Registration: Change password

Sprint: 2

Outcome:

Users can change login password by entering old and new password and confirm OTP code

Implementation description:

Endpoints:

PUT {$domain}/api/v2/barong/resource/users/password

POST {$domain}/api/v2/barong/identity/confirm_password

File destination:

{$Dalan_Path}/app/api/v2/resource/users.rb

Commits:

fb5162e5 8b16cc49 fb9db4ee 70104499 63f69ed0 0ee97595 9e17677b 5bb29d79

What did we implement:

In the Opendax, users can change their current password without confirming the OTP code that must be sent to its mail. Also, there is not any limitation for attempting to enter the current password.

In Zagros, if users enter the wrong current password more than 3 times, they are kicked out from the logged state and the new password is just accepted after entering the valid OTP code.

TODO:
Number of failed attempts to enter the current password must be dynamic and 
changeable by the admin panel

sequenceDiagram

    Title: Change password

    note over User,Ranj: old password parameter is the same as current password
    User->>Ranj:old_password, new_password, confirm_password
    Ranj->>Dalan:Put: after client side checking
    Dalan->>Ranj:4xx if attempt number for entering the valid current password is over
    Dalan->>Ranj:4xx if new_password is not same to confirm_password
    Dalan->>Ranj:4xx if old_password is not valid
    Dalan->>Ranj:4xx if new_password is same to old_password
    Dalan->>Ranj:4xx if length of new password is not valid
    Dalan->>User:2xx send otp to his or her mail
    Ranj->>User:Ask OTP code for confirming
    User-->>Ranj:if OTP code not received, try for resend after <color:#red>120</color> seconds
    Ranj-->>Dalan: Ask for sending OTP code again
    Dalan-->>User:2xx send otp to his or her mail
    User->>Ranj: enter OTP code
    Dalan->>Ranj:4xx if user does not exist in the system
    Ranj->>Dalan:Post : OTP code for checking ice
    Dalan->>Ranj:4xx if OTP code expired
    Dalan->>Ranj:2xx change user password
    Ranj->>User:notify user that password changed

2.1 KiB Raw Blame History