From 61e03eeedfc8e8426fd62ecfd0aa64253cafd19f Mon Sep 17 00:00:00 2001
From: Damodar Lohani <dlohani48@gmail.com>
Date: Fri, 16 Dec 2022 10:29:20 +0000
Subject: [PATCH] add new password to the history

---
 app/controllers/api/account.php | 7 ++++++-
 app/controllers/api/teams.php   | 1 +
 app/controllers/api/users.php   | 9 +++++++--
 3 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/app/controllers/api/account.php b/app/controllers/api/account.php
index 4afa5a2090..0b6423a6b1 100644
--- a/app/controllers/api/account.php
+++ b/app/controllers/api/account.php
@@ -109,6 +109,7 @@ App::post('/v1/account')
                 'email' => $email,
                 'emailVerification' => false,
                 'status' => true,
+                'passwordHistory' => [Auth::passwordHash($password, Auth::DEFAULT_ALGO, Auth::DEFAULT_ALGO_OPTIONS)],
                 'password' => Auth::passwordHash($password, Auth::DEFAULT_ALGO, Auth::DEFAULT_ALGO_OPTIONS),
                 'hash' => Auth::DEFAULT_ALGO,
                 'hashOptions' => Auth::DEFAULT_ALGO_OPTIONS,
@@ -501,6 +502,7 @@ App::get('/v1/account/sessions/oauth2/:provider/redirect')
                         'email' => $email,
                         'emailVerification' => true,
                         'status' => true, // Email should already be authenticated by OAuth2 provider
+                        'passwordHistory' => [Auth::passwordHash(Auth::passwordGenerator(), Auth::DEFAULT_ALGO, Auth::DEFAULT_ALGO_OPTIONS)],
                         'password' => Auth::passwordHash(Auth::passwordGenerator(), Auth::DEFAULT_ALGO, Auth::DEFAULT_ALGO_OPTIONS),
                         'hash' => Auth::DEFAULT_ALGO,
                         'hashOptions' => Auth::DEFAULT_ALGO_OPTIONS,
@@ -1523,8 +1525,11 @@ App::patch('/v1/account/password')
             throw new Exception(Exception::USER_PASSWORD_RECENTLY_USED, 'The password was recently used', 409);
         }
 
+        $history[] = $newPassword;
+
         $user = $dbForProject->updateDocument('users', $user->getId(), $user
-                ->setAttribute('password', Auth::passwordHash($password, Auth::DEFAULT_ALGO, Auth::DEFAULT_ALGO_OPTIONS))
+                ->setAttribute('passwordHistory', $history)
+                ->setAttribute('password', $newPassword)
                 ->setAttribute('hash', Auth::DEFAULT_ALGO)
                 ->setAttribute('hashOptions', Auth::DEFAULT_ALGO_OPTIONS)
                 ->setAttribute('passwordUpdate', DateTime::now()));
diff --git a/app/controllers/api/teams.php b/app/controllers/api/teams.php
index 567560c6a8..763bc22375 100644
--- a/app/controllers/api/teams.php
+++ b/app/controllers/api/teams.php
@@ -358,6 +358,7 @@ App::post('/v1/teams/:teamId/memberships')
                     'email' => $email,
                     'emailVerification' => false,
                     'status' => true,
+                    'passwordHistory' => [Auth::passwordHash(Auth::passwordGenerator(), Auth::DEFAULT_ALGO, Auth::DEFAULT_ALGO_OPTIONS)],
                     'password' => Auth::passwordHash(Auth::passwordGenerator(), Auth::DEFAULT_ALGO, Auth::DEFAULT_ALGO_OPTIONS),
                     'hash' => Auth::DEFAULT_ALGO,
                     'hashOptions' => Auth::DEFAULT_ALGO_OPTIONS,
diff --git a/app/controllers/api/users.php b/app/controllers/api/users.php
index bd3278a60c..32c7735dea 100644
--- a/app/controllers/api/users.php
+++ b/app/controllers/api/users.php
@@ -49,6 +49,7 @@ function createUser(string $hash, mixed $hashOptions, string $userId, ?string $e
             ? ID::unique()
             : ID::custom($userId);
 
+        $password = (!empty($password)) ? ($hash === 'plaintext' ? Auth::passwordHash($password, $hash, $hashOptionsObject) : $password) : null;
         $user = $dbForProject->createDocument('users', new Document([
             '$id' => $userId,
             '$permissions' => [
@@ -61,7 +62,8 @@ function createUser(string $hash, mixed $hashOptions, string $userId, ?string $e
             'phone' => $phone,
             'phoneVerification' => false,
             'status' => true,
-            'password' => (!empty($password)) ? ($hash === 'plaintext' ? Auth::passwordHash($password, $hash, $hashOptionsObject) : $password) : null,
+            'passwordHistory' => is_null($password) ? [] : [$password],
+            'password' => $password,
             'hash' => $hash === 'plaintext' ? Auth::DEFAULT_ALGO : $hash,
             'hashOptions' => $hash === 'plaintext' ? Auth::DEFAULT_ALGO_OPTIONS : $hashOptions,
             'passwordUpdate' => (!empty($password)) ? DateTime::now() : null,
@@ -798,8 +800,11 @@ App::patch('/v1/users/:userId/password')
             throw new Exception(Exception::USER_PASSWORD_RECENTLY_USED, 'The password was recently used', 409);
         }
 
+        $history[] = $newPassword;
+
         $user
-            ->setAttribute('password', Auth::passwordHash($password, Auth::DEFAULT_ALGO, Auth::DEFAULT_ALGO_OPTIONS))
+            ->setAttribute('passwordHistory', $history)
+            ->setAttribute('password', $newPassword)
             ->setAttribute('hash', Auth::DEFAULT_ALGO)
             ->setAttribute('hashOptions', Auth::DEFAULT_ALGO_OPTIONS)
             ->setAttribute('passwordUpdate', DateTime::now());