feat(authctl): support password reset

backend-api/cmd/authctl/main_test.go

@@ -64,6 +64,48 @@ func TestRunCreatesUserWithoutExposingPassword(t *testing.T) {
 	}
 }
 
+func TestRunResetsPasswordWithoutExposingIt(t *testing.T) {
+	databasePath := migratedDatabase(t)
+	var output bytes.Buffer
+	if err := run(
+		[]string{"create-user", "ADMIN", "Admin"},
+		testLookup(databasePath, "old-password"),
+		&output,
+	); err != nil {
+		t.Fatalf("create user: %v", err)
+	}
+	output.Reset()
+
+	err := run(
+		[]string{"reset-password", "ADMIN"},
+		testLookup(databasePath, "admin"),
+		&output,
+	)
+
+	if err != nil {
+		t.Fatalf("run(reset-password) error = %v", err)
+	}
+	if strings.Contains(output.String(), "password=admin") ||
+		output.String() != "username=admin password_updated=true\n" {
+		t.Fatalf("output = %q", output.String())
+	}
+	db, err := database.Open(context.Background(), databasePath)
+	if err != nil {
+		t.Fatalf("database.Open() error = %v", err)
+	}
+	defer db.Close()
+	var hash string
+	if err := db.QueryRow(
+		"SELECT password_hash FROM users WHERE username = 'admin'",
+	).Scan(&hash); err != nil {
+		t.Fatalf("query user: %v", err)
+	}
+	if bcrypt.CompareHashAndPassword([]byte(hash), []byte("admin")) != nil ||
+		bcrypt.CompareHashAndPassword([]byte(hash), []byte("old-password")) == nil {
+		t.Fatal("password was not replaced with a bcrypt hash")
+	}
+}
+
 func TestRunCreatesDeviceAndStoresOnlyTokenHash(t *testing.T) {
 	databasePath := migratedDatabase(t)
 	var output bytes.Buffer
@@ -177,7 +219,7 @@ func TestRunRejectsWeakPasswordAndInvalidCommands(t *testing.T) {
 	databasePath := migratedDatabase(t)
 	err := run(
 		[]string{"create-user", "BUYER", "buyer"},
-		testLookup(databasePath, "short"),
+		testLookup(databasePath, "tiny"),
 		&bytes.Buffer{},
 	)
 	if err == nil || err.Error() != "authentication input is invalid" {