FIX reset password (#130)

## FIX the reset password
As our email verification is not working, create a new endpoint that
allows the user to change the password without email verification.

Keep the email verification for future improvement.

Tested the reset password working successfully.

controllers/authentication.py

@@ -4,7 +4,7 @@
 from domain import session_scope
 from services.authentication import AuthenticationService
 
-from services.jwk import requires_auth
+from services.jwk import requires_auth, JWKService
 
 registration_parser = reqparse.RequestParser()
 registration_parser.add_argument('email', type=str)
@@ -83,14 +83,17 @@ def post(self):
         request.get_json(force=True)
         args = reset_password_parser.parse_args()
         auth = AuthenticationService()
-        with session_scope() as session:
-            result = auth.reset_password(session, args['email'], args['new_password'], args['repeat_password'])
+        user_id = JWKService.decode_user_id()
+        if user_id:
+            with session_scope() as session:
+                result = auth.reset_password(session, user_id, args['new_password'], args['repeat_password'])
+        else:
+            with session_scope() as session:
+                result = auth.reset_password_with_email(session, args['email'], args['new_password'],
+                                                        args['repeat_password'])
         return jsonify({"result": result.name})
 
 
-
-
-
 authentication_bp = Blueprint('authentication', __name__)
 api = Api(authentication_bp)
 api.add_resource(Register, '/authentication/register')

services/authentication.py

@@ -8,7 +8,7 @@
 from domain.type import Diet
 from domain import User, PasswordRetrieval
 from domain.type import UserType, RegisterResult, LoginResult, ForgotPassword, VerifyCode, ResetPassword
-from services.jwk import JWKService
+from services.jwk import JWKService, requires_auth, is_user_or_has_role
 from services.password import PasswordService
 from services.mail_sms import MailSender
 
@@ -163,7 +163,7 @@ def verify_code(session: Session, email: str, code: str):
     #  We can add captcha to make it safer
 
     @staticmethod
-    def reset_password(session: Session, email: str, new_password: str, repeat_password: str):
+    def reset_password_with_email(session: Session, email: str, new_password: str, repeat_password: str):
         """
         Reset password, check whether two input passwords are same.
         :param session:
@@ -200,4 +200,28 @@ def reset_password(session: Session, email: str, new_password: str, repeat_passw
         # print("test", passwordService.compare(old_password, test.password))
         return ResetPassword.SUCCESS
 
+    @staticmethod
+    @requires_auth
+    def reset_password(session: Session, user_id, new_password: str, repeat_password: str):
+        """
+        Reset password, check whether two input passwords are same.
+        :param session:
+        :param user_id: user's ID
+        :param new_password: new password
+        :param repeat_password: same as the new password
+        :return:
+        """
+        user = session.query(User).filter(User.id == user_id).first()
+        if user is None or new_password is None:
+            return ResetPassword.FAIL
+        if new_password != repeat_password:
+            return ResetPassword.RECHECK_TWO_INPUTS
+        if not passwordService.validate(new_password):
+            return ResetPassword.BAD_PASSWORD
+        password_hash = passwordService.hash(new_password)
+        user.password = password_hash
+        session.commit()
+        session.flush()
+        return ResetPassword.SUCCESS
+