feat(authctl): support password reset

backend-api/cmd/authctl/main.go

@@ -46,12 +46,12 @@ func run(
 		return err
 	}
 	var plainPassword string
-	if command == "create-user" {
+	if command == "create-user" || command == "reset-password" {
 		var exists bool
 		plainPassword, exists = lookup(passwordEnvironment)
 		if !exists || plainPassword == "" {
 			return errors.New(
-				passwordEnvironment + " must be set for create-user",
+				passwordEnvironment + " must be set for " + command,
 			)
 		}
 	}
@@ -133,6 +133,22 @@ func run(
 			result.DeviceToken,
 		)
 		return err
+	case "reset-password":
+		if err := service.ResetUserPassword(
+			ctx,
+			usecase.ResetUserPasswordCommand{
+				Username: value,
+				Password: plainPassword,
+			},
+		); err != nil {
+			return publicProvisioningError(err)
+		}
+		_, err = fmt.Fprintf(
+			output,
+			"username=%s password_updated=true\n",
+			domain.NormalizeUsername(value),
+		)
+		return err
 	case "enable-user", "disable-user":
 		active := command == "enable-user"
 		if err := service.SetUserActive(
@@ -182,7 +198,7 @@ func parseArguments(
 	}
 	if len(arguments) == 2 {
 		switch arguments[0] {
-		case "enable-user", "disable-user",
+		case "reset-password", "enable-user", "disable-user",
 			"enable-device", "disable-device":
 			return arguments[0], arguments[1], "", nil
 		}
@@ -198,6 +214,7 @@ func parseArguments(
 	}
 	return "", "", "", errors.New(
 		"usage: authctl create-user <ADMIN|BUYER> <username> | " +
+			"authctl reset-password <username> | " +
 			"authctl create-device <name> | " +
 			"authctl <enable-user|disable-user> <username> | " +
 			"authctl <enable-device|disable-device> <device-id>",