From 1f2fa510ddc841cf0cc5c67939abfb93b346b7db Mon Sep 17 00:00:00 2001
From: Fergal Moran <fergal.moran@gmail.com>
Date: Mon, 7 May 2018 00:41:10 +0100
Subject: [PATCH] Fixed forgot password process

---
 .../base-page/base-page.component.ts          |  2 +-
 .../app/components/login/login.component.html |  5 ++
 .../app/components/login/login.component.ts   |  2 +
 .../app/components/reset/reset.component.html | 13 ++-
 .../app/components/reset/reset.component.ts   | 90 ++++++++++++++-----
 .../src/app/services/podnoms-auth.service.ts  | 31 +++++--
 server/Controllers/AuthController.cs          | 23 +++--
 server/Models/AppSettings.cs                  |  7 +-
 server/Models/StorageSettings.cs              |  7 ++
 9 files changed, 122 insertions(+), 58 deletions(-)
 create mode 100644 server/Models/StorageSettings.cs

diff --git a/client/src/app/components/base-page/base-page.component.ts b/client/src/app/components/base-page/base-page.component.ts
index 888495d..09cddbc 100644
--- a/client/src/app/components/base-page/base-page.component.ts
+++ b/client/src/app/components/base-page/base-page.component.ts
@@ -23,6 +23,6 @@ export class BasePageComponent {
     protected formatError(error: string): string {
         return `${error}<br />Please visit <a href="${
             environment.HELP_URL
-        }">here</a> and request help.`;
+        }" target="_blank">here</a> and request help.`;
     }
 }
diff --git a/client/src/app/components/login/login.component.html b/client/src/app/components/login/login.component.html
index ceec05f..e98c5bf 100644
--- a/client/src/app/components/login/login.component.html
+++ b/client/src/app/components/login/login.component.html
@@ -56,6 +56,11 @@
                                         <strong>Account created!</strong> Please login with your new details
                                     </div>
                                 </div>
+                                <div class="col-md-12 new-user-alert" *ngIf="justReset">
+                                    <div class="alert alert-success" role="alert">
+                                        <strong>Password succesfully reset!</strong> Please login with your new details
+                                    </div>
+                                </div>
                                 <div class="form-group row gutters-tiny">
                                     <div class="col-12 mb-10">
                                         <button type="submit" class="btn btn-block btn-hero btn-noborder btn-rounded btn-alt-primary">
diff --git a/client/src/app/components/login/login.component.ts b/client/src/app/components/login/login.component.ts
index 1cd68f3..11e587a 100644
--- a/client/src/app/components/login/login.component.ts
+++ b/client/src/app/components/login/login.component.ts
@@ -20,6 +20,7 @@ export class LoginComponent extends BasePageComponent implements OnInit {
     private _subscription: Subscription;
 
     brandNew: boolean = false;
+    justReset: boolean = false;
     username: string;
     password: string;
     isRequesting: boolean = false;
@@ -38,6 +39,7 @@ export class LoginComponent extends BasePageComponent implements OnInit {
         this._subscription = this._activatedRoute.queryParams.subscribe(
             (param: any) => {
                 this.brandNew = param['brandNew'];
+                this.justReset = param['justReset'];
                 this.username = param['email'];
             }
         );
diff --git a/client/src/app/components/reset/reset.component.html b/client/src/app/components/reset/reset.component.html
index 6697b6f..9060a07 100644
--- a/client/src/app/components/reset/reset.component.html
+++ b/client/src/app/components/reset/reset.component.html
@@ -13,7 +13,7 @@
                 <div class="row justify-content-center">
                     <div class="col-sm-8 col-md-6 col-xl-4">
                         <form class="js-validation-signin" action="" (ngSubmit)="resetPassword()" method="post">
-                            <div class="form-group row" *ngIf="noToken">
+                            <div class="form-group row" *ngIf="!token">
                                 <div class="col-12">
                                     <div class="form-material floating">
                                         <input type="text" class="form-control" id="login-username" name="login-username" [(ngModel)]="username">
@@ -21,7 +21,7 @@
                                     </div>
                                 </div>
                             </div>
-                            <div class="form-group row" *ngIf="!noToken">
+                            <div class="form-group row" *ngIf="token">
                                 <div class="col-12">
                                     <div class="form-material ">
                                         <input type="password" class="form-control" id="login-password" name="login-password" [(ngModel)]="newPassword">
@@ -29,16 +29,15 @@
                                     </div>
                                 </div>
                             </div>
-                            <div class="form-group row" *ngIf="!noToken">
+                            <div class="form-group row" *ngIf="token">
                                 <div class="col-12 ">
                                     <div class="form-material ">
-                                        <input type="password " class="form-control " id="login-password2 " name="login-password2
-                                " [(ngModel)]="newPasswordRepeat ">
-                                        <label for="login-password ">Repeat password</label>
+                                        <input type="password" class="form-control" id="login-password2" name="login-password2" [(ngModel)]="newPasswordRepeat ">
+                                        <label for="login-password">Repeat password</label>
                                     </div>
                                 </div>
                             </div>
-                            <div class="alert alert-danger " *ngIf="errorMessage " role="alert " [innerHTML]="errorMessage ">
+                            <div class="alert alert-danger" *ngIf="errorMessage " role="alert " [innerHTML]="errorMessage ">
                             </div>
                             <div class="form-group row gutters-tiny " *ngIf="successMessage ">
                                 <div class="col-12 mb-10 ">
diff --git a/client/src/app/components/reset/reset.component.ts b/client/src/app/components/reset/reset.component.ts
index 6b7ebe3..5f654b5 100644
--- a/client/src/app/components/reset/reset.component.ts
+++ b/client/src/app/components/reset/reset.component.ts
@@ -4,6 +4,7 @@ import 'rxjs/add/operator/catch';
 import { Observable } from 'rxjs/Observable';
 import { BasePageComponent } from '../base-page/base-page.component';
 import { AppInsightsService } from '../../services/app-insights.service';
+import { ActivatedRoute, Router } from '@angular/router';
 
 @Component({
     selector: 'app-reset',
@@ -14,43 +15,84 @@ export class ResetComponent extends BasePageComponent implements OnInit {
     username: string;
     errorMessage: string;
     successMessage: string;
-    noToken: boolean = true;
+    token: string;
     newPassword: string;
     newPasswordRepeat: string;
     constructor(
+        route: ActivatedRoute,
         private _authService: PodnomsAuthService,
+        private _router: Router,
         private _insightsService: AppInsightsService
     ) {
         super();
+
+        route.queryParams.subscribe((params) => {
+            this.token = params.token;
+            this.username = params.email;
+        });
     }
 
     ngOnInit() {}
     resetPassword() {
-        if (this.username) {
-            this._authService.resetPassword(this.username).subscribe(
-                (result) => {
-                    if (result.status === 200) {
-                        console.log('reset.component.ts', 'method', result);
-                        this.errorMessage = '';
-                        this.successMessage = `A password reset link has been sent to ${
-                            this.username
-                        }`;
-                    } else {
-                        this.errorMessage =
-                            'Unable to reset your password\nPlease visit https://talk.podnoms.com and request help.';
-                    }
-                },
-                (err) => {
-                    this.errorMessage = this.formatError(
-                        'Unable to reset your password'
+        if (this.token) {
+            if (this.newPassword === this.newPasswordRepeat) {
+                this._authService
+                    .resetPassword(
+                        this.username,
+                        this.newPassword,
+                        this.newPasswordRepeat,
+                        this.token
+                    )
+                    .subscribe(
+                        (result) => {
+                            if (result) {
+                                this._router.navigate(['/login'], {
+                                    queryParams: {
+                                        justReset: true,
+                                        email: this.username
+                                    }
+                                });
+                            } else {
+                                this.errorMessage = this.formatError(
+                                    'Unable to reset your password, has the link expired?'
+                                );
+                            }
+                        },
+                        (err) => {
+                            this.errorMessage = this.formatError(
+                                'Unable to reset your password, has the link expired?'
+                            );
+                        }
                     );
-                    this._insightsService.logEvent('client_error', {
-                        message: err.message
-                    });
-                }
-            );
+            }
         } else {
-            this.errorMessage = 'Please enter your email address';
+            if (this.username) {
+                this._authService.forgotPassword(this.username).subscribe(
+                    (result) => {
+                        if (result['email']) {
+                            console.log('reset.component.ts', 'method', result);
+                            this.errorMessage = '';
+                            this.successMessage = `A password reset link has been sent to ${
+                                this.username
+                            }`;
+                        } else {
+                            this.errorMessage = this.formatError(
+                                'Unable to reset your password'
+                            );
+                        }
+                    },
+                    (err) => {
+                        this.errorMessage = this.formatError(
+                            'Unable to reset your password'
+                        );
+                        this._insightsService.logEvent('client_error', {
+                            message: err.message
+                        });
+                    }
+                );
+            } else {
+                this.errorMessage = 'Please enter your email address';
+            }
         }
     }
 }
diff --git a/client/src/app/services/podnoms-auth.service.ts b/client/src/app/services/podnoms-auth.service.ts
index f07fd3f..68ce543 100644
--- a/client/src/app/services/podnoms-auth.service.ts
+++ b/client/src/app/services/podnoms-auth.service.ts
@@ -127,15 +127,32 @@ export class PodnomsAuthService extends BaseService {
             window.location.reload(true);
         }, 0);
     }
-    public resetPassword(userName: string): Observable<Response> {
+    public resetPassword(
+        email: string,
+        newPassword: string,
+        newPasswordRepeat: string,
+        code: string
+    ): Observable<Response> {
+        const body = JSON.stringify({
+            email: email,
+            password: newPassword,
+            confirmPassword: newPasswordRepeat,
+            code: code
+        });
+        return this._http.post<Response>(
+            environment.API_HOST + '/auth/reset',
+            body,
+            this.httpOptions
+        );
+    }
+    public forgotPassword(userName: string): Observable<Response> {
         const body = JSON.stringify({
             email: userName
         });
-        return this._http
-            .post<Response>(
-                environment.API_HOST + '/auth/forgotpassword',
-                body,
-                this.httpOptions
-            );
+        return this._http.post<Response>(
+            environment.API_HOST + '/auth/forgot',
+            body,
+            this.httpOptions
+        );
     }
 }
diff --git a/server/Controllers/AuthController.cs b/server/Controllers/AuthController.cs
index b1e0d46..6da82b0 100644
--- a/server/Controllers/AuthController.cs
+++ b/server/Controllers/AuthController.cs
@@ -1,3 +1,4 @@
+using System.Net;
 using System.Security.Claims;
 using System.Threading.Tasks;
 using Microsoft.AspNetCore.Authorization;
@@ -17,13 +18,15 @@ namespace PodNoms.Api.Controllers {
         private readonly UserManager<ApplicationUser> _userManager;
         private readonly IJwtFactory _jwtFactory;
         private readonly IEmailSender _emailSender;
+        private readonly AppSettings _appSettings;
         private readonly JwtIssuerOptions _jwtOptions;
 
         public AuthController(UserManager<ApplicationUser> userManager, IJwtFactory jwtFactory, IOptions<JwtIssuerOptions> jwtOptions,
-        IEmailSender emailSender) {
+                    IOptions<AppSettings> appSettings, IEmailSender emailSender) {
             _userManager = userManager;
             _jwtFactory = jwtFactory;
             _emailSender = emailSender;
+            _appSettings = appSettings.Value;
             _jwtOptions = jwtOptions.Value;
         }
 
@@ -63,32 +66,26 @@ namespace PodNoms.Api.Controllers {
             // Credentials are invalid, or account doesn't exist
             return await Task.FromResult<ClaimsIdentity>(null);
         }
-        [HttpPost("reset")]
+        [HttpPost("forgot")]
         [AllowAnonymous]
         public async Task<IActionResult> ForgotPassword([FromBody]ForgotPasswordViewModel model) {
             if (ModelState.IsValid) {
                 var user = await _userManager.FindByNameAsync(model.Email);
                 if (user == null) {
-                    // Don't reveal that the user does not exist or is not confirmed
                     return BadRequest(model);
                 }
-
-                // For more information on how to enable account confirmation and password reset please visit http://go.microsoft.com/fwlink/?LinkID=532713
-                // Send an email with this link
                 var code = await _userManager.GeneratePasswordResetTokenAsync(user);
-                var callbackUrl = Url.Action("ResetPassword", "Account", new { userId = user.Id, code = code }, protocol: HttpContext.Request.Scheme);
+                var callbackUrl = $"{_appSettings.SiteUrl}/reset?token={WebUtility.UrlEncode(code)}&email={WebUtility.UrlEncode(user.Email)}";
                 await _emailSender.SendEmailAsync(model.Email, "Reset Password",
                    "Please reset your password by clicking here: <a href=\"" + callbackUrl + "\">link</a>");
                 return Ok(model);
             }
-
-            // If we got this far, something failed, redisplay form
             return BadRequest(model);
         }
 
-        [HttpPost("/reset")]
+        [HttpPost("reset")]
         [AllowAnonymous]
-        public async Task<ActionResult> ResetPassword(ResetPasswordViewModel model) {
+        public async Task<ActionResult> ResetPassword([FromBody]ResetPasswordViewModel model) {
             if (!ModelState.IsValid) {
                 return BadRequest("Unable to reset your password at this time");
             }
@@ -98,9 +95,9 @@ namespace PodNoms.Api.Controllers {
             }
             var result = await _userManager.ResetPasswordAsync(user, model.Code, model.Password);
             if (result.Succeeded) {
-                return BadRequest();
+                return Ok(model);
             }
-            return Ok();
+            return BadRequest();
         }
     }
 }
diff --git a/server/Models/AppSettings.cs b/server/Models/AppSettings.cs
index 1ddb329..e2fb106 100644
--- a/server/Models/AppSettings.cs
+++ b/server/Models/AppSettings.cs
@@ -1,12 +1,7 @@
 namespace PodNoms.Api.Models {
     public class AppSettings {
         public string Version { get; set; }
+        public string SiteUrl { get; set; }
         public string RssUrl { get; set; }
     }
-
-    public class StorageSettings {
-        public string ConnectionString { get; set; }
-        public string CdnUrl { get; set; }
-
-    }
 }
\ No newline at end of file
diff --git a/server/Models/StorageSettings.cs b/server/Models/StorageSettings.cs
new file mode 100644
index 0000000..44cc0f4
--- /dev/null
+++ b/server/Models/StorageSettings.cs
@@ -0,0 +1,7 @@
+namespace PodNoms.Api.Models {
+    public class StorageSettings {
+        public string ConnectionString { get; set; }
+        public string CdnUrl { get; set; }
+
+    }
+}
\ No newline at end of file