MX-237: Create Password Reset Endpot for Self Service Plugin

[IOhacker]

MX-237: Create Password Reset Endpot for Self Service Plugin

Summary by CodeRabbit

• New Features
  • Added self-service password reset functionality allowing users to request password resets by providing their username and selecting an authentication method (email or SMS)
  • Authorization tokens are automatically generated and delivered to users via their chosen communication channel

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: c0231150-755d-4410-858f-034fa87d241b

📥 Commits

Reviewing files that changed from the base of the PR and between 191427b and 7fba886.

📒 Files selected for processing (7)

• src/main/java/org/apache/fineract/selfservice/config/SelfServiceWarning.java
• src/main/java/org/apache/fineract/selfservice/registration/SelfServiceApiConstants.java
• src/main/java/org/apache/fineract/selfservice/registration/service/SelfServiceForgotPassworWritePlatformService.java
• src/main/java/org/apache/fineract/selfservice/registration/service/SelfServiceForgotPasswordWritePlatformServiceImpl.java
• src/main/java/org/apache/fineract/selfservice/registration/starter/SelfRegistrationConfiguration.java
• src/main/java/org/apache/fineract/selfservice/security/api/SelfForgotPasswordApiResource.java
• src/main/java/org/apache/fineract/selfservice/security/starter/SelfServiceSecurityConfiguration.java

---

📝 Walkthrough

Walkthrough

This pull request introduces a forgot password functionality to the self-service plugin. It adds API endpoints for password reset requests and renewal, includes service layer implementation with username validation and authorization token generation, routes tokens via email or SMS, and configures security rules to permit unauthenticated access to these endpoints.

Changes

Cohort / File(s)	Summary
Warning Configuration src/main/java/org/apache/fineract/selfservice/config/SelfServiceWarning.java	Updated banner message text from "Self service capabilities of Apache Fineract" to "Self Service Plugin capabilities for Apache Fineract" with minor line spacing adjustments.
API Constants src/main/java/org/apache/fineract/selfservice/registration/SelfServiceApiConstants.java	Added new success message constant createForgotPasswordRequestSuccessMessage and new parameter set FORGOT_PASSWORD_REQUEST_DATA_PARAMETERS containing username and authentication mode parameters.
Service Interface & Implementation src/main/java/org/apache/fineract/selfservice/registration/service/SelfServiceForgotPassworWritePlatformService.java, src/main/java/org/apache/fineract/selfservice/registration/service/SelfServiceForgotPasswordWritePlatformServiceImpl.java	Introduced interface contract and implementation class for forgot password request handling, including username validation, authorization token generation (4-digit numeric), and dispatch via email or SMS based on authentication mode. Implementation persists SelfServiceRegistration records and selects SMS provider dynamically.
Spring Configuration src/main/java/org/apache/fineract/selfservice/registration/starter/SelfRegistrationConfiguration.java	Added Spring bean factory method for SelfServiceForgotPassworWritePlatformService with full dependency injection of repositories, services, and external delivery providers.
API Endpoints src/main/java/org/apache/fineract/selfservice/security/api/SelfForgotPasswordApiResource.java	Exposed new JAX-RS REST resource at /v1/self/password with two POST endpoints: /request for initiating password reset and /renew for completing renewal via SelfUserApiResource.
Security Configuration src/main/java/org/apache/fineract/selfservice/security/starter/SelfServiceSecurityConfiguration.java	Added authorization matchers permitting unauthenticated POST access to /api/v1/self/password/request, /api/v1/self/password/renew, and their /v1/self/password variants.

Sequence Diagram(s)

sequenceDiagram
    participant Client
    participant SelfForgotPasswordApiResource
    participant SelfServiceForgotPasswordWritePlatformServiceImpl
    participant Repository as SelfServiceRegistrationRepository
    participant EmailService as GmailBackedPlatformEmailService
    participant SmsService as SmsMessageScheduledJobService
    
    Client->>SelfForgotPasswordApiResource: POST /v1/self/password/request
    SelfForgotPasswordApiResource->>SelfServiceForgotPasswordWritePlatformServiceImpl: createForgotPasswordRequest(jsonBody)
    
    SelfServiceForgotPasswordWritePlatformServiceImpl->>SelfServiceForgotPasswordWritePlatformServiceImpl: Validate parameters & username
    SelfServiceForgotPasswordWritePlatformServiceImpl->>SelfServiceForgotPasswordWritePlatformServiceImpl: Generate 4-digit token
    
    SelfServiceForgotPasswordWritePlatformServiceImpl->>Repository: saveAndFlush(SelfServiceRegistration)
    Repository-->>SelfServiceForgotPasswordWritePlatformServiceImpl: persisted record
    
    alt Email Authentication
        SelfServiceForgotPasswordWritePlatformServiceImpl->>EmailService: sendDefinedDomainObject(EmailDetail)
        EmailService-->>Client: Email with token
    else SMS Authentication
        SelfServiceForgotPasswordWritePlatformServiceImpl->>SmsService: sendMessage(SmsMessage)
        SmsService-->>Client: SMS with token
    end
    
    SelfServiceForgotPasswordWritePlatformServiceImpl-->>SelfForgotPasswordApiResource: SelfServiceRegistration
    SelfForgotPasswordApiResource-->>Client: Success message

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• MX-172: Implement atomic self enrollment flow #133: Modifies SelfServiceApiConstants, SelfRegistrationConfiguration, and SelfServiceSecurityConfiguration for similar self-service endpoint additions (self-enrollment pattern vs forgot password).

Suggested labels

⏱️ 10-30 Min Review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}