From 353b594103e010bd6eba4e18b9c343ac4f0cf284 Mon Sep 17 00:00:00 2001 From: andrej romanov <50377758+auumgn@users.noreply.github.com> Date: Mon, 5 Oct 2026 15:44:50 +0300 Subject: [PATCH 1/3] PD-6002 remove old pw reset link logic --- .../controllers/PasswordResetController.java | 51 ++----------------- .../PasswordResetControllerTest.java | 46 ++--------------- 2 files changed, 7 insertions(+), 90 deletions(-) diff --git a/orcid-web/src/main/java/org/orcid/frontend/web/controllers/PasswordResetController.java b/orcid-web/src/main/java/org/orcid/frontend/web/controllers/PasswordResetController.java index cdba57ca6a..f068f9389c 100644 --- a/orcid-web/src/main/java/org/orcid/frontend/web/controllers/PasswordResetController.java +++ b/orcid-web/src/main/java/org/orcid/frontend/web/controllers/PasswordResetController.java @@ -260,36 +260,8 @@ public ModelAndView resetPasswordEmail(HttpServletRequest request, @PathVariable oneTimeResetPasswordForm.getErrors().add("expiredPasswordResetToken"); return oneTimeResetPasswordForm; } else { - // Old logic support - // TODO: remove once PD-6002 is stable on prod - PasswordResetToken passwordResetToken; - try { - passwordResetToken = buildResetTokenFromEncryptedLink(oneTimeResetPasswordForm.getToken()); - } catch (EncryptionOperationNotPossibleException e) { - oneTimeResetPasswordForm.getErrors().add("invalidPasswordResetToken"); - return oneTimeResetPasswordForm; - } - - if (isTokenExpired(passwordResetToken)) { - String message = "expiredPasswordResetToken"; - oneTimeResetPasswordForm.getErrors().add(message); - return oneTimeResetPasswordForm; - } - - //check first if valid orcid as the admin portal can send either and email or an orcid - if(OrcidStringUtils.isValidOrcid(passwordResetToken.getEmail()) ){ - if(profileEntityManager.orcidExists(passwordResetToken.getEmail())) { - orcid = passwordResetToken.getEmail(); - } - else { - String message = "invalidPasswordResetToken"; - oneTimeResetPasswordForm.getErrors().add(message); - return oneTimeResetPasswordForm; - } - } - else { - orcid = emailManagerReadOnly.findOrcidIdByEmail(passwordResetToken.getEmail()); - } + oneTimeResetPasswordForm.getErrors().add("invalidPasswordResetToken"); + return oneTimeResetPasswordForm; } passwordConfirmValidate(oneTimeResetPasswordForm.getRetypedPassword(), oneTimeResetPasswordForm.getNewPassword()); @@ -364,25 +336,8 @@ else if (oneTimeResetPasswordForm.getTwoFactorCode() != null && !oneTimeResetPas } else if (verificationResult.getStatus() == ExpiringLinkService.VerificationStatus.EXPIRED) { oneTimeResetPasswordForm.getErrors().add("expiredPasswordResetToken"); return oneTimeResetPasswordForm; - } - - // Old logic support - // TODO: remove once PD-6002 is stable on prod - PasswordResetToken passwordResetToken; - - try { - passwordResetToken = buildResetTokenFromEncryptedLink(oneTimeResetPasswordForm.getToken()); - - } catch (EncryptionOperationNotPossibleException e) { - oneTimeResetPasswordForm.getErrors().add("invalidPasswordResetToken"); - return oneTimeResetPasswordForm; - } - - if (isTokenExpired(passwordResetToken)) { - String message = "expiredPasswordResetToken"; - oneTimeResetPasswordForm.getErrors().add(message); - return oneTimeResetPasswordForm; } else { + oneTimeResetPasswordForm.getErrors().add("invalidPasswordResetToken"); return oneTimeResetPasswordForm; } diff --git a/orcid-web/src/test/java/org/orcid/frontend/web/controllers/PasswordResetControllerTest.java b/orcid-web/src/test/java/org/orcid/frontend/web/controllers/PasswordResetControllerTest.java index 1bf1a0dbfc..b1d9d83bb9 100644 --- a/orcid-web/src/test/java/org/orcid/frontend/web/controllers/PasswordResetControllerTest.java +++ b/orcid-web/src/test/java/org/orcid/frontend/web/controllers/PasswordResetControllerTest.java @@ -412,30 +412,8 @@ public void submitPasswordEmailValidatePasswordExpiredJwtDoesNotQueryRedis() { } @Test - public void submitPasswordEmailValidatePasswordLegacyValidTokenPasses() { - when(encryptionManager.decryptForExternalUse(anyString())).thenReturn("email=any@orcid.org&issueDate=2070-05-29T17:04:27"); - OneTimeResetPasswordForm form = new OneTimeResetPasswordForm(); - form.setToken("legacy"); - - OneTimeResetPasswordForm result = controller.submitPasswordEmailValidatePassword(newRequest(), new MockHttpServletResponse(), form); - - assertTrue(result.getErrors().isEmpty()); - } - - @Test - public void submitPasswordEmailValidatePasswordLegacyExpiredTokenReturnsExpiredError() { - when(encryptionManager.decryptForExternalUse(anyString())).thenReturn("email=any@orcid.org&issueDate=1970-05-29T17:04:27"); - OneTimeResetPasswordForm form = new OneTimeResetPasswordForm(); - form.setToken("legacy"); - - OneTimeResetPasswordForm result = controller.submitPasswordEmailValidatePassword(newRequest(), new MockHttpServletResponse(), form); - - assertEquals("expiredPasswordResetToken", result.getErrors().get(0)); - } - - @Test - public void submitPasswordEmailValidatePasswordLegacyInvalidTokenReturnsInvalidError() { - when(encryptionManager.decryptForExternalUse(anyString())).thenThrow(new EncryptionOperationNotPossibleException()); + public void submitPasswordEmailValidatePasswordLegacyTokenReturnsInvalidError() { + when(expiringLinkService.verifyToken("legacy")).thenReturn(ExpiringLinkService.VerificationResult.invalid()); OneTimeResetPasswordForm form = new OneTimeResetPasswordForm(); form.setToken("legacy"); @@ -604,9 +582,8 @@ public void submitPasswordResetV2WeakPasswordStopsBeforeUpdate() { } @Test - public void submitPasswordResetV2LegacyTokenWithInvalidOrcidFails() { - when(encryptionManager.decryptForExternalUse(anyString())).thenReturn("email=0000-0000-0000-9999&issueDate=2070-05-29T17:04:27"); - when(profileEntityManager.orcidExists("0000-0000-0000-9999")).thenReturn(false); + public void submitPasswordResetV2LegacyTokenReturnsInvalidError() { + when(expiringLinkService.verifyToken("legacy")).thenReturn(ExpiringLinkService.VerificationResult.invalid()); OneTimeResetPasswordForm form = strongForm("legacy"); OneTimeResetPasswordForm result = controller.submitPasswordResetV2(newRequest(), new MockHttpServletResponse(), form); @@ -614,21 +591,6 @@ public void submitPasswordResetV2LegacyTokenWithInvalidOrcidFails() { assertEquals("invalidPasswordResetToken", result.getErrors().get(0)); } - @Test - public void submitPasswordResetV2LegacyTokenWithValidOrcidSucceeds() { - String legacyOrcid = "0000-0000-0000-1234"; - when(encryptionManager.decryptForExternalUse(anyString())).thenReturn("email=" + legacyOrcid + "&issueDate=2070-05-29T17:04:27"); - when(profileEntityManager.orcidExists(legacyOrcid)).thenReturn(true); - when(emailManager.getEmails(legacyOrcid)).thenReturn(new Emails()); - when(twoFactorAuthenticationManager.userUsing2FA(legacyOrcid)).thenReturn(false); - OneTimeResetPasswordForm form = strongForm("legacy"); - - OneTimeResetPasswordForm result = controller.submitPasswordResetV2(newRequest(), new MockHttpServletResponse(), form); - - assertTrue(result.getErrors().isEmpty()); - verify(redisClient, never()).set(anyString(), anyString(), anyInt()); - } - @Test public void sendReactivationInvalidEmailReturnsValidationError() throws Exception { ResponseEntity response = controller.sendReactivation("bad-email", null); From f74bc8e0c8b9de9b5b0219b880a0f265470958d2 Mon Sep 17 00:00:00 2001 From: andrej romanov <50377758+auumgn@users.noreply.github.com> Date: Mon, 5 Oct 2026 16:15:12 +0300 Subject: [PATCH 2/3] fix test --- .../frontend/web/controllers/PasswordResetControllerTest.java | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/orcid-web/src/test/java/org/orcid/frontend/web/controllers/PasswordResetControllerTest.java b/orcid-web/src/test/java/org/orcid/frontend/web/controllers/PasswordResetControllerTest.java index b1d9d83bb9..f73ced5cb4 100644 --- a/orcid-web/src/test/java/org/orcid/frontend/web/controllers/PasswordResetControllerTest.java +++ b/orcid-web/src/test/java/org/orcid/frontend/web/controllers/PasswordResetControllerTest.java @@ -11,6 +11,8 @@ import static org.mockito.ArgumentMatchers.eq; import static org.mockito.Mockito.*; +import org.mockito.Mockito; + import java.lang.reflect.Field; import java.util.ArrayList; import java.util.Arrays; @@ -125,7 +127,7 @@ public void setUp() { when(orcidUrlManager.getBaseUrl()).thenReturn(BASE_URL); when(orcidUrlManager.determineFullTargetUrlFromSavedRequest(any(), any())).thenReturn(null); - when(expiringLinkService.verifyToken(anyString())).thenReturn(ExpiringLinkService.VerificationResult.invalid()); + lenient().when(expiringLinkService.verifyToken(anyString())).thenReturn(ExpiringLinkService.VerificationResult.invalid()); } @Test From c40a2c50953cb53ede260118f00a074957b166bc Mon Sep 17 00:00:00 2001 From: andrej romanov <50377758+auumgn@users.noreply.github.com> Date: Thu, 8 Oct 2026 20:53:59 +0300 Subject: [PATCH 3/3] update test --- .../frontend/web/controllers/PasswordResetControllerTest.java | 1 + 1 file changed, 1 insertion(+) diff --git a/orcid-web/src/test/java/org/orcid/frontend/web/controllers/PasswordResetControllerTest.java b/orcid-web/src/test/java/org/orcid/frontend/web/controllers/PasswordResetControllerTest.java index 70ee53266b..b3d5d0b25d 100644 --- a/orcid-web/src/test/java/org/orcid/frontend/web/controllers/PasswordResetControllerTest.java +++ b/orcid-web/src/test/java/org/orcid/frontend/web/controllers/PasswordResetControllerTest.java @@ -750,6 +750,7 @@ public void issuePasswordResetRequestWithAFlaggedOrcidIdAndNoPrimaryAddressSends verifyNoInteractions(recordEmailSender); } + @Test public void submitPasswordResetV2LegacyTokenReturnsInvalidError() { when(expiringLinkService.verifyToken("legacy")).thenReturn(ExpiringLinkService.VerificationResult.invalid()); OneTimeResetPasswordForm form = strongForm("legacy");