43 lines
1.6 KiB
PHP
43 lines
1.6 KiB
PHP
<?php
|
|
require __DIR__ . '/_bootstrap.php';
|
|
|
|
/**
|
|
* @OA\Post(
|
|
* path="/password-change.php",
|
|
* tags={"Auth"},
|
|
* summary="Change the password of the signed-in user",
|
|
* description="Revokes every other token; the current device stays signed in.",
|
|
* security={{"bearerAuth":{}}},
|
|
* @OA\RequestBody(required=true, @OA\JsonContent(
|
|
* required={"current_password","new_password"},
|
|
* @OA\Property(property="current_password", type="string", format="password"),
|
|
* @OA\Property(property="new_password", type="string", format="password", minLength=8)
|
|
* )),
|
|
* @OA\Response(response=200, ref="#/components/responses/Success"),
|
|
* @OA\Response(response=401, ref="#/components/responses/Unauthorized"),
|
|
* @OA\Response(response=422, ref="#/components/responses/ValidationError")
|
|
* )
|
|
*/
|
|
require_method('POST');
|
|
$user = require_auth($pdo);
|
|
|
|
$in = body();
|
|
$current = (string) ($in['current_password'] ?? '');
|
|
$new = (string) ($in['new_password'] ?? '');
|
|
|
|
if (strlen($new) < 8) {
|
|
json_error(422, 'Validation failed', ['new_password' => ['At least 8 characters']]);
|
|
}
|
|
if (!password_verify($current, (string) $user['password'])) {
|
|
json_error(422, 'Validation failed', ['current_password' => ['Wrong password']]);
|
|
}
|
|
|
|
$pdo->prepare('UPDATE auth_users SET password = ? WHERE id = ?')
|
|
->execute([password_hash($new, PASSWORD_DEFAULT), $user['id']]);
|
|
|
|
// Keep the device that just changed the password signed in.
|
|
$pdo->prepare('DELETE FROM api_tokens WHERE user_id = ? AND token <> ?')
|
|
->execute([$user['id'], hash('sha256', (string) bearer_token())]);
|
|
|
|
json_ok();
|