use chrono::Utc;
use serde::Deserialize;
use serde_json::{Value, json};
use crate::{
action::io::parse_request,
error::{AppError, Result},
storage::Storage,
types::{ClientId, UserStatus},
validation::{validate_confirmation_code, validate_password, validate_username},
};
use super::helpers::{hash_password, normalize_confirmation_code, verify_secret_hash};
#[derive(Debug, Deserialize)]
#[serde(rename_all = "PascalCase")]
struct Request {
client_id: ClientId,
username: String,
confirmation_code: String,
password: String,
#[serde(default)]
analytics_metadata: Option<Value>,
#[serde(default)]
client_metadata: Option<std::collections::HashMap<String, String>>,
#[serde(default)]
secret_hash: Option<String>,
#[serde(default)]
user_context_data: Option<Value>,
}
pub async fn handler(storage: &Storage, body: Value) -> Result<Value> {
let req: Request = parse_request(body)?;
let _ = (
&req.analytics_metadata,
&req.client_metadata,
&req.secret_hash,
&req.user_context_data,
);
validate_username(&req.username)?;
validate_confirmation_code(&req.confirmation_code)?;
validate_password(&req.password)?;
let client = storage
.get_user_pool_client(&req.client_id)
.await
.ok_or(AppError::UserPoolClientNotFound)?;
verify_secret_hash(&client, &req.username, req.secret_hash.as_deref())?;
let mut user = storage
.get_user_by_username(&client.user_pool_id, &req.username)
.await
.ok_or(AppError::UserNotFound)?;
if !user.enabled {
return Err(AppError::UserDisabled);
}
if user.user_status == UserStatus::Unconfirmed {
return Err(AppError::UserNotConfirmed);
}
let reset_code = storage
.get_password_reset_code(&user.id)
.await
.ok_or(AppError::InvalidConfirmationCode)?;
if normalize_confirmation_code(&reset_code.code)
!= normalize_confirmation_code(&req.confirmation_code)
{
return Err(AppError::InvalidConfirmationCode);
}
if reset_code.expires_at < Utc::now() {
storage.delete_password_reset_code(&user.id).await;
return Err(AppError::ExpiredCode);
}
user.password_hash = hash_password(&req.password).map_err(AppError::Internal)?;
if user.user_status == UserStatus::ResetRequired {
user.user_status = UserStatus::Confirmed;
}
user.last_modified_date = Utc::now();
storage.update_user(user.clone()).await;
storage.delete_password_reset_code(&user.id).await;
Ok(json!({}))
}
#[cfg(test)]
mod tests {
use super::*;
use serde_json::json;
use crate::action::user::{admin_reset_user_password, forgot_password, initiate_auth, sign_up};
use crate::action::user_pool::{create_user_pool, create_user_pool_client};
use crate::types::{UserPoolId, UserStatus};
async fn setup_pool_and_client(storage: &Storage) -> (String, String) {
let pool = create_user_pool::handler(storage, json!({"PoolName": "test"}))
.await
.unwrap();
let pool_id = pool["UserPool"]["Id"].as_str().unwrap().to_string();
let client = create_user_pool_client::handler(
storage,
json!({
"UserPoolId": pool_id,
"ClientName": "test-client"
}),
)
.await
.unwrap();
let client_id = client["UserPoolClient"]["ClientId"]
.as_str()
.unwrap()
.to_string();
(pool_id, client_id)
}
#[tokio::test]
async fn test_confirm_forgot_password_success() {
let storage = Storage::new();
let (_pool_id, client_id) = setup_pool_and_client(&storage).await;
let sign_up_result = sign_up::handler(
&storage,
json!({
"ClientId": client_id,
"Username": "testuser",
"Password": "Password123!",
"UserAttributes": [
{"Name": "email", "Value": "test@example.com"}
]
}),
)
.await
.unwrap();
let user_sub = sign_up_result["UserSub"].as_str().unwrap();
let user_id = uuid::Uuid::parse_str(user_sub).unwrap();
storage.confirm_user(&user_id).await;
forgot_password::handler(
&storage,
json!({
"ClientId": client_id,
"Username": "testuser"
}),
)
.await
.unwrap();
let reset_code = storage.get_password_reset_code(&user_id).await.unwrap();
let result = handler(
&storage,
json!({
"ClientId": client_id,
"Username": "testuser",
"ConfirmationCode": reset_code.code,
"Password": "NewPassword456!"
}),
)
.await;
assert!(result.is_ok());
let auth_result = initiate_auth::handler(
&storage,
json!({
"ClientId": client_id,
"AuthFlow": "USER_PASSWORD_AUTH",
"AuthParameters": {
"USERNAME": "testuser",
"PASSWORD": "NewPassword456!"
}
}),
)
.await;
assert!(auth_result.is_ok());
}
#[tokio::test]
async fn test_confirm_forgot_password_invalid_code() {
let storage = Storage::new();
let (_pool_id, client_id) = setup_pool_and_client(&storage).await;
let sign_up_result = sign_up::handler(
&storage,
json!({
"ClientId": client_id,
"Username": "testuser",
"Password": "Password123!",
"UserAttributes": [
{"Name": "email", "Value": "test@example.com"}
]
}),
)
.await
.unwrap();
let user_sub = sign_up_result["UserSub"].as_str().unwrap();
let user_id = uuid::Uuid::parse_str(user_sub).unwrap();
storage.confirm_user(&user_id).await;
forgot_password::handler(
&storage,
json!({
"ClientId": client_id,
"Username": "testuser"
}),
)
.await
.unwrap();
let result = handler(
&storage,
json!({
"ClientId": client_id,
"Username": "testuser",
"ConfirmationCode": "WRONG-CODE",
"Password": "NewPassword456!"
}),
)
.await;
assert!(result.is_err());
}
#[tokio::test]
async fn test_confirm_forgot_password_expired_code() {
let storage = Storage::new();
let (_pool_id, client_id) = setup_pool_and_client(&storage).await;
let sign_up_result = sign_up::handler(
&storage,
json!({
"ClientId": client_id,
"Username": "testuser",
"Password": "Password123!",
"UserAttributes": [
{"Name": "email", "Value": "test@example.com"}
]
}),
)
.await
.unwrap();
let user_sub = sign_up_result["UserSub"].as_str().unwrap();
let user_id = uuid::Uuid::parse_str(user_sub).unwrap();
storage.confirm_user(&user_id).await;
forgot_password::handler(
&storage,
json!({
"ClientId": client_id,
"Username": "testuser"
}),
)
.await
.unwrap();
let mut reset_code = storage.get_password_reset_code(&user_id).await.unwrap();
reset_code.expires_at = Utc::now() - chrono::Duration::minutes(1);
storage.save_password_reset_code(reset_code.clone()).await;
let result = handler(
&storage,
json!({
"ClientId": client_id,
"Username": "testuser",
"ConfirmationCode": reset_code.code,
"Password": "NewPassword456!"
}),
)
.await;
assert!(matches!(result, Err(AppError::ExpiredCode)));
assert!(storage.get_password_reset_code(&user_id).await.is_none());
}
#[tokio::test]
async fn test_confirm_forgot_password_clears_reset_required_status() {
let storage = Storage::new();
let (pool_id, client_id) = setup_pool_and_client(&storage).await;
sign_up::handler(
&storage,
json!({
"ClientId": client_id,
"Username": "resetuser",
"Password": "Password123!",
"UserAttributes": [
{"Name": "email", "Value": "test@example.com"}
]
}),
)
.await
.unwrap();
let pool_id_typed: UserPoolId = pool_id.parse().unwrap();
let user = storage
.get_user_by_username(&pool_id_typed, "resetuser")
.await
.unwrap();
storage.confirm_user(&user.id).await;
admin_reset_user_password::handler(
&storage,
json!({
"UserPoolId": pool_id,
"Username": "resetuser"
}),
)
.await
.unwrap();
let reset_code = storage.get_password_reset_code(&user.id).await.unwrap();
handler(
&storage,
json!({
"ClientId": client_id,
"Username": "resetuser",
"ConfirmationCode": reset_code.code,
"Password": "NewPassword456!"
}),
)
.await
.unwrap();
let updated_user = storage.get_user(&user.id).await.unwrap();
assert_eq!(updated_user.user_status, UserStatus::Confirmed);
}
}