22527658769

Committed 28 Feb 2026 07:41PM UTC coverage: 63.267% (-3.6%) from 66.864%

Build # 22527658769

Build Type

push

github

Committed by

web-flow

Commit Message

Merge pull request #36 from daycry/development

Implement TOTP 2FA, JWT auth, device session tracking, and docs overhaul

Coverage Stats

465 of 1168 new or added lines in 52 files covered. (39.81%)

129 existing lines in 46 files now uncovered.

3064 of 4843 relevant lines covered (63.27%)

41.53 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0

/src/Controllers/ForcePasswordResetController.php

<?php

declare(strict_types=1);

/**
 * This file is part of Daycry Auth.
 *
 * (c) Daycry <daycry9@proton.me>
 *
 * For the full copyright and license information, please view
 * the LICENSE file that was distributed with this source code.
 */

namespace Daycry\Auth\Controllers;

use CodeIgniter\HTTP\RedirectResponse;
use CodeIgniter\HTTP\ResponseInterface;
use Daycry\Auth\Authentication\Passwords;
use Daycry\Auth\Models\UserModel;

/**
 * Handles forced password resets for logged-in users
 * whose accounts have been flagged for a mandatory password change.
 *
 * The ForcePasswordResetFilter redirects users here when
 * $user->requiresPasswordReset() returns true.
 */
class ForcePasswordResetController extends BaseAuthController
{
    /**
     * Displays the force password reset form.
     */
    public function showView(): ResponseInterface
    {
        if (! auth()->loggedIn()) {
            return redirect()->route('login');
        }

        $content = $this->view(setting('Auth.views')['force-password-reset']);

        return $this->response->setBody($content);
    }

    /**
     * Handles the force password reset form submission.
     */
    public function resetAction(): RedirectResponse
    {
        if (! auth()->loggedIn()) {
            return redirect()->route('login');
        }

        $rules = $this->getValidationRules();

        $postData = $this->request->getPost();

        if (! $this->validateRequest($postData, $rules)) {
            return $this->handleValidationError(config('Auth')->forcePasswordResetRedirect());
        }

        $user            = auth()->user();
        $currentPassword = $this->request->getPost('current_password');
        $newPassword     = $this->request->getPost('new_password');

        // Verify the current password
        /** @var Passwords $passwords */
        $passwords = service('passwords');

        if (! $passwords->verify($currentPassword, $user->getPasswordHash())) {
            return $this->handleError(
                config('Auth')->forcePasswordResetRedirect(),
                lang('Auth.invalidCurrentPassword'),
            );
        }

        // Update the password
        $user->setPassword($newPassword);

        /** @var UserModel $userModel */
        $userModel = model(UserModel::class);
        $userModel->save($user);

        // Clear the force reset flag
        $user->undoForcePasswordReset();

        return $this->handleSuccess(
            config('Auth')->loginRedirect(),
            lang('Auth.forceResetSuccess'),
        );
    }

    /**
     * Returns the rules that should be used for validation.
     *
     * @return array<string, string>
     */
    protected function getValidationRules(): array
    {
        return [
            'current_password'     => 'required',
            'new_password'         => 'required|min_length[8]',
            'new_password_confirm' => 'required|matches[new_password]',
        ];
    }
}

1	<?php
2
3	declare(strict_types=1);
4
5	/**
6	* This file is part of Daycry Auth.
7	*
8	* (c) Daycry <daycry9@proton.me>
9	*
10	* For the full copyright and license information, please view
11	* the LICENSE file that was distributed with this source code.
12	*/
13
14	namespace Daycry\Auth\Controllers;
15
16	use CodeIgniter\HTTP\RedirectResponse;
17	use CodeIgniter\HTTP\ResponseInterface;
18	use Daycry\Auth\Authentication\Passwords;
19	use Daycry\Auth\Models\UserModel;
20
21	/**
22	* Handles forced password resets for logged-in users
23	* whose accounts have been flagged for a mandatory password change.
24	*
25	* The ForcePasswordResetFilter redirects users here when
26	* $user->requiresPasswordReset() returns true.
27	*/
28	class ForcePasswordResetController extends BaseAuthController
29	{
30	/**
31	* Displays the force password reset form.
32	*/
NEW 33	public function showView(): ResponseInterface	×
34	{
NEW 35	if (! auth()->loggedIn()) {	×
NEW 36	return redirect()->route('login');	×
37	}
38
NEW 39	$content = $this->view(setting('Auth.views')['force-password-reset']);	×
40
NEW 41	return $this->response->setBody($content);	×
42	}
43
44	/**
45	* Handles the force password reset form submission.
46	*/
NEW 47	public function resetAction(): RedirectResponse	×
48	{
NEW 49	if (! auth()->loggedIn()) {	×
NEW 50	return redirect()->route('login');	×
51	}
52
NEW 53	$rules = $this->getValidationRules();	×
54
NEW 55	$postData = $this->request->getPost();	×
56
NEW 57	if (! $this->validateRequest($postData, $rules)) {	×
NEW 58	return $this->handleValidationError(config('Auth')->forcePasswordResetRedirect());	×
59	}
60
NEW 61	$user = auth()->user();	×
NEW 62	$currentPassword = $this->request->getPost('current_password');	×
NEW 63	$newPassword = $this->request->getPost('new_password');	×
64
65	// Verify the current password
66	/** @var Passwords $passwords */
NEW 67	$passwords = service('passwords');	×
68
NEW 69	if (! $passwords->verify($currentPassword, $user->getPasswordHash())) {	×
NEW 70	return $this->handleError(	×
NEW 71	config('Auth')->forcePasswordResetRedirect(),	×
NEW 72	lang('Auth.invalidCurrentPassword'),	×
NEW 73	);	×
74	}
75
76	// Update the password
NEW 77	$user->setPassword($newPassword);	×
78
79	/** @var UserModel $userModel */
NEW 80	$userModel = model(UserModel::class);	×
NEW 81	$userModel->save($user);	×
82
83	// Clear the force reset flag
NEW 84	$user->undoForcePasswordReset();	×
85
NEW 86	return $this->handleSuccess(	×
NEW 87	config('Auth')->loginRedirect(),	×
NEW 88	lang('Auth.forceResetSuccess'),	×
NEW 89	);	×
90	}
91
92	/**
93	* Returns the rules that should be used for validation.
94	*
95	* @return array<string, string>
96	*/
NEW 97	protected function getValidationRules(): array	×
98	{
NEW 99	return [	×
NEW 100	'current_password' => 'required',	×
NEW 101	'new_password' => 'required\|min_length[8]',	×
NEW 102	'new_password_confirm' => 'required\|matches[new_password]',	×
NEW 103	];	×
104	}
105	}

daycry / auth / 22527658769

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous