Remove Account Update Route

[gr2m]

I think we can remove the PATCH /session/account route entirely, and make all account properties after sign up read only, without exception. The security requirements / workflows to change a username or a password are app-specific, so I'd suggest that we use the requests API for that. I think it's perfectly suited for that.

In Hoodie’s implementation, the handlers for the different requests can be defined with requests option passed to the hapi plugin. For example the following request handler would require a x-password header to be sent, and the PUT request against CouchDB would happen with basic auth, using the username and password, and will therefore fail if the password is incorrect. The user's session is ignored entirely.

var options = {
  /// ...
  requests: {
    updateAccount: function (request, reply) {
      var server = request.connection.server
      var user = request.auth.credentials
      var password = request.headers['x-password']

      var promise = server.plugins.account.api.accounts.update(user.id, {
        username: request.payload.username,
        password: request.payload.password
      }, {
        auth: {
          username: user.username,
          password: password
        }
      })

      reply(promise)
    }
  }
}

That would also make the separation of accounts & profiles more clear.

Any thoughts @patriciagarcia @tthew?

[patriciagarcia]

👍

[HipsterBrown]

👍

[gr2m]

fixed via #7