feat: add /api/account/update-email route

account/account.go

@@ -278,6 +278,32 @@ func (s AccountServiceDefault) UpdateAccountName(userId uint, firstName string,
 	return s.updateAccountInfo(userId, models.User{FirstName: firstName, LastName: lastName})
 }
 
+func (s AccountServiceDefault) UpdateAccountEmail(userId uint, email string, password string) error {
+	exists, _, err := s.EmailExists(email)
+	if err != nil {
+		return err
+	}
+
+	if exists {
+		return NewAccountError(ErrKeyEmailAlreadyExists, nil)
+	}
+
+	valid, _, err := s.ValidLoginByUserID(userId, password)
+	if err != nil {
+		return err
+	}
+
+	if !valid {
+		return NewAccountError(ErrKeyInvalidLogin, nil)
+	}
+
+	var update models.User
+
+	update.Email = email
+
+	return s.updateAccountInfo(userId, update)
+}
+
 func (s AccountServiceDefault) AddPubkeyToAccount(user models.User, pubkey string) error {
 	var model models.PublicKey
 

api/account/account.go

@@ -319,6 +319,21 @@ func (a AccountAPI) uploadLimit(c jape.Context) {
 	})
 }
 
+func (a AccountAPI) updateEmail(c jape.Context) {
+	user := middleware.GetUserFromContext(c.Request.Context())
+
+	var request UpdateEmailRequest
+
+	if c.Decode(&request) != nil {
+		return
+	}
+
+	err := a.accounts.UpdateAccountEmail(user, request.Email, request.Password)
+	if c.Check("failed to update email", err) != nil {
+		return
+	}
+}
+
 func (a *AccountAPI) Routes() (*httprouter.Router, error) {
 	loginAuthMw2fa := authMiddleware(middleware.AuthMiddlewareOptions{
 		Identity:     a.identity,
@@ -387,17 +402,22 @@ func (a *AccountAPI) Routes() (*httprouter.Router, error) {
 	})
 
 	routes := map[string]jape.Handler{
-		"POST /api/auth/ping":                   middleware.ApplyMiddlewares(a.ping, corsMw.Handler, pingAuthMw, middleware.ProxyMiddleware),
-		"POST /api/auth/login":                  middleware.ApplyMiddlewares(a.login, corsMw.Handler, loginAuthMw2fa, middleware.ProxyMiddleware),
-		"POST /api/auth/register":               middleware.ApplyMiddlewares(a.register, corsMw.Handler, middleware.ProxyMiddleware),
-		"POST /api/auth/verify-email":           middleware.ApplyMiddlewares(a.verifyEmail, corsMw.Handler, middleware.ProxyMiddleware),
-		"POST /api/auth/otp/verify":             middleware.ApplyMiddlewares(a.otpVerify, corsMw.Handler, authMw, middleware.ProxyMiddleware),
-		"POST /api/auth/otp/validate":           middleware.ApplyMiddlewares(a.otpValidate, corsMw.Handler, authMw, middleware.ProxyMiddleware),
-		"POST /api/auth/otp/disable":            middleware.ApplyMiddlewares(a.otpDisable, corsMw.Handler, authMw, middleware.ProxyMiddleware),
-		"POST /api/auth/password-reset/request": middleware.ApplyMiddlewares(a.passwordResetRequest, corsMw.Handler, middleware.ProxyMiddleware),
-		"POST /api/auth/password-reset/confirm": middleware.ApplyMiddlewares(a.passwordResetConfirm, corsMw.Handler, middleware.ProxyMiddleware),
-		"POST /api/auth/logout":                 middleware.ApplyMiddlewares(a.logout, corsMw.Handler, authMw, middleware.ProxyMiddleware),
-		"GET /*path":                            middleware.ApplyMiddlewares(getHandler, corsMw.Handler),
+		// Auth
+		"POST /api/auth/ping":         middleware.ApplyMiddlewares(a.ping, corsMw.Handler, pingAuthMw, middleware.ProxyMiddleware),
+		"POST /api/auth/login":        middleware.ApplyMiddlewares(a.login, corsMw.Handler, loginAuthMw2fa, middleware.ProxyMiddleware),
+		"POST /api/auth/register":     middleware.ApplyMiddlewares(a.register, corsMw.Handler, middleware.ProxyMiddleware),
+		"POST /api/auth/otp/validate": middleware.ApplyMiddlewares(a.otpValidate, corsMw.Handler, authMw, middleware.ProxyMiddleware),
+		"POST /api/auth/logout":       middleware.ApplyMiddlewares(a.logout, corsMw.Handler, authMw, middleware.ProxyMiddleware),
+
+		// Account
+		"POST /api/account/verify-email":           middleware.ApplyMiddlewares(a.verifyEmail, corsMw.Handler, middleware.ProxyMiddleware),
+		"POST /api/account/otp/verify":             middleware.ApplyMiddlewares(a.otpVerify, corsMw.Handler, authMw, middleware.ProxyMiddleware),
+		"POST /api/account/otp/disable":            middleware.ApplyMiddlewares(a.otpDisable, corsMw.Handler, authMw, middleware.ProxyMiddleware),
+		"POST /api/account/password-reset/request": middleware.ApplyMiddlewares(a.passwordResetRequest, corsMw.Handler, middleware.ProxyMiddleware),
+		"POST /api/account/password-reset/confirm": middleware.ApplyMiddlewares(a.passwordResetConfirm, corsMw.Handler, middleware.ProxyMiddleware),
+		"POST /api/account/update-email":           middleware.ApplyMiddlewares(a.updateEmail, corsMw.Handler, middleware.ProxyMiddleware),
+
+		"GET /*path": middleware.ApplyMiddlewares(getHandler, corsMw.Handler),
 	}
 
 	return jape.Mux(routes), nil

api/account/messages.go

@@ -58,3 +58,7 @@ type AccountInfoResponse struct {
 type UploadLimitResponse struct {
 	Limit uint64 `json:"limit"`
 }
+type UpdateEmailRequest struct {
+	Email    string `json:"email"`
+	Password string `json:"password"`
+}

api/account/swagger.yaml

@@ -42,7 +42,7 @@ paths:
                     description: Successfully registered
                 '400':
                     description: Bad Request
-    /api/auth/verify-email:
+    /api/account/verify-email:
         post:
             summary: Verify email address
             requestBody:
@@ -64,7 +64,7 @@ paths:
                         application/json:
                             schema:
                                 $ref: '#/components/schemas/OTPGenerateResponse'
-    /api/auth/otp/verify:
+    /api/account/otp/verify:
         post:
             summary: Verify OTP for enabling two-factor authentication
             requestBody:
@@ -76,7 +76,7 @@ paths:
             responses:
                 '200':
                     description: OTP verified successfully
-    /api/auth/otp/validate:
+    /api/account/otp/validate:
         post:
             summary: Validate OTP for two-factor authentication login
             requestBody:
@@ -100,7 +100,7 @@ paths:
             responses:
                 '200':
                     description: OTP disabled successfully
-    /api/auth/password-reset/request:
+    /api/password-rese/password-reset/request:
         post:
             summary: Request a password reset
             requestBody:
@@ -112,7 +112,7 @@ paths:
             responses:
                 '200':
                     description: Password reset requested successfully
-    /api/auth/password-reset/confirm:
+    /api/password-rese/password-reset/confirm:
         post:
             summary: Confirm a password reset
             requestBody:
@@ -148,6 +148,18 @@ paths:
                                 $ref: '#/components/schemas/AccountInfoResponse'
                 '401':
                     description: Unauthorized
+    /api/account/update-email:
+        post:
+            summary: Update email address
+            requestBody:
+                required: true
+                content:
+                    application/json:
+                        schema:
+                            $ref: '#/components/schemas/UpdateEmailRequest'
+            responses:
+                '200':
+                    description: Email updated successfully
     /api/upload-limit:
         get:
             summary: Get the basic file upload (POST) upload limit set by the portal
@@ -248,6 +260,16 @@ components:
                     type: string
                 password:
                     type: string
+        UpdateEmailRequest:
+            type: object
+            required:
+                - email
+                - password
+            properties:
+                email:
+                    type: string
+                password:
+                    type: string
         PingResponse:
             type: object
             properties: