allow changing passwords as superuser

2 files changed, 13 insertions, 3 deletions

diff --git a/nexus/src/main/kotlin/tech/libeufin/nexus/ebics/EbicsNexus.kt b/nexus/src/main/kotlin/tech/libeufin/nexus/ebics/EbicsNexus.kt
index 2bbadbe1..f0782124 100644
--- a/nexus/src/main/kotlin/tech/libeufin/nexus/ebics/EbicsNexus.kt
+++ b/nexus/src/main/kotlin/tech/libeufin/nexus/ebics/EbicsNexus.kt
@@ -603,6 +603,7 @@ class EbicsBankConnectionProtocol: BankConnectionProtocol {
         pdfWriter.flush()
         return po.toByteArray()
     }
+
     override fun exportBackup(bankConnectionId: String, passphrase: String): JsonNode {
         val subscriber = transaction { getEbicsSubscriberDetails(bankConnectionId) }
         val ret = EbicsKeysBackupJson(
diff --git a/nexus/src/main/kotlin/tech/libeufin/nexus/server/NexusServer.kt b/nexus/src/main/kotlin/tech/libeufin/nexus/server/NexusServer.kt
index 08e05ff6..42bf9dc6 100644
--- a/nexus/src/main/kotlin/tech/libeufin/nexus/server/NexusServer.kt
+++ b/nexus/src/main/kotlin/tech/libeufin/nexus/server/NexusServer.kt
@@ -279,6 +279,7 @@ fun serverMain(dbName: String, host: String, port: Int) {
 
             post("/permissions") {
                 val req = call.receive<ChangePermissionsRequest>()
+                val knownPermissions = listOf()
                 transaction {
                     requireSuperuser(call.request)
                     val existingPerm = findPermission(req.permission)
@@ -321,11 +322,19 @@ fun serverMain(dbName: String, host: String, port: Int) {
             }
 
             // change a user's password
-            post("/users/password") {
+            post("/users/{username}/password") {
                 val body = call.receiveJson<ChangeUserPassword>()
+                val targetUsername = ensureNonNull(call.parameters["username"])
                 transaction {
-                    val user = authenticateRequest(call.request)
-                    user.passwordHash = CryptoUtil.hashpw(body.newPassword)
+                    requireSuperuser(call.request)
+                    val targetUser = NexusUserEntity.find {
+                        NexusUsersTable.username eq targetUsername
+                    }.firstOrNull()
+                    if (targetUser == null) throw NexusError(
+                        HttpStatusCode.NotFound,
+                        "Username $targetUsername not found"
+                    )
+                    targetUser.passwordHash = CryptoUtil.hashpw(body.newPassword)
                 }
                 call.respond(NexusMessage(message = "Password successfully changed"))
                 return@post