001// --------------------------------------------------------------------------------
002// Copyright 2002-2026 Echo Three, LLC
003//
004// Licensed under the Apache License, Version 2.0 (the "License");
005// you may not use this file except in compliance with the License.
006// You may obtain a copy of the License at
007//
008//     http://www.apache.org/licenses/LICENSE-2.0
009//
010// Unless required by applicable law or agreed to in writing, software
011// distributed under the License is distributed on an "AS IS" BASIS,
012// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
013// See the License for the specific language governing permissions and
014// limitations under the License.
015// --------------------------------------------------------------------------------
016
017package com.echothree.control.user.authentication.server.command;
018
019import com.echothree.control.user.authentication.common.form.SetPasswordForm;
020import com.echothree.model.control.customer.server.control.CustomerControl;
021import com.echothree.model.control.employee.server.control.EmployeeControl;
022import com.echothree.model.control.party.common.PartyTypes;
023import com.echothree.model.control.party.server.logic.PartyLogic;
024import com.echothree.model.control.party.server.logic.PasswordStringPolicyLogic;
025import com.echothree.model.control.user.common.UserConstants;
026import com.echothree.model.control.vendor.server.control.VendorControl;
027import com.echothree.model.data.party.server.entity.Party;
028import com.echothree.util.common.command.BaseResult;
029import com.echothree.util.common.message.ExecutionErrors;
030import com.echothree.util.common.validation.FieldDefinition;
031import com.echothree.util.common.validation.FieldType;
032import java.util.List;
033import javax.enterprise.context.Dependent;
034import javax.inject.Inject;
035
036@Dependent
037public class SetPasswordCommand
038        extends BaseLoginCommand<SetPasswordForm> {
039    
040    private final static List<FieldDefinition> FORM_FIELD_DEFINITIONS;
041    
042    static {
043        FORM_FIELD_DEFINITIONS = List.of(
044                new FieldDefinition("PartyName", FieldType.ENTITY_NAME, false, null, null),
045                new FieldDefinition("EmployeeName", FieldType.ENTITY_NAME, false, null, null),
046                new FieldDefinition("CustomerName", FieldType.ENTITY_NAME, false, null, null),
047                new FieldDefinition("VendorName", FieldType.ENTITY_NAME, false, null, null),
048                new FieldDefinition("OldPassword", FieldType.STRING, false, 1L, 40L),
049                new FieldDefinition("NewPassword1", FieldType.STRING, true, 1L, 40L),
050                new FieldDefinition("NewPassword2", FieldType.STRING, true, 1L, 40L)
051        );
052    }
053
054    @Inject
055    CustomerControl customerControl;
056
057    @Inject
058    EmployeeControl employeeControl;
059
060    @Inject
061    VendorControl vendorControl;
062
063    @Inject
064    PartyLogic partyLogic;
065
066    @Inject
067    PasswordStringPolicyLogic passwordStringPolicyLogic;
068
069    
070    /** Creates a new instance of SetPasswordCommand */
071    public SetPasswordCommand() {
072        super(null, FORM_FIELD_DEFINITIONS);
073    }
074    
075    @Override
076    protected BaseResult execute() {
077        var partyName = form.getPartyName();
078        var employeeName = form.getEmployeeName();
079        var customerName = form.getCustomerName();
080        var vendorName = form.getVendorName();
081        var parameterCount = (partyName == null ? 0 : 1) + (employeeName == null ? 0 : 1) + (customerName == null ? 0 : 1) + (vendorName == null ? 0 : 1);
082        
083        if(parameterCount < 2) {
084            var self = getParty();
085            Party party = null;
086            
087            if(partyName != null) {
088                party = partyControl.getPartyByName(partyName);
089                if(party == null) {
090                    addExecutionError(ExecutionErrors.UnknownPartyName.name(), partyName);
091                }
092            } else if(employeeName != null) {
093                var partyEmployee = employeeControl.getPartyEmployeeByName(employeeName);
094                
095                if(partyEmployee != null) {
096                    party = partyEmployee.getParty();
097                } else {
098                    addExecutionError(ExecutionErrors.UnknownEmployeeName.name(), employeeName);
099                }
100            } else if(customerName != null) {
101                var customer = customerControl.getCustomerByName(customerName);
102                
103                if(customer != null) {
104                    party = customer.getParty();
105                } else {
106                    addExecutionError(ExecutionErrors.UnknownCustomerName.name(), customerName);
107                }
108            } else if(vendorName != null) {
109                var vendor = vendorControl.getVendorByName(vendorName);
110                
111                if(vendor != null) {
112                    party = vendor.getParty();
113                } else {
114                    addExecutionError(ExecutionErrors.UnknownVendorName.name(), vendorName);
115                }
116            } else {
117                party = self;
118            }
119            
120            if(!hasExecutionErrors()) {
121                if(party != null) {
122                    partyLogic.checkPartyType(this, party, PartyTypes.EMPLOYEE.name(), PartyTypes.CUSTOMER.name(),
123                            PartyTypes.VENDOR.name());
124
125                    if(!hasExecutionErrors()) {
126                        var userLoginPasswordType = userControl.getUserLoginPasswordTypeByName(UserConstants.UserLoginPasswordType_STRING);
127                        var userLoginPassword = userControl.getUserLoginPassword(party, userLoginPasswordType);
128
129                        if(userLoginPassword != null) {
130                            var newPassword1 = form.getNewPassword1();
131                            var newPassword2 = form.getNewPassword2();
132
133                            if(newPassword1.equals(newPassword2)) {
134                                var userLoginStatus = userControl.getUserLoginStatusForUpdate(party);
135                                var oldPassword = form.getOldPassword();
136
137                                if(oldPassword != null) {
138                                    if(!checkPasswords(userLoginStatus, oldPassword, party, false)) {
139                                        addExecutionError(ExecutionErrors.IncorrectPassword.name());
140                                    }
141                                } else if(party.equals(self)) {
142                                    addExecutionError(ExecutionErrors.MissingOldPassword.name());
143                                }
144
145                                if(!hasExecutionErrors()) {
146                                    var userLoginPasswordStringValue = userControl.getUserLoginPasswordStringValueForUpdate(userLoginPassword);
147                                    var partyTypePasswordStringPolicy = passwordStringPolicyLogic.checkStringPassword(session,
148                                            getUserVisit(), this, party, userLoginPassword, userLoginPasswordStringValue, newPassword1);
149
150                                    if(!hasExecutionErrors()) {
151                                        var changingForSelf = self.equals(party);
152
153                                        userLoginPasswordStringValue.setPassword(newPassword1);
154                                        userLoginPasswordStringValue.setChangedTime(session.getStartTime());
155                                        userLoginPasswordStringValue.setWasReset(!changingForSelf);
156
157                                        userControl.updateUserLoginPasswordStringFromValue(userLoginPasswordStringValue, self.getPrimaryKey());
158
159                                        userLoginStatus.setExpiredCount(0);
160                                        userLoginStatus.setForceChange(changingForSelf ? false : partyTypePasswordStringPolicy == null? false
161                                                : partyTypePasswordStringPolicy.getLastDetail().getForceChangeAfterReset());
162                                    }
163                                }
164                            } else {
165                                addExecutionError(ExecutionErrors.MismatchedPasswords.name());
166                            }
167                        } else {
168                            addExecutionError(ExecutionErrors.UnknownUserLoginPassword.name());
169                        }
170                    }
171                } else {
172                    addExecutionError(ExecutionErrors.UnknownParty.name());
173                }
174            }
175        } else {
176            addExecutionError(ExecutionErrors.InvalidParameterCount.name());
177        }
178        
179        return null;
180    }
181    
182}