[CORL-445] Change Password (#2426)

* fix: reversed `new-password` autocomplete option

* feat: initial implementation

* fix: localization and testing

* fix: updated snapshot

src/core/server/graph/tenant/loaders/Comments.ts

@@ -74,8 +74,9 @@ const primeCommentsFromConnection = (ctx: Context) => (
  */
 const mapVisibleComment = (user?: Pick<User, "role">) => {
   // Check to see if this user is privileged and can view non-visible comments.
-  const isPrivilegedUser =
-    user && [GQLUSER_ROLE.ADMIN, GQLUSER_ROLE.MODERATOR].includes(user.role);
+  const isPrivilegedUser = Boolean(
+    user && [GQLUSER_ROLE.ADMIN, GQLUSER_ROLE.MODERATOR].includes(user.role)
+  );
 
   // Return a function that will map out the non-visible comments if needed.
   return (comment: Readonly<Comment> | null) => {
@@ -103,7 +104,7 @@ const mapVisibleComments = (user?: Pick<User, "role">) => (
 ): Array<Readonly<Comment> | null> => comments.map(mapVisibleComment(user));
 
 export default (ctx: Context) => ({
-  comment: new DataLoader(
+  comment: new DataLoader<string, Readonly<Comment> | null>(
     (ids: string[]) =>
       retrieveManyComments(ctx.mongo, ctx.tenant.id, ids).then(
         mapVisibleComments(ctx.user)

src/core/server/graph/tenant/mutators/Users.ts

@@ -95,12 +95,16 @@ export const Users = (ctx: TenantContext) => ({
   updatePassword: async (
     input: GQLUpdatePasswordInput
   ): Promise<Readonly<User> | null> =>
-    updatePassword(
-      ctx.mongo,
-      ctx.mailerQueue,
-      ctx.tenant,
-      ctx.user!,
-      input.password
+    mapFieldsetToErrorCodes(
+      updatePassword(
+        ctx.mongo,
+        ctx.mailerQueue,
+        ctx.tenant,
+        ctx.user!,
+        input.oldPassword,
+        input.newPassword
+      ),
+      { "input.oldPassword": [ERROR_CODES.PASSWORD_INCORRECT] }
     ),
   createToken: async (input: GQLCreateTokenInput) =>
     createToken(

src/core/server/graph/tenant/resolvers/Mutation.ts

@@ -1,5 +1,7 @@
 import { GQLMutationTypeResolver } from "coral-server/graph/tenant/schema/__generated__/types";
 
+// TODO: (wyattjoh) add rate limiting to these edges
+
 export const Mutation: Required<GQLMutationTypeResolver<void>> = {
   editComment: async (source, { input }, ctx) => ({
     comment: await ctx.mutators.Comments.edit(input),

src/core/server/graph/tenant/schema/schema.graphql

@@ -3979,9 +3979,15 @@ type SetPasswordPayload {
 
 input UpdatePasswordInput {
   """
-  password is the new password that should be associated with the User.
+  oldPassword is the old password that that should be compared against when
+  trying to change the password before the change.
   """
-  password: String!
+  oldPassword: String!
+
+  """
+  newPassword is the new password that should be associated with the User.
+  """
+  newPassword: String!
 
   """
   clientMutationId is required for Relay support.