added ability to change password

src/controllers/user.js

@@ -15,7 +15,7 @@ class UserController {
 
         if (password != passwordConfirm) return res.status(400).send("Passwords do not match");
 
-        let hashedPassword = await bcrypt.hash(password, 8);
+        const hashedPassword = await bcrypt.hash(password, 8);
 
         await UserService.register(username, hashedPassword);
 
@@ -39,6 +39,24 @@ class UserController {
         return res.redirect("/index");
     }
 
+    async changePassword(req, res) {
+        const token = req.session.jwt;
+        const username = jwt.decode(token).username;
+        const { oldPassword, newPassword } = req.body;
+
+        const storedPassword = await UserService.getPassword(username);
+
+        if (!bcrypt.compareSync(oldPassword, storedPassword)) {
+            return res.status(403).send("Password is not correct");
+        }
+
+        const newHashedPassword = await bcrypt.hash(newPassword, 8);
+
+        await UserService.changePassword(username, newHashedPassword);
+
+        return res.status(200).send("Successful");
+    }
+
     async logout(req, res) {
         req.session.destroy();
         return res.redirect("/login");

src/routers/api.js

@@ -12,7 +12,9 @@ const ApiRouter = new Router();
 ApiRouter.post('/register', requiredParameters.requireUsername, requiredParameters.requirePassword, auth.validateInviteToken, existance.userDoesNotExist, UserController.register);
 ApiRouter.post('/login', requiredParameters.requireUsername, requiredParameters.requirePassword, existance.userExist, UserController.login);
 ApiRouter.get('/logout', auth.authenticate, UserController.logout);
+ApiRouter.post('/changepassword', auth.authenticate, existance.userExist, UserController.changePassword);
 ApiRouter.post('/uploadSkin', existance.userExist, auth.authenticate, utils.upload.single('file'), requiredParameters.requireFile, UserController.uploadSkin);
 ApiRouter.post('/uploadCape', existance.userExist, auth.authenticate, auth.canHaveCloak, utils.upload.single('file'), requiredParameters.requireFile, UserController.uploadCape);
 ApiRouter.get('/getUsername', existance.userExist, auth.authenticate, UserController.getUsername);
+
 export default ApiRouter;

src/services/user.js

@@ -16,6 +16,10 @@ class UserService {
     async canHaveCloak(username) {
         return (await db.query("SELECT can_have_cloak FROM users WHERE username = $1", [username])).rows[0].can_have_cloak;
     }
+
+    async changePassword(username, newPassword) {
+        await db.query("UPDATE users SET password = $1 WHERE username = $2", [newPassword, username]);
+    }
 };
 
 export default new UserService();