Skip to content

[PM-29955] User reset password key can be empty string during key rotation #6871

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mzieniukbw merged 2 commits into from
Jan 27, 2026
Merged

[PM-29955] User reset password key can be empty string during key rotation #6871

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8fb834c
user reset password key can be empty string
mzieniukbw Jan 19, 2026
dc739ae
Merge branch 'main' into km/pm-29955-unable-to-trust-prompt-when-rota…
mzieniukbw Jan 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions src/Api/KeyManagement/Validators/OrganizationUserRotationValidator.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,8 +34,7 @@ public async Task<IReadOnlyList<OrganizationUser>> ValidateAsync(User user,
}

// Exclude any account recovery that do not have a key.
existing = existing.Where(o => o.ResetPasswordKey != null).ToList();
Comment thread
mzieniukbw marked this conversation as resolved.

existing = existing.Where(o => !string.IsNullOrEmpty(o.ResetPasswordKey)).ToList();

foreach (var ou in existing)
{
Expand Down
38 changes: 38 additions & 0 deletions test/Api.Test/KeyManagement/Validators/OrganizationUserRotationValidatorTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,44 @@ public async Task ValidateAsync_NoOrgUsers_ReturnsEmptyList(
Assert.Empty(result);
}

[Theory]
[BitAutoData([null])]
[BitAutoData("")]
public async Task ValidateAsync_OrgUsersWithNullOrEmptyResetPasswordKey_FiltersOutInvalidKeys(
string? invalidResetPasswordKey,
SutProvider<OrganizationUserRotationValidator> sutProvider, User user,
ResetPasswordWithOrgIdRequestModel validResetPasswordKey)
{
// Arrange
var existingUserResetPassword = new List<OrganizationUser>
{
// Valid org user with reset password key
new OrganizationUser
{
Id = Guid.NewGuid(),
OrganizationId = validResetPasswordKey.OrganizationId,
ResetPasswordKey = validResetPasswordKey.ResetPasswordKey
},
// Invalid org user with null or empty reset password key - should be filtered out
new OrganizationUser
{
Id = Guid.NewGuid(),
OrganizationId = Guid.NewGuid(),
ResetPasswordKey = invalidResetPasswordKey
}
};
sutProvider.GetDependency<IOrganizationUserRepository>().GetManyByUserAsync(user.Id)
.Returns(existingUserResetPassword);

// Act
var result = await sutProvider.Sut.ValidateAsync(user, new[] { validResetPasswordKey });

// Assert
Assert.NotNull(result);
Assert.Single(result);
Assert.Equal(validResetPasswordKey.OrganizationId, result[0].OrganizationId);
}

[Theory]
[BitAutoData]
public async Task ValidateAsync_MissingResetPassword_Throws(
Expand Down
Loading