metabuilder/packages/ui_auth/workflow/password-change-workflow.jsonscript

{
  "version": "2.2.0",
  "name": "Password Change Workflow",
  "description": "Change password for authenticated user with old password verification",
  "trigger": {
    "type": "http",
    "method": "POST",
    "path": "/auth/change-password"
  },
  "nodes": [
    {
      "id": "validate_context",
      "type": "operation",
      "op": "validate",
      "input": "{{ $context.user.id }}",
      "validator": "required"
    },
    {
      "id": "validate_input",
      "type": "operation",
      "op": "validate",
      "input": "{{ $json }}",
      "rules": {
        "currentPassword": "required|string",
        "newPassword": "required|string|minLength:8|different:currentPassword",
        "confirmPassword": "required|string|same:newPassword"
      }
    },
    {
      "id": "fetch_user",
      "type": "operation",
      "op": "database_read",
      "entity": "User",
      "params": {
        "filter": {
          "id": "{{ $context.user.id }}",
          "tenantId": "{{ $context.tenantId }}"
        }
      }
    },
    {
      "id": "verify_current_password",
      "type": "operation",
      "op": "crypto",
      "operation": "bcrypt_compare",
      "input": "{{ $json.currentPassword }}",
      "hash": "{{ $steps.fetch_user.output.passwordHash }}"
    },
    {
      "id": "check_password_correct",
      "type": "operation",
      "op": "condition",
      "condition": "{{ $steps.verify_current_password.output === true }}"
    },
    {
      "id": "hash_new_password",
      "type": "operation",
      "op": "crypto",
      "operation": "bcrypt_hash",
      "input": "{{ $json.newPassword }}",
      "rounds": 12
    },
    {
      "id": "update_password",
      "type": "operation",
      "op": "database_update",
      "entity": "User",
      "params": {
        "filter": {
          "id": "{{ $context.user.id }}"
        },
        "data": {
          "passwordHash": "{{ $steps.hash_new_password.output }}",
          "passwordChangedAt": "{{ new Date().toISOString() }}"
        }
      }
    },
    {
      "id": "invalidate_sessions",
      "type": "operation",
      "op": "database_delete_many",
      "entity": "Session",
      "params": {
        "filter": {
          "userId": "{{ $context.user.id }}",
          "id": {
            "$ne": "{{ $context.sessionId }}"
          }
        }
      }
    },
    {
      "id": "send_confirmation_email",
      "type": "operation",
      "op": "email_send",
      "to": "{{ $steps.fetch_user.output.email }}",
      "subject": "Your password has been changed",
      "template": "password_changed",
      "data": {
        "displayName": "{{ $steps.fetch_user.output.displayName }}",
        "timestamp": "{{ new Date().toISOString() }}"
      }
    },
    {
      "id": "emit_event",
      "type": "action",
      "action": "emit_event",
      "event": "password_changed",
      "channel": "{{ 'user:' + $context.user.id }}",
      "data": {
        "timestamp": "{{ new Date().toISOString() }}"
      }
    },
    {
      "id": "return_success",
      "type": "action",
      "action": "http_response",
      "status": 200,
      "body": {
        "message": "Password changed successfully. All other sessions have been invalidated for security."
      }
    }
  ]
}