From caa30e7ef4d331f923b6e3691d016abb9fbfaae3 Mon Sep 17 00:00:00 2001
From: Neil MacDougall <neil.macdougall@suse.com>
Date: Wed, 18 Sep 2019 20:25:53 +0100
Subject: [PATCH 1/2] Add support for view and edit profile for local user

---
 .../edit-profile-info.component.html          |   9 +-
 .../edit-profile-info.component.ts            |   7 +
 .../profile-info/profile-info.component.html  |  20 ++-
 .../profile-info/profile-info.component.ts    |   2 +
 .../user-profile-banner.component.html        |   7 +-
 .../user-profile-banner.component.ts          |  10 +-
 .../store/src/effects/user-profile.effects.ts |   6 +-
 src/jetstream/auth.go                         |   4 +
 .../20190918092300_LocalUsersUpdates.go       |  33 ++++
 src/jetstream/plugins/userinfo/local_user.go  | 152 ++++++++++++++++++
 src/jetstream/plugins/userinfo/main.go        | 145 ++++++++++++++++-
 src/jetstream/plugins/userinfo/types.go       |  40 +++++
 .../userinfo/{user_info.go => uaa_user.go}    |  75 ++++++---
 .../repository/interfaces/localuser.go        |   2 +
 .../repository/localusers/psql_localusers.go  |  22 ++-
 src/jetstream/setup_console.go                |  10 +-
 16 files changed, 493 insertions(+), 51 deletions(-)
 create mode 100644 src/jetstream/datastore/20190918092300_LocalUsersUpdates.go
 create mode 100644 src/jetstream/plugins/userinfo/local_user.go
 create mode 100644 src/jetstream/plugins/userinfo/types.go
 rename src/jetstream/plugins/userinfo/{user_info.go => uaa_user.go} (57%)

diff --git a/src/frontend/packages/core/src/features/user-profile/edit-profile-info/edit-profile-info.component.html b/src/frontend/packages/core/src/features/user-profile/edit-profile-info/edit-profile-info.component.html
index f83ef80ba6..5414f1f0bb 100644
--- a/src/frontend/packages/core/src/features/user-profile/edit-profile-info/edit-profile-info.component.html
+++ b/src/frontend/packages/core/src/features/user-profile/edit-profile-info/edit-profile-info.component.html
@@ -19,13 +19,16 @@ <h1>Edit User Profile</h1>
         <mat-form-field>
           <input matInput placeholder="Primary Email Address" formControlName="emailAddress">
         </mat-form-field>
-        <p *ngIf="!(canChangePassword | async)">Current password is required when changing email address</p>
-        <p *ngIf="(canChangePassword | async)">Current password is required when changing email address or password</p>
-        <mat-form-field>
+        <p *ngIf="!(canChangePassword | async) && needsPasswordForEmailChange">Current password is required when changing email address</p>
+        <p *ngIf="(canChangePassword | async) && needsPasswordForEmailChange">Current password is required when changing email address or password</p>
+        <mat-form-field *ngIf="needsPasswordForEmailChange">
           <input matInput placeholder="Current Password" type="password" formControlName="currentPassword" [required]="passwordRequired">
         </mat-form-field>
         <div *ngIf="(canChangePassword | async)" class="edit-profile__group">
           <p>Change Password (Leave blank to keep current password)</p>
+          <mat-form-field *ngIf="!needsPasswordForEmailChange">
+            <input matInput placeholder="Current Password" type="password" formControlName="currentPassword" required="true">
+          </mat-form-field>
           <mat-form-field>
             <input matInput placeholder="New Password" type="password" formControlName="newPassword">
           </mat-form-field>
diff --git a/src/frontend/packages/core/src/features/user-profile/edit-profile-info/edit-profile-info.component.ts b/src/frontend/packages/core/src/features/user-profile/edit-profile-info/edit-profile-info.component.ts
index c05f60543f..4de71c0598 100644
--- a/src/frontend/packages/core/src/features/user-profile/edit-profile-info/edit-profile-info.component.ts
+++ b/src/frontend/packages/core/src/features/user-profile/edit-profile-info/edit-profile-info.component.ts
@@ -23,6 +23,8 @@ export class EditProfileInfoComponent implements OnInit, OnDestroy {
 
   editProfileForm: FormGroup;
 
+  needsPasswordForEmailChange: boolean;
+
   constructor(
     private userProfileService: UserProfileService,
     private fb: FormBuilder,
@@ -36,6 +38,8 @@ export class EditProfileInfoComponent implements OnInit, OnDestroy {
       newPassword: '',
       confirmPassword: '',
     });
+
+    this.needsPasswordForEmailChange = false;
   }
 
   private sub: Subscription;
@@ -56,6 +60,9 @@ export class EditProfileInfoComponent implements OnInit, OnDestroy {
   ngOnInit() {
     this.userProfileService.fetchUserProfile();
     this.userProfileService.userProfile$.pipe(first()).subscribe(profile => {
+      // UAA needs the user's password for email changes. Local user does not
+      // Both need it for password change
+      this.needsPasswordForEmailChange = (profile.origin === 'uaa');
       this.profile = profile;
       this.emailAddress = this.userProfileService.getPrimaryEmailAddress(profile);
       this.editProfileForm.setValue({
diff --git a/src/frontend/packages/core/src/features/user-profile/profile-info/profile-info.component.html b/src/frontend/packages/core/src/features/user-profile/profile-info/profile-info.component.html
index b949cbccb2..92ae47a731 100644
--- a/src/frontend/packages/core/src/features/user-profile/profile-info/profile-info.component.html
+++ b/src/frontend/packages/core/src/features/user-profile/profile-info/profile-info.component.html
@@ -12,7 +12,7 @@ <h1>User Profile</h1>
     text: ''
   }"></app-no-content-message>
   <app-user-profile-banner *ngIf="userProfile$ | async as profile"
-    name="{{ profile.name.givenName }} {{ profile.name.familyName }}" email="{{ primaryEmailAddress$ | async }}">
+    name="{{ profile.name.givenName }} {{ profile.name.familyName }}" email="{{ primaryEmailAddress$ | async }}" username="{{ profile.userName }}">
   </app-user-profile-banner>
   <div class="user-profile__info" *ngIf="userProfile$ | async as profile">
     <div class="user-profile__content">
@@ -24,11 +24,17 @@ <h1>User Profile</h1>
           <div class="app-metadata">
             <div class="app-metadata__two-cols">
               <app-metadata-item icon="person" label="User id">{{ profile.userName }}</app-metadata-item>
-              <app-metadata-item icon="title" label="Name">{{ profile.name.givenName }} {{ profile.name.familyName }}
-              </app-metadata-item>
-              <app-metadata-item icon="email" label="Email">{{ primaryEmailAddress$ | async }}</app-metadata-item>
+              <app-metadata-item *ngIf="(profile.name.givenName || profile.name.familyName); else noName" icon="title" label="Name">{{ profile.name.givenName }} {{ profile.name.familyName }}</app-metadata-item>
+              <ng-template #noName>
+                <app-metadata-item icon="title" label="Name">No Name</app-metadata-item>
+              </ng-template>
+              <app-metadata-item *ngIf="primaryEmailAddress$ | async; else noEmail" icon="email" label="Email">{{ primaryEmailAddress$ | async }}</app-metadata-item>
+              <ng-template #noEmail>
+                <app-metadata-item icon="email" label="Email">No Email Address</app-metadata-item>
+              </ng-template>
+              <app-metadata-item *ngIf="(this.userService.isAdmin$ | async)" icon="security" label="User Type">Administrator</app-metadata-item>
             </div>
-            <div class="app-metadata__two-cols">
+            <div class="app-metadata__two-cols" *ngIf="profile.origin === 'uaa'">
               <app-metadata-item icon="date_range" label="Account Created">{{ profile.meta.created | date:'medium' }}
               </app-metadata-item>
               <app-metadata-item icon="date_range" label="Account Last Modified">
@@ -77,12 +83,12 @@ <h1>User Profile</h1>
               [color]="pollingEnabled === 'true' ? 'warn' : 'primary'">
               {{ pollingEnabled === 'true' ? 'Disable' : 'Enable' }} polling
             </button>
-            <div class="user-profile__option-subtext">Disabling polling wil result in some pages not automatically
+            <div class="user-profile__option-subtext">Disabling polling will result in some views not automatically
               updating.</div>
           </div>
         </div>
       </mat-card>
-      <mat-card>
+      <mat-card *ngIf="profile.origin === 'uaa'">
         <mat-card-header>
           <mat-card-title>Groups</mat-card-title>
         </mat-card-header>
diff --git a/src/frontend/packages/core/src/features/user-profile/profile-info/profile-info.component.ts b/src/frontend/packages/core/src/features/user-profile/profile-info/profile-info.component.ts
index 8f1803d274..0bee290cd4 100644
--- a/src/frontend/packages/core/src/features/user-profile/profile-info/profile-info.component.ts
+++ b/src/frontend/packages/core/src/features/user-profile/profile-info/profile-info.component.ts
@@ -10,6 +10,7 @@ import { UserProfileInfo } from '../../../../../store/src/types/user-profile.typ
 import { ConfirmationDialogConfig } from '../../../shared/components/confirmation-dialog.config';
 import { ConfirmationDialogService } from '../../../shared/components/confirmation-dialog.service';
 import { UserProfileService } from '../user-profile.service';
+import { UserService } from '../../../core/user.service';
 
 @Component({
   selector: 'app-profile-info',
@@ -58,6 +59,7 @@ export class ProfileInfoComponent implements OnInit {
     private userProfileService: UserProfileService,
     private store: Store<AppState>,
     private confirmDialog: ConfirmationDialogService,
+    public userService: UserService,
   ) {
     this.isError$ = userProfileService.isError$;
     this.userProfile$ = userProfileService.userProfile$;
diff --git a/src/frontend/packages/core/src/shared/components/user-profile-banner/user-profile-banner.component.html b/src/frontend/packages/core/src/shared/components/user-profile-banner/user-profile-banner.component.html
index 01fb197c6d..e46a59b0f6 100644
--- a/src/frontend/packages/core/src/shared/components/user-profile-banner/user-profile-banner.component.html
+++ b/src/frontend/packages/core/src/shared/components/user-profile-banner/user-profile-banner.component.html
@@ -2,8 +2,13 @@
   <div class="user-profile-banner__avatar">
     <mat-icon>account_circle</mat-icon>
   </div>
-  <div class="user-profile-banner__title">
+  <div class="user-profile-banner__title" *ngIf="(name || email); else noNameOrEmail">
     <div>{{ name }}</div>
     <div class="user-profile-banner__email">{{ email }}</div>
   </div>
+  <ng-template #noNameOrEmail>
+    <div class="user-profile-banner__title">
+      <div>{{ username }}</div>
+    </div>
+  </ng-template>
 </div>
diff --git a/src/frontend/packages/core/src/shared/components/user-profile-banner/user-profile-banner.component.ts b/src/frontend/packages/core/src/shared/components/user-profile-banner/user-profile-banner.component.ts
index cc08da9e85..85fc1dd52a 100644
--- a/src/frontend/packages/core/src/shared/components/user-profile-banner/user-profile-banner.component.ts
+++ b/src/frontend/packages/core/src/shared/components/user-profile-banner/user-profile-banner.component.ts
@@ -7,8 +7,16 @@ import { Component, OnInit, Input } from '@angular/core';
 })
 export class UserProfileBannerComponent implements OnInit {
 
-  @Input() name: string;
+  private uName: string;
+
+  @Input()
+  get name(): string { return this.uName; }
+  set name(name: string) {
+    this.uName = name.trim();
+  }
+
   @Input() email: string;
+  @Input() username: string;
 
   constructor() { }
 
diff --git a/src/frontend/packages/store/src/effects/user-profile.effects.ts b/src/frontend/packages/store/src/effects/user-profile.effects.ts
index 7354f453c3..728a2eb24f 100644
--- a/src/frontend/packages/store/src/effects/user-profile.effects.ts
+++ b/src/frontend/packages/store/src/effects/user-profile.effects.ts
@@ -49,7 +49,7 @@ export class UserProfileEffect {
         type: action.type,
       } as IRequestAction;
       this.store.dispatch(new StartRequestAction(apiAction));
-      return this.httpClient.get(`/pp/${proxyAPIVersion}/uaa/Users/${action.guid}`).pipe(
+      return this.httpClient.get(`/pp/${proxyAPIVersion}/users/${action.guid}`).pipe(
         mergeMap((info: UserProfileInfo) => {
           return [
             new WrapperRequestActionSuccess({
@@ -82,7 +82,7 @@ export class UserProfileEffect {
         headers['x-stratos-password'] = action.password;
       }
 
-      return this.httpClient.put(`/pp/${proxyAPIVersion}/uaa/Users/${guid}`, action.profile, { headers }).pipe(
+      return this.httpClient.put(`/pp/${proxyAPIVersion}/users/${guid}`, action.profile, { headers }).pipe(
         mergeMap((info: UserProfileInfo) => {
           return [
             new WrapperRequestActionSuccess({
@@ -114,7 +114,7 @@ export class UserProfileEffect {
         'x-stratos-password': action.passwordChanges.oldPassword,
         'x-stratos-password-new': action.passwordChanges.password
       };
-      return this.httpClient.put(`/pp/${proxyAPIVersion}/uaa/Users/${guid}/password`, action.passwordChanges, { headers }).pipe(
+      return this.httpClient.put(`/pp/${proxyAPIVersion}/users/${guid}/password`, action.passwordChanges, { headers }).pipe(
         switchMap((info: UserProfileInfo) => {
           return [
             new WrapperRequestActionSuccess({
diff --git a/src/jetstream/auth.go b/src/jetstream/auth.go
index 79f16ddbbf..f4b1d2bf9c 100644
--- a/src/jetstream/auth.go
+++ b/src/jetstream/auth.go
@@ -1248,6 +1248,10 @@ func (p *portalProxy) getLocalUser(userGUID string) (*interfaces.ConnectedUser,
 	}
 
 	var scopes []string
+	scopes = make([]string, 2)
+	scopes[0] = user.Scope
+	scopes[1] = "password.write"
+
 	uaaAdmin := (user.Scope == p.Config.ConsoleConfig.ConsoleAdminScope)
 	uaaEntry := &interfaces.ConnectedUser{
 		GUID:   userGUID,
diff --git a/src/jetstream/datastore/20190918092300_LocalUsersUpdates.go b/src/jetstream/datastore/20190918092300_LocalUsersUpdates.go
new file mode 100644
index 0000000000..1c5517b90d
--- /dev/null
+++ b/src/jetstream/datastore/20190918092300_LocalUsersUpdates.go
@@ -0,0 +1,33 @@
+package datastore
+
+import (
+	"database/sql"
+
+	"bitbucket.org/liamstask/goose/lib/goose"
+)
+
+func init() {
+	
+	RegisterMigration(20190918092300, "LocalUsersUpdates", func(txn *sql.Tx, conf *goose.DBConf) error {
+		addGivenNameColumn := "ALTER TABLE local_users ADD given_name VARCHAR(128);"
+		_, err := txn.Exec(addGivenNameColumn)
+		if err != nil {
+			return err
+		}
+
+		addFamilyNameColumn := "ALTER TABLE local_users ADD family_name VARCHAR(128);"
+		_, err = txn.Exec(addFamilyNameColumn)
+		if err != nil {
+			return err
+		}
+
+		// All existing data will not have values, so set to defaults
+		populate := "UPDATE local_users SET given_name='Admin', family_name='User'"
+		_, err = txn.Exec(populate)
+		if err != nil {
+			return err
+		}
+
+		return nil
+	})
+}
diff --git a/src/jetstream/plugins/userinfo/local_user.go b/src/jetstream/plugins/userinfo/local_user.go
new file mode 100644
index 0000000000..fb1c2b08a7
--- /dev/null
+++ b/src/jetstream/plugins/userinfo/local_user.go
@@ -0,0 +1,152 @@
+package userinfo
+
+import (
+	"encoding/json"
+	"net/http"
+
+	"golang.org/x/crypto/bcrypt"
+
+	"github.com/cloudfoundry-incubator/stratos/src/jetstream/repository/localusers"
+	"github.com/cloudfoundry-incubator/stratos/src/jetstream/repository/interfaces"
+)
+
+// LocalUserInfo is a plugin to fetch user info
+type LocalUserInfo struct {
+	portalProxy interfaces.PortalProxy
+}
+
+// InitLocalUserInfo creates a new local user info provider
+func InitLocalUserInfo(portalProxy interfaces.PortalProxy) Provider {
+	return &LocalUserInfo{portalProxy: portalProxy}
+}
+
+// GetUserInfo gets info for the specified user
+func (userInfo *LocalUserInfo) GetUserInfo(id string) (int, []byte, error) {
+
+	localUsersRepo, err := localusers.NewPgsqlLocalUsersRepository(userInfo.portalProxy.GetDatabaseConnection())
+	if err != nil {
+		return 500, nil, err
+	}
+
+	user, err := localUsersRepo.FindUser(id)
+	if err != nil {
+		return 500, nil, err
+	}
+
+	uaaUser := &uaaUser{
+		ID: id,
+		Origin: "local",
+		Username: user.Username,
+	}
+
+	emails := make([]uaaUserEmail, 1)
+	emails[0] = uaaUserEmail{Value: user.Email}
+	uaaUser.Emails = emails
+
+	uaaUser.Name.GivenName = user.GivenName
+	uaaUser.Name.FamilyName = user.FamilyName
+
+	groups := make([]uaaUserGroup, 2)
+	groups[0] = uaaUserGroup{Display: user.Scope}
+	groups[1] = uaaUserGroup{Display: "password.write"}
+	uaaUser.Groups = groups
+
+	uaaUser.Meta.Version = 0
+
+	jsonString, err := json.Marshal(uaaUser)
+	if err != nil {
+		return 500, nil, err
+	}
+
+	return 200, jsonString, nil
+}
+
+// UpdateUserInfo updates the user's info
+func (userInfo *LocalUserInfo) UpdateUserInfo(profile *uaaUser) (error) {
+
+	// Fetch the user, make updates and save
+	id := profile.ID
+	localUsersRepo, err := localusers.NewPgsqlLocalUsersRepository(userInfo.portalProxy.GetDatabaseConnection())
+	if err != nil {
+		return err
+	}
+
+	user, err := localUsersRepo.FindUser(id)
+	if err != nil {
+		return err
+	}
+
+	hash, err := localUsersRepo.FindPasswordHash(id)
+	if err != nil {
+		return err
+	}
+
+	user.PasswordHash = hash
+
+	if len(profile.Emails) == 1 {
+		email := profile.Emails[0]
+		if len(email.Value) >0 {
+			user.Email = email.Value
+		}
+	}
+
+	user.GivenName = profile.Name.GivenName
+	user.FamilyName = profile.Name.FamilyName
+
+	err = localUsersRepo.UpdateLocalUser(user)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// UpdatePassword updates the user's password
+func (userInfo *LocalUserInfo) UpdatePassword(id string, passwordInfo *passwordChangeInfo) (error) {
+
+	// Fetch the user, make updates and save
+	localUsersRepo, err := localusers.NewPgsqlLocalUsersRepository(userInfo.portalProxy.GetDatabaseConnection())
+	if err != nil {
+		return err
+	}
+
+	user, err := localUsersRepo.FindUser(id)
+	if err != nil {
+		return err
+	}
+
+	hash, err := localUsersRepo.FindPasswordHash(id)
+	if err != nil {
+		return err
+	}
+
+	// Check old password is correct
+	err = bcrypt.CompareHashAndPassword(hash, []byte(passwordInfo.OldPassword))
+	if err != nil {
+		// Old password is incorrect
+		return interfaces.NewHTTPShadowError(
+			http.StatusBadRequest,
+			"Current password is incorrect",
+			"Current password is incorrect: %v", err,
+		)
+	}
+
+	passwordHash, err := HashPassword(passwordInfo.NewPassword)
+	if err != nil {
+		return err
+	}
+
+	user.PasswordHash = passwordHash
+
+	err = localUsersRepo.UpdateLocalUser(user)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+//HashPassword accepts a plaintext password string and generates a salted hash
+func HashPassword(password string) ([]byte, error) {
+	bytes, err := bcrypt.GenerateFromPassword([]byte(password), 14)
+	return bytes, err
+}
\ No newline at end of file
diff --git a/src/jetstream/plugins/userinfo/main.go b/src/jetstream/plugins/userinfo/main.go
index 3dd7798c68..2ebf881e02 100644
--- a/src/jetstream/plugins/userinfo/main.go
+++ b/src/jetstream/plugins/userinfo/main.go
@@ -1,7 +1,12 @@
 package userinfo
 
 import (
+	"encoding/json"
 	"errors"
+	"io/ioutil"
+	"net/http"
+
+	log "github.com/sirupsen/logrus"
 
 	"github.com/cloudfoundry-incubator/stratos/src/jetstream/repository/interfaces"
 	"github.com/labstack/echo"
@@ -39,11 +44,147 @@ func (userInfo *UserInfo) AddAdminGroupRoutes(echoGroup *echo.Group) {
 
 // AddSessionGroupRoutes adds the session routes for this plugin to the Echo server
 func (userInfo *UserInfo) AddSessionGroupRoutes(echoGroup *echo.Group) {
-	// User Info
-	echoGroup.Any("/uaa/*", userInfo.uaa)
+
+	// Only make available specific endpoints for the User Profile for now
+	// Get the user information for the current user session
+	echoGroup.GET("/users/:id", userInfo.userInfo)
+	echoGroup.PUT("/users/:id", userInfo.updateUserInfo)
+	echoGroup.PUT("/users/:id/password", userInfo.updateUserPassword)
 }
 
 // Init performs plugin initialization
 func (userInfo *UserInfo) Init() error {
 	return nil
 }
+
+func (userInfo *UserInfo) getProvider(c echo.Context) Provider {
+	if interfaces.AuthEndpointTypes[userInfo.portalProxy.GetConfig().ConsoleConfig.AuthEndpointType] == interfaces.Local {
+		return InitLocalUserInfo(userInfo.portalProxy)
+	}
+
+	return InitUaaUserInfo(userInfo.portalProxy, c)
+}
+
+func (userInfo *UserInfo) preFlightChecks(c echo.Context) (string, error) {
+	// Check session
+	_, err := userInfo.portalProxy.GetSessionInt64Value(c, "exp")
+	if err != nil {
+		msg := "Could not find session date"
+		log.Error(msg)
+		return "", echo.NewHTTPError(http.StatusForbidden, msg)
+	}
+
+	sessionUser, err := userInfo.portalProxy.GetSessionStringValue(c, "user_id")
+	if err != nil {
+		msg := "Could not find user_id in Session"
+		log.Error(msg)
+		return "", echo.NewHTTPError(http.StatusForbidden, msg)
+	}
+
+	id := c.Param("id")
+	if id != sessionUser {
+		return id, echo.NewHTTPError(http.StatusForbidden, "Invalid user id")
+	}
+
+	return id, nil
+}
+
+// get user info for the current user
+func (userInfo *UserInfo) userInfo(c echo.Context) error {
+	id, err := userInfo.preFlightChecks(c)
+	if err != nil {
+		return err
+	}
+
+	provider := userInfo.getProvider(c)
+	statusCode, body, err := provider.GetUserInfo(id)
+	if err != nil {
+		return err
+	}
+
+	c.Response().WriteHeader(statusCode)
+	_, _ = c.Response().Write(body)
+
+	return nil
+}
+
+
+// update the user info for the current user
+func (userInfo *UserInfo) updateUserInfo(c echo.Context) error {
+	_, err := userInfo.preFlightChecks(c)
+	if err != nil {
+		return err
+	}
+
+	provider := userInfo.getProvider(c)
+
+	body, err := ioutil.ReadAll(c.Request().Body)
+	if err != nil {
+		log.Errorf("Unexpected response: %v", err)
+		return echo.NewHTTPError(http.StatusBadRequest, "Invalid message body")
+	}
+
+	updatedProfile := &uaaUser{}
+	updatedProfile.Raw = body
+	err = json.Unmarshal(body, updatedProfile)
+	if err != nil {
+		return echo.NewHTTPError(http.StatusBadRequest, "Invalid message body")
+	}
+
+	err = provider.UpdateUserInfo(updatedProfile)
+	if err != nil {
+		if httpError, ok := err.(interfaces.ErrHTTPShadow); ok {
+			return httpError
+		}
+
+		return interfaces.NewHTTPShadowError(
+			http.StatusInternalServerError,
+			"Unable to update user profile",
+			"Unable to update user profile: %v", err,
+		)
+	}		
+	
+	c.Response().WriteHeader(http.StatusOK)
+
+	return nil
+}
+
+// update the user info for the current user
+func (userInfo *UserInfo) updateUserPassword(c echo.Context) error {
+	id, err := userInfo.preFlightChecks(c)
+	if err != nil {
+		return err
+	}
+
+	provider := userInfo.getProvider(c)
+
+	body, err := ioutil.ReadAll(c.Request().Body)
+	if err != nil {
+		log.Errorf("Unexpected response: %v", err)
+		return echo.NewHTTPError(http.StatusBadRequest, "Invalid message body")
+	}
+
+	passwordInfo := &passwordChangeInfo{}
+	passwordInfo.Raw = body
+	err = json.Unmarshal(body, passwordInfo)
+	if err != nil {
+		return echo.NewHTTPError(http.StatusBadRequest, "Invalid message body")
+	}
+
+	err = provider.UpdatePassword(id, passwordInfo)
+	if err != nil {
+		if httpError, ok := err.(interfaces.ErrHTTPShadow); ok {
+			return httpError
+		}
+
+		return interfaces.NewHTTPShadowError(
+			http.StatusInternalServerError,
+			"Unable to update user password",
+			"Unable to update user password: %v", err,
+		)
+	}		
+	
+	c.Response().WriteHeader(http.StatusOK)
+
+	return nil
+}
\ No newline at end of file
diff --git a/src/jetstream/plugins/userinfo/types.go b/src/jetstream/plugins/userinfo/types.go
new file mode 100644
index 0000000000..6a65d73905
--- /dev/null
+++ b/src/jetstream/plugins/userinfo/types.go
@@ -0,0 +1,40 @@
+package userinfo
+
+// Provider manages user info for a provider
+type Provider interface {
+	GetUserInfo(id string) (int, []byte, error)
+	UpdateUserInfo(*uaaUser) error
+	UpdatePassword(id string, info *passwordChangeInfo) error
+}
+
+type uaaUserEmail struct {
+	Value string `json:"value"`
+}
+
+type uaaUserName struct {
+	FamilyName string `json:"familyName"`
+	GivenName string `json:"givenName"`
+}
+
+type uaaUserGroup struct {
+	Display string `json:"display"`
+}
+
+type uaaUser struct {
+	Raw []byte
+	ID string `json:"id"`
+	Username string `json:"userName"`
+	Emails []uaaUserEmail `json:"emails"`
+	Name uaaUserName `json:"name"`
+	Origin string `json:"origin"`
+	Groups []uaaUserGroup `json:"groups"`
+	Meta struct {
+		Version int `json:"version"`
+	} `json:"meta"`
+}
+
+type passwordChangeInfo struct {
+	Raw []byte
+	OldPassword string `json:"oldPassword"`
+	NewPassword string `json:"password"`
+}
\ No newline at end of file
diff --git a/src/jetstream/plugins/userinfo/user_info.go b/src/jetstream/plugins/userinfo/uaa_user.go
similarity index 57%
rename from src/jetstream/plugins/userinfo/user_info.go
rename to src/jetstream/plugins/userinfo/uaa_user.go
index cbf5860c31..711a5c19b4 100644
--- a/src/jetstream/plugins/userinfo/user_info.go
+++ b/src/jetstream/plugins/userinfo/uaa_user.go
@@ -1,6 +1,7 @@
 package userinfo
 
 import (
+	"bytes"
 	"fmt"
 	"io/ioutil"
 	"net/http"
@@ -8,86 +9,114 @@ import (
 
 	"github.com/labstack/echo"
 	log "github.com/sirupsen/logrus"
+
+	"github.com/cloudfoundry-incubator/stratos/src/jetstream/repository/interfaces"
 )
 
-func (userInfo *UserInfo) uaa(c echo.Context) error {
+// UaaUserInfo for UAA User Info
+type UaaUserInfo struct {
+	portalProxy interfaces.PortalProxy
+	echo        echo.Context
+}
+
+// InitUaaUserInfo creates a new UAA user info provider
+func InitUaaUserInfo(portalProxy interfaces.PortalProxy, c echo.Context) Provider {
+	return &UaaUserInfo{portalProxy: portalProxy, echo: c}
+}
+
+// GetUserInfo gets info for the specified user
+func (userInfo *UaaUserInfo) GetUserInfo(id string) (int, []byte, error) {
+	target := fmt.Sprintf("Users/%s", id)
+	return userInfo.uaa(target, nil)
+}
+
+// UpdateUserInfo updates the user's info
+func (userInfo *UaaUserInfo) UpdateUserInfo(profile *uaaUser) (error) {
+	target := fmt.Sprintf("Users/%s", profile.ID)
+	_, _, err := userInfo.uaa(target, profile.Raw)
+	return err
+}
+
+// UpdatePassword updates the user's password
+func (userInfo *UaaUserInfo) UpdatePassword(id string, passwordInfo *passwordChangeInfo) (error) {
+	target := fmt.Sprintf("Users/%s/password", id)
+	_, _, err := userInfo.uaa(target, passwordInfo.Raw)
+	return err
+}
+
+func (userInfo *UaaUserInfo) uaa(target string, body []byte) (int, []byte, error)  {
 	log.Debug("uaa request")
 
 	// Check session
-	_, err := userInfo.portalProxy.GetSessionInt64Value(c, "exp")
+	_, err := userInfo.portalProxy.GetSessionInt64Value(userInfo.echo, "exp")
 	if err != nil {
 		msg := "Could not find session date"
 		log.Error(msg)
-		return echo.NewHTTPError(http.StatusForbidden, msg)
+		return http.StatusForbidden, nil, echo.NewHTTPError(http.StatusForbidden, msg)
 	}
 
-	sessionUser, err := userInfo.portalProxy.GetSessionStringValue(c, "user_id")
+	sessionUser, err := userInfo.portalProxy.GetSessionStringValue(userInfo.echo, "user_id")
 	if err != nil {
 		msg := "Could not find user_id in Session"
 		log.Error(msg)
-		return echo.NewHTTPError(http.StatusForbidden, msg)
+		return http.StatusForbidden, nil, echo.NewHTTPError(http.StatusForbidden, msg)
 	}
 
 	uaaEndpoint := userInfo.portalProxy.GetConfig().ConsoleConfig.UAAEndpoint
-	path := c.Path()
 
 	// Now get the URL of the request and remove the path to give the path of the API that is being requested
-	target := c.Request().URL.Path
-	target = target[(len(path) - 1):]
 	url := fmt.Sprintf("%s/%s", uaaEndpoint, target)
 
 	username, err := userInfo.portalProxy.GetUsername(sessionUser)
 	if err != nil {
-		return err
+		return http.StatusInternalServerError, nil, err
 	}
 
 	// Check for custom header - if present, verify the user's password before making the request
-	password := c.Request().Header.Get("x-stratos-password")
+	password := userInfo.echo.Request().Header.Get("x-stratos-password")
 	if len(password) > 0 {
 		// Need to verify the user's login
 		err := userInfo.portalProxy.RefreshUAALogin(username, password, false)
 		if err != nil {
-			return err
+			return  http.StatusInternalServerError, nil, err
 		}
 	}
 
-	statusCode, body, err := userInfo.doAPIRequest(sessionUser, url, c.Request())
+	statusCode, body, err := userInfo.doAPIRequest(sessionUser, url, userInfo.echo.Request(), body)
 	if err != nil {
-		return err
+		return http.StatusInternalServerError, nil, err
 	}
 
 	// Refresh the access token
 	if statusCode == 401 {
 		_, err := userInfo.portalProxy.RefreshUAAToken(sessionUser)
 		if err != nil {
-			return err
+			return  http.StatusInternalServerError, nil, err
 		}
-		statusCode, body, err = userInfo.doAPIRequest(sessionUser, url, c.Request())
+		statusCode, body, err = userInfo.doAPIRequest(sessionUser, url, userInfo.echo.Request(), body)
 		if err != nil {
-			return err
+			return  http.StatusInternalServerError, nil, err
 		}
 	}
 
 	// If we have the user's password, log them in again
 	// This is used when the API call that is being made revokes the current access and refresh tokens
 	if len(password) > 0 {
-		newPassword := c.Request().Header.Get("x-stratos-password-new")
+		newPassword := userInfo.echo.Request().Header.Get("x-stratos-password-new")
 		if len(newPassword) > 0 {
 			password = newPassword
 		}
 		err := userInfo.portalProxy.RefreshUAALogin(username, password, true)
 		if err != nil {
-			return err
+			return  http.StatusInternalServerError, nil, err
 		}
 	}
 
-	c.Response().WriteHeader(statusCode)
-	_, _ = c.Response().Write(body)
+	return statusCode, body, nil
 
-	return nil
 }
 
-func (userInfo *UserInfo) doAPIRequest(sessionUser string, url string, echoReq *http.Request) (stausCode int, body []byte, err error) {
+func (userInfo *UaaUserInfo) doAPIRequest(sessionUser string, url string, echoReq *http.Request, body []byte) (int, []byte, error) {
 	// Proxy the request to the UAA on behalf of the user
 	log.Debugf("doAPIRequest: %s", url)
 
@@ -100,7 +129,7 @@ func (userInfo *UserInfo) doAPIRequest(sessionUser string, url string, echoReq *
 	var res *http.Response
 	var req *http.Request
 
-	req, err = http.NewRequest(echoReq.Method, url, echoReq.Body)
+	req, err = http.NewRequest(echoReq.Method, url, bytes.NewReader(body))
 	if err != nil {
 		return 0, nil, err
 	}
diff --git a/src/jetstream/repository/interfaces/localuser.go b/src/jetstream/repository/interfaces/localuser.go
index 33e0438f42..94f149c8f6 100644
--- a/src/jetstream/repository/interfaces/localuser.go
+++ b/src/jetstream/repository/interfaces/localuser.go
@@ -7,4 +7,6 @@ type LocalUser struct {
 	Username     string `json:"username"`
 	Email        string `json:"email"`
 	Scope        string `json:"scope"`
+	GivenName    string `json:"given_name"`
+	FamilyName   string `json:"family_name"`
 }
diff --git a/src/jetstream/repository/localusers/psql_localusers.go b/src/jetstream/repository/localusers/psql_localusers.go
index bd131c1389..956e7c68ad 100644
--- a/src/jetstream/repository/localusers/psql_localusers.go
+++ b/src/jetstream/repository/localusers/psql_localusers.go
@@ -16,12 +16,12 @@ var findPasswordHash = `SELECT password_hash
 									WHERE user_guid = $1`
 var findUserGUID = `SELECT user_guid FROM local_users WHERE user_name = $1`
 var findUserScope = `SELECT user_scope FROM local_users WHERE user_guid = $1`
-var insertLocalUser = `INSERT INTO local_users (user_guid, password_hash, user_name, user_email, user_scope) VALUES ($1, $2, $3, $4, $5)`
-var updateLocalUser = `UPDATE local_users SET password_hash=$1, user_name=$2, user_email=$3, user_scope=$4 WHERE user_guid=$5`
+var insertLocalUser = `INSERT INTO local_users (user_guid, password_hash, user_name, user_email, user_scope, given_name, family_name) VALUES ($1, $2, $3, $4, $5, $6, $7)`
+var updateLocalUser = `UPDATE local_users SET password_hash=$1, user_name=$2, user_email=$3, user_scope=$4, given_name=$5, family_name=$6 WHERE user_guid=$7`
 var updateLastLoginTime = `UPDATE local_users SET last_login=$1 WHERE user_guid = $2`
 var findLastLoginTime = `SELECT last_login FROM local_users WHERE user_guid = $1`
 var getTableCount = `SELECT count(user_guid) FROM local_users`
-var findUser = `SELECT user_name, user_email, user_scope FROM local_users WHERE user_guid = $1`
+var findUser = `SELECT user_name, user_email, user_scope, given_name, family_name FROM local_users WHERE user_guid = $1`
 
 // PgsqlLocalUsersRepository is a PostgreSQL-backed local users repository
 type PgsqlLocalUsersRepository struct {
@@ -114,10 +114,12 @@ func (p *PgsqlLocalUsersRepository) FindUser(userGUID string) (interfaces.LocalU
 	var (
 		email sql.NullString
 		scope sql.NullString
+		givenName sql.NullString
+		familyName sql.NullString
 	)
 
 	// Look for the user
-	err := p.db.QueryRow(findUser, userGUID).Scan(&user.Username, &email, &scope)
+	err := p.db.QueryRow(findUser, userGUID).Scan(&user.Username, &email, &scope, &givenName, &familyName)
 	if err != nil {
 		msg := "Unable to find user: %v"
 		log.Debugf(msg, err)
@@ -132,6 +134,14 @@ func (p *PgsqlLocalUsersRepository) FindUser(userGUID string) (interfaces.LocalU
 		user.Scope = scope.String
 	}
 
+	if givenName.Valid {
+		user.GivenName = givenName.String
+	}
+
+	if familyName.Valid {
+		user.FamilyName = familyName.String
+	}
+
 	return user, nil
 }
 
@@ -245,7 +255,7 @@ func (p *PgsqlLocalUsersRepository) AddLocalUser(user interfaces.LocalUser) erro
 
 	// Add the new local user to the DB
 	var result sql.Result
-	if result, err = p.db.Exec(insertLocalUser, user.UserGUID, user.PasswordHash, user.Username, user.Email, user.Scope); err != nil {
+	if result, err = p.db.Exec(insertLocalUser, user.UserGUID, user.PasswordHash, user.Username, user.Email, user.Scope, user.GivenName, user.FamilyName); err != nil {
 		msg := "unable to INSERT local user: %v"
 		log.Debugf(msg)
 		err = fmt.Errorf(msg, err)
@@ -294,7 +304,7 @@ func (p *PgsqlLocalUsersRepository) UpdateLocalUser(user interfaces.LocalUser) e
 
 	// Update the local user to the DB
 	var result sql.Result
-	if result, err = p.db.Exec(updateLocalUser, user.PasswordHash, user.Username, user.Email, user.Scope, user.UserGUID); err != nil {
+	if result, err = p.db.Exec(updateLocalUser, user.PasswordHash, user.Username, user.Email, user.Scope, user.GivenName, user.FamilyName, user.UserGUID); err != nil {
 		msg := "unable to UPDATE local user: %v"
 		log.Debugf(msg)
 		err = fmt.Errorf(msg, err)
diff --git a/src/jetstream/setup_console.go b/src/jetstream/setup_console.go
index 3939a005e7..95b133f779 100644
--- a/src/jetstream/setup_console.go
+++ b/src/jetstream/setup_console.go
@@ -257,13 +257,13 @@ func initialiseLocalUsersConfiguration(consoleConfig *interfaces.ConsoleConfig,
 	}
 	scope := localUserScope
 	email := ""
-	user := interfaces.LocalUser{UserGUID: userGUID, PasswordHash: passwordHash, Username: localUserName, Email: email, Scope: scope}
+	user := interfaces.LocalUser{UserGUID: userGUID, PasswordHash: passwordHash, Username: localUserName, Email: email, Scope: scope, GivenName: "Admin", FamilyName: "User"}
 
-	// Don't add the user if they already exist - update instead
-	guid, err := localUsersRepo.FindUserGUID(localUserName)
+	// Don't add the user if they already exist
+	_, err = localUsersRepo.FindUserGUID(localUserName)
 	if err == nil {
-		user.UserGUID = guid
-		return localUsersRepo.UpdateLocalUser(user)
+		// Can't modify the user once created else we loose any updates that might have neen made
+		return nil
 	}
 
 	err = localUsersRepo.AddLocalUser(user)

From 3c1336d10f3bdb430dd8ad688cfe81967c3e121f Mon Sep 17 00:00:00 2001
From: Neil MacDougall <neil.macdougall@suse.com>
Date: Thu, 19 Sep 2019 16:03:57 +0100
Subject: [PATCH 2/2] Fix required on profile edit

---
 .../edit-profile-info/edit-profile-info.component.html       | 2 +-
 .../edit-profile-info/edit-profile-info.component.ts         | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/frontend/packages/core/src/features/user-profile/edit-profile-info/edit-profile-info.component.html b/src/frontend/packages/core/src/features/user-profile/edit-profile-info/edit-profile-info.component.html
index 5414f1f0bb..8377145582 100644
--- a/src/frontend/packages/core/src/features/user-profile/edit-profile-info/edit-profile-info.component.html
+++ b/src/frontend/packages/core/src/features/user-profile/edit-profile-info/edit-profile-info.component.html
@@ -27,7 +27,7 @@ <h1>Edit User Profile</h1>
         <div *ngIf="(canChangePassword | async)" class="edit-profile__group">
           <p>Change Password (Leave blank to keep current password)</p>
           <mat-form-field *ngIf="!needsPasswordForEmailChange">
-            <input matInput placeholder="Current Password" type="password" formControlName="currentPassword" required="true">
+            <input matInput placeholder="Current Password" type="password" formControlName="currentPassword" [required]="passwordRequired">
           </mat-form-field>
           <mat-form-field>
             <input matInput placeholder="New Password" type="password" formControlName="newPassword">
diff --git a/src/frontend/packages/core/src/features/user-profile/edit-profile-info/edit-profile-info.component.ts b/src/frontend/packages/core/src/features/user-profile/edit-profile-info/edit-profile-info.component.ts
index 4de71c0598..d76fa89193 100644
--- a/src/frontend/packages/core/src/features/user-profile/edit-profile-info/edit-profile-info.component.ts
+++ b/src/frontend/packages/core/src/features/user-profile/edit-profile-info/edit-profile-info.component.ts
@@ -83,7 +83,10 @@ export class EditProfileInfoComponent implements OnInit, OnDestroy {
 
   onChanges() {
     this.sub = this.editProfileForm.valueChanges.subscribe(values => {
-      const required = values.emailAddress !== this.emailAddress || values.newPassword.length;
+      // Old password is required if either email or new pw is specified (uaa)
+      // or only if new pw is specified (local account)
+      const required = this.needsPasswordForEmailChange ?
+        values.emailAddress !== this.emailAddress || values.newPassword.length : values.newPassword.length;
       this.passwordRequired = !!required;
       if (required !== this.lastRequired) {
         this.lastRequired = required;