appauth/jsoncs3: Allow deletion using password hash

pkg/appauth/manager/jsoncs3/jsoncs3.go

@@ -226,6 +226,15 @@ func (m *manager) InvalidateAppPassword(ctx context.Context, secret string) erro
 
 	updater := func(a map[string]*apppb.AppPassword) (map[string]*apppb.AppPassword, error) {
 		for key, pw := range a {
+			// Allow deleting a token using the password hash. This is needed because of
+			// some shortcomings of the CS3 APIs. On the API level tokens don't have IDs
+			// ListAppPasswords only returns the hashed password. So allowing to delete
+			// using the hashed password as the key is the only way to delete tokens for
+			// which the user does not remember the password.
+			if secret == pw.Password {
+				delete(a, key)
+				return a, nil
+			}
 			ok, err := argon2id.ComparePasswordAndHash(secret, pw.Password)
 			switch {
 			case err != nil:

pkg/appauth/manager/jsoncs3/jsoncs3_test.go

@@ -296,10 +296,11 @@ var _ = Describe("Jsoncs3", func() {
 		})
 		Describe("InvalidateAppPassword", func() {
 			var appPasswords = map[string]*apppb.AppPassword{}
+			var hash2 string
 			BeforeEach(func() {
 				hash1, err := argon2id.CreateHash("password1", argon2id.DefaultParams)
 				Expect(err).ToNot(HaveOccurred())
-				hash2, err := argon2id.CreateHash("password2", argon2id.DefaultParams)
+				hash2, err = argon2id.CreateHash("password2", argon2id.DefaultParams)
 				Expect(err).ToNot(HaveOccurred())
 				appPasswords["id1"] = &apppb.AppPassword{
 					Password: hash1,
@@ -338,6 +339,28 @@ var _ = Describe("Jsoncs3", func() {
 				_, ok := uploadedPw["id1"]
 				Expect(ok).To(BeTrue())
 
+				_, ok = uploadedPw["id2"]
+				Expect(ok).To(BeFalse())
+			})
+			It("Removes the requested password from the store when using the password hash", func() {
+				var uploadedPw map[string]*apppb.AppPassword
+				md.EXPECT().Upload(
+					mock.Anything,
+					mock.MatchedBy(func(req metadata.UploadRequest) bool {
+						if req.Path != testUserID+".json" {
+							return false
+						}
+						err := json.Unmarshal(req.Content, &uploadedPw)
+						return err == nil
+					}),
+				).Return(nil, nil)
+				err := manager.InvalidateAppPassword(ctx, hash2)
+				Expect(err).ToNot(HaveOccurred())
+				Expect(len(uploadedPw)).To(Equal(1))
+
+				_, ok := uploadedPw["id1"]
+				Expect(ok).To(BeTrue())
+
 				_, ok = uploadedPw["id2"]
 				Expect(ok).To(BeFalse())
 			})