Allow password reset request for users in realms

Author: beeman

common/models/user.js

@@ -546,11 +546,12 @@ module.exports = function(User) {
   };
 
   /**
-   * Create a short lived acess token for temporary login. Allows users
+   * Create a short lived access token for temporary login. Allows users
    * to change passwords if forgotten.
    *
    * @options {Object} options
-   * @prop {String} email The user's email address
+   * @property {String} email The user's email address
+   * @property {String} realm The user's realm (optional)
    * @callback {Function} callback
    * @param {Error} err
    */
@@ -575,7 +576,13 @@ module.exports = function(User) {
     } catch (err) {
       return cb(err);
     }
-    UserModel.findOne({ where: { email: options.email }}, function(err, user) {
+    var where = {
+      email: options.email
+    };
+    if (options.realm) {
+      where.realm = options.realm;
+    }
+    UserModel.findOne({ where: where }, function(err, user) {
       if (err) {
         return cb(err);
       }

test/user.test.js

@@ -15,6 +15,7 @@ describe('User', function() {
   var validCredentials = {email: validCredentialsEmail, password: 'bar'};
   var validCredentialsEmailVerified = {email: '[email protected]', password: 'bar1', emailVerified: true};
   var validCredentialsEmailVerifiedOverREST = {email: '[email protected]', password: 'bar2', emailVerified: true};
+  var validCredentialsWithRealm = {email: '[email protected]', password: 'bar', realm: 'foobar'};
   var validCredentialsWithTTL = {email: '[email protected]', password: 'bar', ttl: 3600};
   var validCredentialsWithTTLAndScope = {email: '[email protected]', password: 'bar', ttl: 3600, scope: 'all'};
   var validMixedCaseEmailCredentials = {email: '[email protected]', password: 'bar'};
@@ -1878,6 +1879,58 @@ describe('User', function() {
           });
       });
     });
+
+    describe('User.resetPassword(options, cb) requiring realm', function() {
+      var realmUser;
+
+      beforeEach(function(done) {
+        User.create(validCredentialsWithRealm, function(err, u) {
+          if (err) return done(err);
+
+          realmUser = u;
+          done();
+        });
+      });
+
+      it('Reports when email is not found in realm', function(done) {
+        User.resetPassword({
+          email: realmUser.email,
+          realm: 'unknown'
+        }, function(err) {
+          assert(err);
+          assert.equal(err.code, 'EMAIL_NOT_FOUND');
+          assert.equal(err.statusCode, 404);
+
+          done();
+        });
+      });
+
+      it('Creates a temp accessToken to allow a user in realm to change password', function(done) {
+        var calledBack = false;
+
+        User.resetPassword({
+          email: realmUser.email,
+          realm: realmUser.realm
+        }, function() {
+          calledBack = true;
+        });
+
+        User.once('resetPasswordRequest', function(info) {
+          assert(info.email);
+          assert(info.accessToken);
+          assert(info.accessToken.id);
+          assert.equal(info.accessToken.ttl / 60, 15);
+          assert(calledBack);
+          info.accessToken.user(function(err, user) {
+            if (err) return done(err);
+
+            assert.equal(user.email, realmUser.email);
+
+            done();
+          });
+        });
+      });
+    });
   });
 
   describe('Email Update', function() {