Don't allow password resets for holding accounts

2015-04-14 13:11:49 +01:00
parent 33f56b71a2
commit 893ff85521
2 changed files with 8 additions and 1 deletions
@@ -60,6 +60,13 @@ describe "PasswordResetHandler", ->
 				args[1].setNewPasswordUrl.should.equal "#{@settings.siteUrl}/user/password/set?passwordResetToken=#{@token}"
 				done()

+		it "should return exists = false for a holdingAccount", (done) ->
+			@user.holdingAccount = true
+			@UserGetter.getUser.callsArgWith(1, null, @user)
+			@PasswordResetTokenHandler.getNewToken.callsArgWith(1)
+			@PasswordResetHandler.generateAndEmailResetToken @user.email, (err, exists)=>
+				exists.should.equal false
+				done()

 	describe "setNewUserPassword", ->