Centralized demo account logic in the password auth service. ref #167

approot/messages.xml

@@ -17,6 +17,7 @@
 <message id="Lms.password-bad-login-combination">Bad login / password combination</message>
 <message id="Lms.password-client-throttled">Login throttled, please try again later</message>
 <message id="Lms.password-confirm">Confirm password</message>
+<message id="Lms.password-must-match-login">Password must match the login name!</message>
 <message id="Lms.password-new">New password</message>
 <message id="Lms.password-old">Old password</message>
 <message id="Lms.password-too-weak">Password too weak</message>
@@ -94,7 +95,6 @@
 <!--User-->
 <message id="Lms.Admin.User.demo-account">Demo account</message>
 <message id="Lms.Admin.User.demo-account-already-exists">Demo account already exists!</message>
-<message id="Lms.Admin.User.demo-password-invalid">Demo password must be the login name!</message>
 <message id="Lms.Admin.User.last-login">Last login</message>
 <message id="Lms.Admin.User.user-already-exists">User already exists!</message>
 <message id="Lms.Admin.User.user-create">New user</message>

approot/messages_fr.xml

@@ -17,6 +17,7 @@
 <message id="Lms.password-bad-login-combination">Mauvaise combinaison login / mot de passe</message>
 <message id="Lms.password-client-throttled">Trop de tentatives de connexion, veuillez réessayer plus tard</message>
 <message id="Lms.password-confirm">Confirmation du mot de passe</message>
+<message id="Lms.password-must-match-login">Le password doit être égal au login !</message>
 <message id="Lms.password-new">Nouveau mot de passe</message>
 <message id="Lms.password-old">Ancien mot de passe</message>
 <message id="Lms.password-too-weak">Mot de passe trop faible</message>
@@ -94,7 +95,6 @@
 <!--User-->
 <message id="Lms.Admin.User.demo-account">Compte de démonstration</message>
 <message id="Lms.Admin.User.demo-account-already-exists">Le compte de démonstration existe déjà !</message>
-<message id="Lms.Admin.User.demo-password-invalid">Le password doit être égal au login !</message>
 <message id="Lms.Admin.User.last-login">Date du dernier login</message>
 <message id="Lms.Admin.User.user-already-exists">L'utilisateur existe déjà !</message>
 <message id="Lms.Admin.User.user-create">Nouvel utilisateur</message>

approot/messages_it.xml

@@ -17,6 +17,7 @@
 <message id="Lms.password-bad-login-combination">Errata combinazione di Login / Password </message>
 <message id="Lms.password-client-throttled">Superati i tentativi di accesso, riprova più tardi</message>
 <message id="Lms.password-confirm">Conferma la password</message>
+<message id="Lms.password-must-match-login">La password deve essere il nome utente!</message>
 <message id="Lms.password-new">Nuova password</message>
 <message id="Lms.password-old">Vecchia password</message>
 <message id="Lms.password-too-weak">La password è troppo debole</message>
@@ -93,7 +94,6 @@
 <!--User-->
 <message id="Lms.Admin.User.demo-account">Account demo</message>
 <message id="Lms.Admin.User.demo-account-already-exists">L'account demo è già esistente!</message>
-<message id="Lms.Admin.User.demo-password-invalid">La password dell'account demo deve essere il nome utente!</message>
 <message id="Lms.Admin.User.last-login">Ultimo accesso</message>
 <message id="Lms.Admin.User.user-already-exists">Utente già esistente!</message>
 <message id="Lms.Admin.User.user-create">Crea utente</message>

approot/messages_zh.xml

@@ -17,6 +17,7 @@
 <message id="Lms.password-bad-login-combination">无效的登陆 / 密码组合</message>
 <message id="Lms.password-client-throttled">登录已被限制，请稍后再试</message>
 <message id="Lms.password-confirm">确认密码</message>
+<message id="Lms.password-must-match-login">演示密码必须是登录名！</message>
 <message id="Lms.password-new">新密码</message>
 <message id="Lms.password-old">旧密码</message>
 <message id="Lms.password-too-weak">密码太弱</message>
@@ -94,7 +95,6 @@
 <!--User-->
 <message id="Lms.Admin.User.demo-account">演示账号</message>
 <message id="Lms.Admin.User.demo-account-already-exists">演示账号已存在！</message>
-<message id="Lms.Admin.User.demo-password-invalid">演示密码必须是登录名！</message>
 <message id="Lms.Admin.User.last-login">最后登录</message>
 <message id="Lms.Admin.User.user-already-exists">用户已存在！</message>
 <message id="Lms.Admin.User.user-create">新建用户</message>

src/libs/auth/impl/internal/InternalPasswordService.cpp

@@ -80,16 +80,16 @@ namespace Auth
 		return true;
 	}
 
-	bool
+	IPasswordService::PasswordAcceptabilityResult
-	InternalPasswordService::isPasswordSecureEnough(std::string_view password, const PasswordValidationContext& context) const
+	InternalPasswordService::checkPasswordAcceptability(std::string_view password, const PasswordValidationContext& context) const
 	{
 		switch (context.userType)
 		{
 			case Database::UserType::ADMIN:
 			case Database::UserType::REGULAR:
-				return _validator.evaluateStrength(std::string {password}, context.loginName, "").isValid();
+				return _validator.evaluateStrength(std::string {password}, context.loginName, "").isValid() ? PasswordAcceptabilityResult::OK : PasswordAcceptabilityResult::TooWeak;
 			case Database::UserType::DEMO:
-				return true; // no constraint
+				return password == context.loginName ? PasswordAcceptabilityResult::OK : PasswordAcceptabilityResult::MustMatchLoginName;
 		}
 
 		throw NotImplementedException {};
@@ -106,8 +106,15 @@ namespace Auth
 		if (!user)
 			throw Exception {"User not found!"};
 
-		if (!isPasswordSecureEnough(newPassword, PasswordValidationContext {user->getLoginName(), user->getType()} ))
+		switch (checkPasswordAcceptability(newPassword, PasswordValidationContext {user->getLoginName(), user->getType()}))
-			throw PasswordTooWeakException {};
+		{
+			case PasswordAcceptabilityResult::OK:
+				break;
+			case PasswordAcceptabilityResult::TooWeak:
+				throw PasswordTooWeakException {};
+			case PasswordAcceptabilityResult::MustMatchLoginName:
+				throw PasswordMustMatchLoginNameException {};
+		}
 
 		user.modify()->setPasswordHash(passwordHash);
 		getAuthTokenService().clearAuthTokens(session, userId);

src/libs/auth/impl/internal/InternalPasswordService.hpp

@@ -41,7 +41,7 @@ namespace Auth
 						std::string_view password) override;
 
 			bool	canSetPasswords() const override;
-			bool	isPasswordSecureEnough(std::string_view loginName, const PasswordValidationContext& context) const override;
+			PasswordAcceptabilityResult	checkPasswordAcceptability(std::string_view loginName, const PasswordValidationContext& context) const override;
 			void	setPassword(Database::Session& session, Database::IdType userId, std::string_view newPassword) override;
 
 			Database::User::PasswordHash	hashPassword(std::string_view password) const;

src/libs/auth/impl/pam/PAMPasswordService.cpp

@@ -186,8 +186,8 @@ namespace Auth
 		return false;
 	}
 
-	bool
+	IPasswordService::PasswordAcceptabilityResult
-	PAMPasswordService::isPasswordSecureEnough(std::string_view, const PasswordValidationContext&) const
+	PAMPasswordService::checkPasswordAcceptability(std::string_view, const PasswordValidationContext&) const
 	{
 		throw NotImplementedException {};
 	}

src/libs/auth/impl/pam/PAMPasswordService.hpp

@@ -36,7 +36,7 @@ namespace Auth
 						std::string_view password) override;
 
 			bool	canSetPasswords() const override;
-			bool	isPasswordSecureEnough(std::string_view loginName, const PasswordValidationContext& context) const override;
+			PasswordAcceptabilityResult	checkPasswordAcceptability(std::string_view loginName, const PasswordValidationContext& context) const override;
 			void	setPassword(Database::Session& session,
 						Database::IdType userId,
 						std::string_view newPassword) override;

src/libs/auth/include/auth/IPasswordService.hpp

@@ -56,15 +56,21 @@ namespace Auth
 				std::optional<Database::IdType> userId {};
 				std::optional<Wt::WDateTime> expiry {};
 			};
-			virtual CheckResult				checkUserPassword(Database::Session& session,
+			virtual CheckResult		checkUserPassword(Database::Session& session,
-													const boost::asio::ip::address& clientAddress,
+											const boost::asio::ip::address& clientAddress,
-													std::string_view loginName,
+											std::string_view loginName,
-													std::string_view password) = 0;
+											std::string_view password) = 0;
 
-			virtual bool					canSetPasswords() const = 0;
+			virtual bool			canSetPasswords() const = 0;
 
-			virtual bool					isPasswordSecureEnough(std::string_view password, const PasswordValidationContext& context) const = 0;
+			enum class PasswordAcceptabilityResult
-			virtual void					setPassword(Database::Session& session, Database::IdType userId, std::string_view newPassword) = 0;
+			{
+				OK,
+				TooWeak,
+				MustMatchLoginName,
+			};
+			virtual PasswordAcceptabilityResult	checkPasswordAcceptability(std::string_view password, const PasswordValidationContext& context) const = 0;
+			virtual void						setPassword(Database::Session& session, Database::IdType userId, std::string_view newPassword) = 0;
 	};
 
 	std::unique_ptr<IPasswordService>	createPasswordService(std::string_view authPasswordBackend, std::size_t maxThrottlerEntryCount, IAuthTokenService& authTokenService);

src/libs/auth/include/auth/Types.hpp

@@ -36,16 +36,34 @@ namespace Auth
 			NotImplementedException() : Auth::Exception {"Not implemented"} {}
 	};
 
+	class UserNotFoundException : public Exception
+	{
+		public:
+			UserNotFoundException() : Auth::Exception {"User not found"} {}
+	};
+
 	struct PasswordValidationContext
 	{
 		std::string loginName;
 		Database::UserType userType;
 	};
 
-	class PasswordTooWeakException : public Exception
+	class PasswordException : public Exception
 	{
 		public:
-			PasswordTooWeakException() : Auth::Exception {"Password too weak"} {}
+			using Exception::Exception;
+	};
+
+	class PasswordTooWeakException : public PasswordException
+	{
+		public:
+			PasswordTooWeakException() : PasswordException {"Password too weak"} {}
+	};
+
+	class PasswordMustMatchLoginNameException : public PasswordException
+	{
+		public:
+			PasswordMustMatchLoginNameException() : PasswordException {"Password must match login name"} {}
 	};
 }
 

src/libs/subsonic/impl/SubsonicResource.cpp

@@ -559,11 +559,15 @@ handleChangePassword(RequestContext& context)
 
 		Service<Auth::IPasswordService>::get()->setPassword(context.dbSession, userId, password);
 	}
-	catch (Auth::PasswordTooWeakException&)
+	catch (const Auth::PasswordMustMatchLoginNameException&)
+	{
+		throw PasswordMustMatchLoginNameGenericError {};
+	}
+	catch (const Auth::PasswordTooWeakException&)
 	{
 		throw PasswordTooWeakGenericError {};
 	}
-	catch (Auth::Exception& authException)
+	catch (const Auth::Exception& authException)
 	{
 		throw UserNotAuthorizedError {};
 	}
@@ -658,6 +662,11 @@ handleCreateUserRequest(RequestContext& context)
 	{
 		Service<Auth::IPasswordService>::get()->setPassword(context.dbSession, userId, password);
 	}
+	catch (const Auth::PasswordMustMatchLoginNameException&)
+	{
+		removeCreatedUser();
+		throw PasswordMustMatchLoginNameGenericError {};
+	}
 	catch (const Auth::PasswordTooWeakException&)
 	{
 		removeCreatedUser();
@@ -1711,6 +1720,10 @@ handleUpdateUserRequest(RequestContext& context)
 		{
 			Service<::Auth::IPasswordService>()->setPassword(context.dbSession, userId, decodePasswordIfNeeded(*password));
 		}
+		catch (const Auth::PasswordMustMatchLoginNameException&)
+		{
+			throw PasswordMustMatchLoginNameGenericError {};
+		}
 		catch (const Auth::PasswordTooWeakException&)
 		{
 			throw PasswordTooWeakGenericError {};

src/libs/subsonic/impl/SubsonicResponse.hpp

@@ -152,6 +152,11 @@ class PasswordTooWeakGenericError : public GenericError
 	std::string getMessage() const override { return "Password too weak"; }
 };
 
+class PasswordMustMatchLoginNameGenericError : public GenericError
+{
+	std::string getMessage() const override { return "Password must match login name"; }
+};
+
 class DemoUserCannotChangePasswordGenericError : public GenericError
 {
 	std::string getMessage() const override { return "Demo user cannot change its password"; }

src/lms/ui/SettingsView.cpp

@@ -276,6 +276,14 @@ class SettingsModel : public Wt::WFormModel
 					validator(SettingsModel::ListenBrainzTokenField)->setMandatory(usesListenBrainz);
 				}
 			}
+			if (_authPasswordService)
+			{
+				if (_withOldPassword)
+					setValue(PasswordOldField, "");
+
+				setValue(PasswordField, "");
+				setValue(PasswordConfirmField, "");
+			}
 		}
 
 	private:

src/lms/ui/admin/UserView.cpp

@@ -66,7 +66,7 @@ class UserModel : public Wt::WFormModel
 			if (authPasswordService)
 			{
 				addField(PasswordField);
-				setValidator(PasswordField, createPasswordStrengthValidator([this] { return ::Auth::PasswordValidationContext {getLoginName(), Wt::asNumber(value(DemoField)) ? UserType::DEMO : UserType::REGULAR}; }));
+				setValidator(PasswordField, createPasswordStrengthValidator([this] { return ::Auth::PasswordValidationContext {getLoginName(), getUserType()}; }));
 				if (!userId)
 					validator(PasswordField)->setMandatory(true);
 			}
@@ -122,6 +122,19 @@ class UserModel : public Wt::WFormModel
 				throw UserNotAllowedException {};
 		}
 
+		Database::UserType getUserType() const
+		{
+			if (_userId)
+			{
+				auto transaction {LmsApp->getDbSession().createSharedTransaction()};
+
+				const Database::User::pointer user {Database::User::getById(LmsApp->getDbSession(), *_userId)};
+				return user->getType();
+			}
+
+			return Wt::asNumber(value(DemoField)) ? UserType::DEMO : UserType::REGULAR;
+		}
+
 		std::string getLoginName() const
 		{
 			if (_userId)
@@ -131,18 +144,8 @@ class UserModel : public Wt::WFormModel
 				const Database::User::pointer user {Database::User::getById(LmsApp->getDbSession(), *_userId)};
 				return user->getLoginName();
 			}
-			else
-				return valueText(LoginField).toUTF8();
-		}
 
-		void validatePassword(Wt::WString& error) const
+			return valueText(LoginField).toUTF8();
-		{
-			if (!valueText(PasswordField).empty() && Wt::asNumber(value(DemoField)))
-			{
-				// Demo account: password must be the same as the login name
-				if (valueText(PasswordField) != getLoginName())
-					error = Wt::WString::tr("Lms.Admin.User.demo-password-invalid");
-			}
 		}
 
 		bool validateField(Field field)
@@ -157,13 +160,6 @@ class UserModel : public Wt::WFormModel
 				if (user)
 					error = Wt::WString::tr("Lms.Admin.User.user-already-exists");
 			}
-			else if (field == PasswordField)
-			{
-				if (Wt::asNumber(value(DemoField)))
-					setValidator(PasswordField, {});
-
-				validatePassword(error);
-			}
 			else if (field == DemoField)
 			{
 				auto transaction {LmsApp->getDbSession().createSharedTransaction()};

src/lms/ui/common/PasswordValidator.cpp

@@ -48,10 +48,17 @@ namespace UserInterface
 
 		const ::Auth::PasswordValidationContext context {_passwordValidationContextGetFunc()};
 
-		if (Service<::Auth::IPasswordService>::get()->isPasswordSecureEnough(input.toUTF8(), context))
+		switch (Service<::Auth::IPasswordService>::get()->checkPasswordAcceptability(input.toUTF8(), context))
-			return Wt::WValidator::Result {Wt::ValidationState::Valid};
+		{
+			case ::Auth::IPasswordService::PasswordAcceptabilityResult::OK:
+				return Wt::WValidator::Result {Wt::ValidationState::Valid};
+			case ::Auth::IPasswordService::PasswordAcceptabilityResult::TooWeak:
+				return Wt::WValidator::Result {Wt::ValidationState::Invalid, Wt::WString::tr("Lms.password-too-weak")};
+			case ::Auth::IPasswordService::PasswordAcceptabilityResult::MustMatchLoginName:
+				return Wt::WValidator::Result {Wt::ValidationState::Invalid, Wt::WString::tr("Lms.password-must-match-login")};
+		}
 
-		return Wt::WValidator::Result {Wt::ValidationState::Invalid, Wt::WString::tr("Lms.password-too-weak")};
+		throw LmsException {"internal error"};
 	}
 
 	std::shared_ptr<Wt::WValidator>