Add reset password mutation

Author: mcelicalderon

app/graphql/graphql_devise/mutations/base.rb

@@ -9,6 +9,10 @@ def raise_user_error(message)
         raise GraphqlDevise::UserError, message
       end
 
+      def raise_user_error_list(message, errors:)
+        raise GraphqlDevise::DetailedUserError.new(message, errors: errors)
+      end
+
       def remove_resource
         controller.resource = nil
         controller.client_id = nil
@@ -31,6 +35,10 @@ def resource_class
         context[:resource_class]
       end
 
+      def recoverable_enabled?
+        resource_class.devise_modules.include?(:recoverable)
+      end
+
       def current_resource
         context[:current_resource]
       end

app/graphql/graphql_devise/mutations/login.rb

@@ -17,7 +17,7 @@ def resolve(email:, password:)
 
           yield resource if block_given?
 
-          { success: true, authenticable: resource, errors: [] }
+          { authenticable: resource}
         elsif resource && !active_for_authentication?(resource)
           if locked?(resource)
             raise_user_error(I18n.t('graphql_devise.mailer.unlock_instructions.account_lock_msg'))

app/graphql/graphql_devise/mutations/update_password.rb

@@ -0,0 +1,44 @@
+module GraphqlDevise
+  module Mutations
+    class UpdatePassword < Base
+      argument :password,              String, required: true
+      argument :password_confirmation, String, required: true
+      argument :current_password,      String, required: false
+
+      def resolve(current_password: nil, **attrs)
+        if current_resource.blank?
+          raise_user_error(I18n.t('graphql_devise.not_authenticated'))
+        elsif current_resource.provider != 'email'
+          raise_user_error(
+            I18n.t('graphql_devise.passwords.password_not_required', provider: current_resource.provider.humanize)
+          )
+        end
+
+        if update_cresource_password(current_password, attrs)
+          current_resource.allow_password_change = false if recoverable_enabled?
+          current_resource.save!
+
+          yield current_resource if block_given?
+
+          { authenticable: current_resource }
+        else
+          raise_user_error_list(
+            I18n.t('graphql_devise.passwords.update_password_error'),
+            errors: current_resource.errors.full_messages
+          )
+        end
+      end
+
+      private
+
+      def update_cresource_password(current_password, attrs)
+        allow_password_change = recoverable_enabled? && current_resource.allow_password_change == true
+        if DeviseTokenAuth.check_current_password_before_update == false || allow_password_change
+          current_resource.public_send(:update, attrs)
+        else
+          current_resource.public_send(:update_with_password, attrs.merge(current_password: current_password))
+        end
+      end
+    end
+  end
+end

config/locales/en.yml

@@ -1,6 +1,11 @@
 en:
   graphql_devise:
+    not_authenticated: "User is not logged in."
     user_not_found: "User was not found or was not logged in."
+    passwords:
+      update_password_error: "Unable to update user password"
+      missing_passwords: "You must fill out the fields labeled 'Password' and 'Password confirmation'."
+      password_not_required: "This account does not require a password. Sign in using your '%{provider}' account instead."
     sessions:
       bad_credentials: "Invalid login credentials. Please try again."
       not_confirmed: "A confirmation email was sent to your account at '%{email}'. You must follow the instructions in the email before your account can be activated"

lib/graphql_devise.rb

@@ -9,3 +9,4 @@ class Error < StandardError; end
 end
 
 require 'graphql_devise/user_error'
+require 'graphql_devise/detailed_user_error'

lib/graphql_devise/detailed_user_error.rb

@@ -0,0 +1,14 @@
+module GraphqlDevise
+  class DetailedUserError < GraphQL::ExecutionError
+    def initialize(message, errors:)
+      @message = message
+      @errors  = errors
+
+      super(message)
+    end
+
+    def to_h
+      super.merge(extensions: { code: 'USER_ERROR', detailed_errors: @errors })
+    end
+  end
+end

lib/graphql_devise/rails/routes.rb

@@ -19,16 +19,17 @@ def mount_graphql_devise_for(resource, opts = {})
                            GraphqlDevise::Types::AuthenticableType
 
       default_mutations = {
-        login:  GraphqlDevise::Mutations::Login,
-        logout: GraphqlDevise::Mutations::Logout
+        login:           GraphqlDevise::Mutations::Login,
+        logout:          GraphqlDevise::Mutations::Logout,
+        update_password: GraphqlDevise::Mutations::UpdatePassword
       }.freeze
 
       default_mutations.each do |action, mutation|
         used_mutation = if mutation_options[action].present?
           mutation_options[action]
         else
           new_mutation = Class.new(mutation)
-          new_mutation.graphql_name("#{resource}#{action.to_s.titleize}")
+          new_mutation.graphql_name("#{resource}#{action.to_s.camelize(:upper)}")
           new_mutation.field(:authenticable, authenticable_type, null: true)
 
           new_mutation

spec/dummy/config/initializers/devise_token_auth.rb

@@ -5,7 +5,7 @@
   # client is responsible for keeping track of the changing tokens. Change
   # this to false to prevent the Authorization header from changing after
   # each request.
-  # config.change_headers_on_each_request = true
+  config.change_headers_on_each_request = false
 
   # By default, users will need to re-authenticate after 2 weeks. This setting
   # determines how long tokens will remain valid after they are issued.
@@ -35,7 +35,7 @@
   # Uncomment to enforce current_password param to be checked before all
   # attribute updates. Set it to :password if you want it to be checked only if
   # password is updated.
-  # config.check_current_password_before_update = :attributes
+  config.check_current_password_before_update = :password
 
   # By default we will use callbacks for single omniauth.
   # It depends on fields like email, provider and uid.

spec/requests/mutations/login_spec.rb

@@ -18,7 +18,7 @@
     GRAPHQL
   end
 
-  before { post '/api/v1/graphql_auth', *graphql_params }
+  before { post_request }
 
   context 'when user is able to login' do
     context 'when credentials are valid' do

spec/requests/mutations/logout_spec.rb

@@ -7,14 +7,14 @@
   let(:query) do
     <<-GRAPHQL
       mutation {
-        userLogout{
+        userLogout {
           authenticable { email }
         }
       }
     GRAPHQL
   end
 
-  before { post '/api/v1/graphql_auth', *graphql_params }
+  before { post_request }
 
   context 'when user is logged in' do
     let(:headers) { user.create_new_auth_token }