reset/update password

src/http.rs

@@ -92,6 +92,7 @@ pub fn build_router(state: AppState) -> Router {
             "/account/passkeys/{passkey_id}/delete",
             post(delete_passkey),
         )
+        .route("/account/password", post(change_password))
         .route("/lists", get(lists_page).post(create_list))
         .route("/lists/{list_id}", get(list_page))
         .route("/lists/{list_id}/items", post(add_item))
@@ -274,6 +275,13 @@ struct DeletePasskeyForm {
     csrf: String,
 }
 
+#[derive(Debug, Deserialize)]
+struct ChangePasswordForm {
+    csrf: String,
+    new_password: String,
+    confirm_password: String,
+}
+
 #[derive(Debug, Deserialize)]
 struct MealForm {
     name: String,
@@ -448,9 +456,39 @@ async fn account_page(
         &user.session.user,
         &passkeys,
         &user.session.csrf_token,
+        None,
+        false,
     )))
 }
 
+async fn change_password(
+    State(state): State<AppState>,
+    user: CurrentUser,
+    LoggedForm(form): LoggedForm<ChangePasswordForm>,
+) -> Result<Response, AppError> {
+    verify_csrf(&user, &form.csrf)?;
+    let passkeys = state.webauthn.list_passkeys(user.session.user.id).await?;
+    let render = |error: Option<&str>, success: bool| {
+        html_response(views::account_page(
+            &user.session.user,
+            &passkeys,
+            &user.session.csrf_token,
+            error,
+            success,
+        ))
+    };
+
+    if form.new_password != form.confirm_password {
+        return Ok(render(Some("New password and confirmation do not match."), false));
+    }
+
+    state
+        .auth
+        .change_password(user.session.user.id, form.new_password)
+        .await?;
+    Ok(render(None, true))
+}
+
 async fn passkey_register_start(
     State(state): State<AppState>,
     user: CurrentUser,