Registration: Reset password

Sprint: 2

Outcome:

Users can reset login password by entering email and confirm by OTP code

Implementation description:

Endpoints:

POST {$domain}/api/v2/barong/identity/users/password/generate_code POST {$domain}/api/v2/barong/identity/users/password/confirm_code POST {$domain}/api/v2/barong/identity/users/password/reset

File destination:

{$Dalan_Path}/app/api/v2/identity/users.rb

Commits:

9e17677b 42b34ae2 e04a58b0

What did we implement:

In the Opendax, users get a reset token by entering their email, after in reset password page user can reset the password by entering a valid reset token and a new password

In Zagros, the reset password process is done in 3 steps, the first step is to generate OTP code by Vault, then is a step to check the OTP code in by separate API, and then reset the password

sequenceDiagram

    Title: Reset password
    
    User->>Ranj:email
    Ranj->>Dalan:Post: after client side checking
    Dalan->>Ranj:4xx if the user does not exist
    Dalan->>User:2xx send otp to his or her mail
    Ranj->>User:Ask OTP code for confirming
    User-->>Ranj:if OTP code not received, try for resend after <color:#red>120</color> seconds
    Ranj-->>Dalan: Ask for sending OTP code again
    Dalan-->>User:2xx send otp to his or her mail
    User->>Ranj: enter OTP code
    Ranj->>Dalan: OTP code for checking
    Dalan->>Ranj:4xx if user does not exist in the system
    Dalan->>Ranj:4xx if OTP code expired
    Dalan->>Ranj:2xx OTP code is check\n
    Ranj->>User: show reset password page
    Ranj->>Dalan: email, password, confirm_password
    Dalan->>Ranj:4xx if user does not exist in the system
    Dalan->>Ranj:4xx if new_password is not same to confirm_password
    Dalan->>Ranj:4xx if new password is not strong
    Dalan->>Ranj:2xx reset user password
    Ranj->>User:notify user that password changed

1.9 KiB Raw Permalink Blame History