Make sure we check password before continue

Author: KangDroid

src/main/kotlin/com/mptsix/todaydiary/data/request/PasswordChangeRequest.kt

@@ -1,5 +1,6 @@
 package com.mptsix.todaydiary.data.request
 
 data class PasswordChangeRequest(
+    var previousPassword: String,
     var userPassword: String // 바꾸고 싶은 비밀번호
 )

src/main/kotlin/com/mptsix/todaydiary/service/UserService.kt

@@ -119,9 +119,11 @@ class UserService(
     }
 
     fun changePassword(userToken: String, passwordChangeRequest: PasswordChangeRequest) {
-        val user: User = userRepository.findByUserId(getUserIdFromToken(userToken)).apply {
-            userPassword = passwordChangeRequest.userPassword
+        val user: User = userRepository.findByUserId(getUserIdFromToken(userToken))
+        if (!passwordEncryptorService.isMatching(passwordChangeRequest.previousPassword, user.userPassword)) {
+            throw ForbiddenException("Password is not correct!")
         }
+        user.userPassword = passwordEncryptorService.encodePlainText(passwordChangeRequest.userPassword)
         userRepository.addUser(user)
     }
 

src/test/kotlin/com/mptsix/todaydiary/controller/UserControllerTest.kt

@@ -185,7 +185,7 @@ internal class UserControllerTest {
             put("X-AUTH-TOKEN", listOf(loginToken))
         }
         val responseEntity: ResponseEntity<Unit> =
-            restTemplate.exchange(url, HttpMethod.PUT, HttpEntity<PasswordChangeRequest>(PasswordChangeRequest("test"), httpHeaders))
+            restTemplate.exchange(url, HttpMethod.PUT, HttpEntity<PasswordChangeRequest>(PasswordChangeRequest("test", "test"), httpHeaders))
 
         assertThat(responseEntity.statusCode).isEqualTo(HttpStatus.NO_CONTENT)
     }

src/test/kotlin/com/mptsix/todaydiary/service/UserServiceTest.kt

@@ -323,10 +323,24 @@ internal class UserServiceTest {
     @Test
     fun is_changePassword_works_well() {
         val loginToken: String = loginUser()
-        userService.changePassword(loginToken, PasswordChangeRequest("whatever"))
+        val beforeUser: User = userRepository.findByUserId(mockUser.userId)
+        userService.changePassword(loginToken, PasswordChangeRequest(mockUser.userPassword, "whatever"))
 
         val user: User = userRepository.findByUserId(mockUser.userId)
-        assertThat(user.userPassword).isEqualTo("whatever")
+        assertThat(user.userPassword).isNotEqualTo("whatever")
+        assertThat(user.userPassword).isNotEqualTo(beforeUser.userPassword)
+    }
+
+    @Test
+    fun is_changePassword_throws_forbidden() {
+        val loginToken: String = loginUser()
+        runCatching {
+            userService.changePassword(loginToken, PasswordChangeRequest("mockUser.userPassword", "whatever"))
+        }.onSuccess {
+            fail("Password is wrong, but succeed?")
+        }.onFailure {
+            assertThat(it is ForbiddenException).isEqualTo(true)
+        }
     }
 
     @Test