Ghost/test
Naz c84866dda7
Improved password reset and session invalidation for "locked" users (#11790)
- Fixed session invalidation for "locked" user
  - Currently Ghost API was returning 404 for users having status set to "locked". This lead the user to be stuck in Ghost-Admin with "Rousource Not Found" error message.
  - By returning 401 for non-"active" users it allows for the Ghost-Admin to redirect the user to "signin" screen where they would be instructed to reset their password

- Fixed error message returned by session API
  - Instead of returning generic 'access' denied message when error happens during `User.check` we want to return more specific error thrown inside of the method, e.g.: 'accountLocked' or 'accountSuspended'
  - Fixed messaging for 'accountLocked' i18n, which not corresponds to the
actual UI available to the end user

- Added automatic password reset email to locked users on sign-in
  - uses alternative email for required password reset so it's clear that this is a security related reset and not a user-requested reset

- Backported the auto sending of required password reset email to v2 sign-in route
  - used by 3rd party clients where the email is necessary for users to know why login is failing

Co-authored-by: Kevin Ansfield <kevin@lookingsideways.co.uk>
2020-05-05 19:37:53 +01:00
..
api-acceptance Added new endpoint for refreshing api key secret (#11791) 2020-05-05 23:36:21 +05:30
frontend-acceptance Added new members/api/site endpoint 2020-04-30 19:50:40 +01:00
regression Fixed error in redirect regression test 2020-04-30 09:01:49 +01:00
unit Improved password reset and session invalidation for "locked" users (#11790) 2020-05-05 19:37:53 +01:00
utils Added Router etc to shared/express + use everywhere 2020-05-01 19:32:57 +01:00
.eslintignore Move tests from core to root (#11700) 2020-03-30 16:26:47 +01:00
.eslintrc.json Fixed linting error 2020-04-17 11:32:29 +01:00
.jshintrc Move tests from core to root (#11700) 2020-03-30 16:26:47 +01:00