fix(server): change password with token should be public (#7855)

packages/backend/server/tests/auth.e2e.ts

@@ -132,13 +132,14 @@ test('set and change password', async t => {
     );
 
     const newPassword = randomBytes(16).toString('hex');
-    const userId = await changePassword(
+    const success = await changePassword(
       app,
-      u1.token.token,
+      u1.id,
       setPasswordToken as string,
       newPassword
     );
-    t.is(u1.id, userId, 'failed to set password');
+
+    t.true(success, 'failed to change password');
 
     const ret = auth.signIn(u1Email, newPassword);
     t.notThrowsAsync(ret, 'failed to check password');
@@ -201,7 +202,7 @@ test('should revoke token after change user identify', async t => {
       await sendSetPasswordEmail(app, u3.token.token, u3Email, 'affine.pro');
       const token = await getTokenFromLatestMailMessage();
       const newPassword = randomBytes(16).toString('hex');
-      await changePassword(app, u3.token.token, token as string, newPassword);
+      await changePassword(app, u3.id, token as string, newPassword);
 
       const user = await currentUser(app, u3.token.token);
       t.is(user, null, 'token should be revoked');

packages/backend/server/tests/utils/user.ts

@@ -129,26 +129,23 @@ export async function sendSetPasswordEmail(
 
 export async function changePassword(
   app: INestApplication,
-  userToken: string,
+  userId: string,
   token: string,
   password: string
 ): Promise<string> {
   const res = await request(app.getHttpServer())
     .post(gql)
-    .auth(userToken, { type: 'bearer' })
     .set({ 'x-request-id': 'test', 'x-operation-name': 'test' })
     .send({
       query: `
-            mutation changePassword($token: String!, $password: String!) {
-              changePassword(token: $token, newPassword: $password) {
-                id
-              }
+            mutation changePassword($token: String!, $userId: String!, $password: String!) {
+              changePassword(token: $token, userId: $userId, newPassword: $password)
             }
           `,
-      variables: { token, password },
+      variables: { token, password, userId },
     })
     .expect(200);
-  return res.body.data.changePassword.id;
+  return res.body.data.changePassword;
 }
 
 export async function sendVerifyChangeEmail(