Lots of refinement

cmd/user.go

@@ -44,7 +44,7 @@ var flagsUser = append(
 var cmdUser = &cli.Command{
 	Name:      "user",
 	Usage:     "Manage/show users",
-	UsageText: "ntfy user [list|add|remove|change-pass|change-role] ...",
+	UsageText: "ntfy user [list|add|remove|change-pass|reset-pass|change-role] ...",
 	Flags:     flagsUser,
 	Before:    initConfigFileInputSourceFunc("config", flagsUser, initLogFunc),
 	Category:  categoryServer,
@@ -108,11 +108,11 @@ directly the bcrypt hash. This is useful if you are updating users via scripts.
 `,
 		},
 		{
-			Name:      "password-reset",
-			Aliases:   []string{"reset"},
+			Name:      "reset-pass",
+			Aliases:   []string{"rp"},
 			Usage:     "Generates a password reset link for a user",
-			UsageText: "ntfy user password-reset [--send-email] USERNAME",
-			Action:    execUserPasswordReset,
+			UsageText: "ntfy user reset-pass [--send-email] USERNAME",
+			Action:    execUserResetPass,
 			Flags: []cli.Flag{
 				&cli.BoolFlag{Name: "send-email", Aliases: []string{"e"}, Usage: "also email the reset link to the user's primary email"},
 			},
@@ -129,8 +129,8 @@ requires SMTP to be configured and the user to have a verified primary email).
 Requires base-url to be configured so an absolute link can be generated.
 
 Example:
-  ntfy user password-reset phil               # Print a reset link for user phil
-  ntfy user password-reset --send-email phil  # Print and email the reset link
+  ntfy user reset-pass phil               # Print a reset link for user phil
+  ntfy user reset-pass --send-email phil  # Print and email the reset link
 `,
 		},
 		{
@@ -319,12 +319,12 @@ func execUserChangePass(c *cli.Context) error {
 	return nil
 }
 
-func execUserPasswordReset(c *cli.Context) error {
+func execUserResetPass(c *cli.Context) error {
 	username := c.Args().Get(0)
 	sendEmail := c.Bool("send-email")
 	baseURL := strings.TrimSuffix(c.String("base-url"), "/")
 	if username == "" {
-		return errors.New("username expected, type 'ntfy user password-reset --help' for help")
+		return errors.New("username expected, type 'ntfy user reset-pass --help' for help")
 	} else if username == userEveryone || username == user.Everyone {
 		return errors.New("username not allowed")
 	} else if baseURL == "" {
@@ -339,6 +339,8 @@ func execUserPasswordReset(c *cli.Context) error {
 		return fmt.Errorf("user %s does not exist", username)
 	} else if err != nil {
 		return err
+	} else if u.Provisioned {
+		return fmt.Errorf("user %s is provisioned in the config file; its password cannot be reset", username)
 	}
 	// Resolve the primary email up front if we need to send -- fail before creating a token
 	var primaryEmail string

cmd/user_test.go

@@ -122,7 +122,7 @@ func TestCLI_User_Delete(t *testing.T) {
 	require.Contains(t, err.Error(), "user phil does not exist")
 }
 
-func TestCLI_User_PasswordReset(t *testing.T) {
+func TestCLI_User_ResetPass(t *testing.T) {
 	s, conf, port := newTestServerWithAuth(t)
 	defer test.StopServer(t, s, port)
 
@@ -132,11 +132,11 @@ func TestCLI_User_PasswordReset(t *testing.T) {
 
 	// Prints a working-looking reset link when base-url is set
 	app, _, stdout, _ = newTestApp()
-	require.Nil(t, runUserCommand(app, conf, "--base-url=https://ntfy.example.com", "password-reset", "phil"))
+	require.Nil(t, runUserCommand(app, conf, "--base-url=https://ntfy.example.com", "reset-pass", "phil"))
 	require.Contains(t, stdout.String(), "https://ntfy.example.com/account/password/reset/")
 }
 
-func TestCLI_User_PasswordReset_NoBaseURL(t *testing.T) {
+func TestCLI_User_ResetPass_NoBaseURL(t *testing.T) {
 	s, conf, port := newTestServerWithAuth(t)
 	defer test.StopServer(t, s, port)
 
@@ -145,12 +145,12 @@ func TestCLI_User_PasswordReset_NoBaseURL(t *testing.T) {
 	require.Nil(t, runUserCommand(app, conf, "add", "phil"))
 
 	app, _, _, _ = newTestApp()
-	err := runUserCommand(app, conf, "password-reset", "phil")
+	err := runUserCommand(app, conf, "reset-pass", "phil")
 	require.Error(t, err)
 	require.Contains(t, err.Error(), "base-url")
 }
 
-func TestCLI_User_PasswordReset_SendEmailNoPrimary(t *testing.T) {
+func TestCLI_User_ResetPass_SendEmailNoPrimary(t *testing.T) {
 	s, conf, port := newTestServerWithAuth(t)
 	defer test.StopServer(t, s, port)
 
@@ -160,11 +160,31 @@ func TestCLI_User_PasswordReset_SendEmailNoPrimary(t *testing.T) {
 
 	// --send-email requires a primary email; phil has none
 	app, _, _, _ = newTestApp()
-	err := runUserCommand(app, conf, "--base-url=https://ntfy.example.com", "password-reset", "--send-email", "phil")
+	err := runUserCommand(app, conf, "--base-url=https://ntfy.example.com", "reset-pass", "--send-email", "phil")
 	require.Error(t, err)
 	require.Contains(t, err.Error(), "no primary email")
 }
 
+func TestCLI_User_ResetPass_ProvisionedRejected(t *testing.T) {
+	s, conf, port := newTestServerWithAuth(t)
+	defer test.StopServer(t, s, port)
+
+	// Seed a provisioned user into the auth database via config provisioning
+	m, err := user.NewSQLiteManager(conf.AuthFile, "", &user.Config{
+		ProvisionEnabled: true,
+		Users: []*user.User{
+			{Name: "provuser", Hash: "$2a$10$YLiO8U21sX1uhZamTLJXHuxgVC0Z/GKISibrKCLohPgtG7yIxSk4C", Role: user.RoleUser},
+		},
+	})
+	require.Nil(t, err)
+	require.Nil(t, m.Close())
+
+	app, _, _, _ := newTestApp()
+	err = runUserCommand(app, conf, "--base-url=https://ntfy.example.com", "reset-pass", "provuser")
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "provisioned")
+}
+
 func newTestServerWithAuth(t *testing.T) (s *server.Server, conf *server.Config, port int) {
 	configFile := filepath.Join(t.TempDir(), "server-dummy.yml")
 	require.Nil(t, os.WriteFile(configFile, []byte(""), 0600)) // Dummy config file to avoid lookup of real server.yml