@@ -261,7 +261,7 @@ describe('user.controller > auth management > updateSettings (email, username, p
261261 } ) ;
262262 expect ( saveUser ) . toHaveBeenCalledTimes ( 1 ) ;
263263 } ) ;
264- it ( 'does not send a confirmation email to the user' , ( ) => {
264+ it ( 'sends a confirmation email to the user' , ( ) => {
265265 expect ( mailerService . send ) . toHaveBeenCalledWith (
266266 expect . objectContaining ( {
267267 subject : 'Mock confirm your email'
@@ -293,7 +293,7 @@ describe('user.controller > auth management > updateSettings (email, username, p
293293 } ) ;
294294 expect ( saveUser ) . toHaveBeenCalledTimes ( 1 ) ;
295295 } ) ;
296- it ( 'does not send a confirmation email to the user' , ( ) => {
296+ it ( 'sends a confirmation email to the user' , ( ) => {
297297 expect ( mailerService . send ) . toHaveBeenCalledWith (
298298 expect . objectContaining ( {
299299 subject : 'Mock confirm your email'
@@ -304,6 +304,7 @@ describe('user.controller > auth management > updateSettings (email, username, p
304304 } ) ;
305305
306306 describe ( 'unhappy paths' , ( ) => {
307+ // Client-side checks to require username
307308 describe . skip ( 'when missing username' , ( ) => {
308309 beforeEach ( async ( ) => {
309310 request . setBody ( { email : OLD_EMAIL } ) ;
@@ -325,14 +326,15 @@ describe('user.controller > auth management > updateSettings (email, username, p
325326 } ) ;
326327 } ) ;
327328
329+ // Client-side checks to require email
328330 describe . skip ( 'when missing email' , ( ) => {
329331 beforeEach ( async ( ) => {
330332 request . setBody ( { username : OLD_USERNAME } ) ;
331333 await updateSettings ( request , response , next ) ;
332334 } ) ;
333335
334336 it ( 'returns 401 with an "Missing email" message' , ( ) => {
335- expect ( response . status ) . toHaveBeenCalledWith ( 400 ) ;
337+ expect ( response . status ) . toHaveBeenCalledWith ( 401 ) ;
336338 expect ( response . json ) . toHaveBeenCalledWith ( {
337339 error : 'Email is required.'
338340 } ) ;
@@ -346,6 +348,7 @@ describe('user.controller > auth management > updateSettings (email, username, p
346348 } ) ;
347349 } ) ;
348350
351+ // Client-side checks to require new password if current password is provided
349352 describe . skip ( 'when given old username, old email, and matching current password and no new password' , ( ) => {
350353 beforeEach ( async ( ) => {
351354 requestBody = {
@@ -357,7 +360,7 @@ describe('user.controller > auth management > updateSettings (email, username, p
357360 } ) ;
358361
359362 it ( 'returns 401 with an "New password is required" message' , ( ) => {
360- expect ( response . status ) . toHaveBeenCalledWith ( 400 ) ;
363+ expect ( response . status ) . toHaveBeenCalledWith ( 401 ) ;
361364 expect ( response . json ) . toHaveBeenCalledWith ( {
362365 error : 'New password is required.'
363366 } ) ;
@@ -371,6 +374,34 @@ describe('user.controller > auth management > updateSettings (email, username, p
371374 } ) ;
372375 } ) ;
373376
377+ describe ( 'when given old username, old email, and non-matching current password and no new password' , ( ) => {
378+ beforeEach ( async ( ) => {
379+ testUser . comparePassword = jest . fn ( ) . mockResolvedValue ( false ) ;
380+
381+ requestBody = {
382+ ...minimumValidRequest ,
383+ currentPassword : 'not the same password' ,
384+ newPassword : NEW_PASSWORD
385+ } ;
386+ request . setBody ( requestBody ) ;
387+ await updateSettings ( request , response , next ) ;
388+ } ) ;
389+
390+ it ( 'returns 401 with an "Current password is invalid" message' , ( ) => {
391+ expect ( response . status ) . toHaveBeenCalledWith ( 401 ) ;
392+ expect ( response . json ) . toHaveBeenCalledWith ( {
393+ error : 'Current password is invalid.'
394+ } ) ;
395+ } ) ;
396+
397+ it ( 'does not save the user with the new password' , ( ) => {
398+ expect ( saveUser ) . not . toHaveBeenCalled ( ) ;
399+ } ) ;
400+ it ( 'does not send a confirmation email to the user' , ( ) => {
401+ expect ( mailerService . send ) . not . toHaveBeenCalled ( ) ;
402+ } ) ;
403+ } ) ;
404+
374405 describe ( 'when given old username, old email, and non-matching current password and a new password' , ( ) => {
375406 beforeEach ( async ( ) => {
376407 testUser . comparePassword = jest . fn ( ) . mockResolvedValue ( false ) ;
0 commit comments