t *testing.T) {
 			Password: newPassword,
 		})
 		require.NoError(t, err)
+
+		// We now need to check that the one-time passcode isn't valid.
+		err = anotherClient.ChangePasswordWithOneTimePasscode(ctx, codersdk.ChangePasswordWithOneTimePasscodeRequest{
+			Email:           anotherUser.Email,
+			OneTimePasscode: oneTimePasscode,
+			Password:        "SomeDifferentSecurePassword!",
+		})
+		require.Error(t, err)
 	})
 
 	t.Run("CannotChangePasswordWithInvalidOneTimePasscode", func(t *testing.T) {
@@ -1754,6 +1762,43 @@ func TestUserForgotPassword(t *testing.T) {
 		require.Equal(t, http.StatusBadRequest, apiErr.StatusCode())
 	})
 
+	t.Run("CannotChangePasswordWithNoOneTimePasscode", func(t *testing.T) {
+		t.Parallel()
+
+		notifyEnq := &testutil.FakeNotificationsEnqueuer{}
+
+		client := coderdtest.New(t, &coderdtest.Options{
+			NotificationsEnqueuer: notifyEnq,
+		})
+		user := coderdtest.CreateFirstUser(t, client)
+
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+
+		anotherClient, anotherUser := coderdtest.CreateAnotherUser(t, client, user.OrganizationID)
+
+		err := anotherClient.RequestOneTimePasscode(ctx, codersdk.RequestOneTimePasscodeRequest{
+			Email: anotherUser.Email,
+		})
+		require.NoError(t, err)
+
+		require.Equal(t, 2, len(notifyEnq.Sent))
+
+		notif := notifyEnq.Sent[1]
+		verifyOneTimePasscodeNotification(t, notif, anotherUser.ID)
+
+		err = anotherClient.ChangePasswordWithOneTimePasscode(ctx, codersdk.ChangePasswordWithOneTimePasscodeRequest{
+			Email:           anotherUser.Email,
+			OneTimePasscode: "",
+			Password:        "SomeNewSecurePassword!",
+		})
+		require.Error(t, err)
+
+		var apiErr *codersdk.Error
+		require.ErrorAs(t, err, &apiErr)
+		require.Equal(t, http.StatusBadRequest, apiErr.StatusCode())
+	})
+
 	t.Run("CannotChangePasswordWithWeakPassword", func(t *testing.T) {
 		t.Parallel()
 

Original file line number	Diff line number	Diff line change
`@@ -9110,6 +9110,8 @@ func (q *FakeQuerier) UpdateUserHashedPassword(_ context.Context, arg database.U`
`9110`	`9110`	`continue`
`9111`	`9111`	`}`
`9112`	`9112`	`user.HashedPassword = arg.HashedPassword`
	`9113`	`+ user.HashedOneTimePasscode = nil`
	`9114`	`+ user.OneTimePasscodeExpiresAt = sql.NullTime{}`
`9113`	`9115`	`q.users[i] = user`
`9114`	`9116`	`return nil`
`9115`	`9117`	`}`