Skip to content
GitLab

fix(passcode): report incorrect current passcode error message

Merged Hung Hoang requested to merge hunghoang/fix/change-passcode-incorrect-message into develop

Summary

Fixes the misleading error message when changing a passcode: entering an incorrect current passcode previously displayed "Current passcode is required to change it." instead of indicating that the current passcode was incorrect.

Root Cause

In be/src/modules/users/services/passcode.service.ts (setPasscode), both missing currentPasscode and failed bcrypt.compare were collapsed into a single condition:

const matchesCurrent = !!currentPasscode && (await bcrypt.compare(currentPasscode, user.passcodeHash));
if (!matchesCurrent) {
    await this.registerFailure(key);
    throw new UnauthorizedException('Current passcode is required to change it.');
}

When a user entered their current passcode but guessed wrongly, matchesCurrent was false, causing the backend to throw 'Current passcode is required to change it.'. The mobile frontend then surfaced this misleading error in the red error banner.

Changes

  1. Backend (be/src/modules/users/services/passcode.service.ts):

    • Differentiated missing vs. incorrect current passcode:
      • If !currentPasscode: throw 401 PASSCODE_REQUIRED with message "Current passcode is required to change it.".
      • If !(await bcrypt.compare(currentPasscode, user.passcodeHash)): register failure against the lockout key and throw 401 PASSCODE_INCORRECT with message "Current passcode is incorrect.".

  2. Unit Tests:

    • be/src/modules/users/services/passcode.service.spec.ts: Updated tests to assert the distinct error codes (PASSCODE_REQUIRED vs. PASSCODE_INCORRECT) and message ("Current passcode is incorrect.").
    • fe/src/components/passcode-form.test.tsx: Added test verifying the error banner correctly displays "Current passcode is incorrect." when rejected with that message.

Verification

  • Backend unit tests: pnpm --prefix be test src/modules/users/services/passcode.service.spec.ts -> 30/30 passed.
  • Frontend unit tests: pnpm --prefix fe test src/components/passcode-form.test.tsx -> 23/23 passed.
  • Frontend type-check & lint: pnpm --prefix fe type-check (0 errors), npx eslint src/components/passcode-form.test.tsx (0 errors).
  • Backend build: pnpm --prefix be build -> succeeded.
  • Conventional commitlint: passed.