feat(#9547): add password change feature on first time login

api/resources/translations/messages-en.properties

@@ -400,6 +400,11 @@ bulkdelete.confirm.title = Delete record?
 bulkdelete.confirm.title.plural = Delete selected records?
 call = Call
 case_id = Case ID
+change.password.confirm.password = Confirm password
+change.password.hint = Use uppercase letters, numbers, and special characters.
+change.password.new.password = New password
+change.password.submit = Change password
+change.password.title = Change your password
 child_birth_date = Child birth date
 child_birth_outcome = Child birth outcome
 child_birth_weight = Child birth weight
@@ -964,8 +969,11 @@ partner.logo.upload = Upload partner logo
 partner.name.field = Partner name
 partner.supporting = Supporting partners
 partner.tab.partners = Partners
+password.current.incorrect = Current password is not correct
 password.incorrect = Password is not correct.
 password.length.minimum = The password must be at least {{minimum}} characters long.
+password.must.match = Password and confirm password must match
+password.same = New password must be different from current password
 password.update = Update password
 password.weak = The password is too easy to guess. Include a range of characters to make it more complex.
 patient\ id\ not\ found\ response = Send the following response message if the validations pass but the Medic ID is not located.

api/resources/translations/messages-es.properties

@@ -400,6 +400,11 @@ bulkdelete.confirm.title = ¿Eliminar el registro?
 bulkdelete.confirm.title.plural = ¿Eliminar registros seleccionados?
 call = Llamar
 case_id = Identificación del caso
+change.password.confirm.password = Confirmar contraseña
+change.password.hint = Utilice letras mayúsculas, números y caracteres especiales.
+change.password.new.password = Nueva contraseña
+change.password.submit = Cambiar la contraseña
+change.password.title = Cambiar contraseña
 child_birth_date = Fecha de nacimiento del niño
 child_birth_outcome = Resultado del nacimiento del niño
 child_birth_weight = Peso del niño al nacer
@@ -964,8 +969,11 @@ partner.logo.upload = Subir logo del socio
 partner.name.field = Nombre del socio
 partner.supporting = Socios que está apoyando
 partner.tab.partners = Socios
+password.current.incorrect = La contraseña actual no es correcta
 password.incorrect = La contraseña no es correcta.
 password.length.minimum = La contraseña debe tener al menos {{minimum}} caracteres.
+password.must.match = Las contraseñas y la contraseña de confirmación deben coincidir
+password.same = La nueva contraseña debe ser diferente de la contraseña actual
 password.update = Actualizar contraseña
 password.weak = La contraseña es demasiado fácil de adivinar. Incluya más variedad de caracteres para hacerlo más complejo.
 patient\ id\ not\ found\ response = Enviar el siguiente mensaje de respuesta, sí las validaciones pasan correctamente pero no se encontró el Medic ID.

api/resources/translations/messages-fr.properties

@@ -400,6 +400,11 @@ bulkdelete.confirm.title = Supprimer l'enregistrement?
 bulkdelete.confirm.title.plural = Supprimer les enregistrements sélectionnés?
 call = Appeler
 case_id = ID du cas
+change.password.confirm.password = Confirmer le mot de passe
+change.password.hint = Utilisez une combinaison de lettres majuscules, de chiffres et de caractères spéciaux.
+change.password.new.password = Nouveau mot de passe
+change.password.submit = Changer le mot de passe
+change.password.title = Changez votre mot de passe
 child_birth_date = Date de naissance de l'enfant
 child_birth_outcome = Résultat de la naissance de l'enfant
 child_birth_weight = Poids de l'enfant à la naissance
@@ -964,8 +969,11 @@ partner.logo.upload = Télécharger le logo du partenaire
 partner.name.field = Nom du partenaire
 partner.supporting = Partenaires de soutien
 partner.tab.partners = Partenaires
+password.current.incorrect = Le mot de passe actuel n'est pas correct
 password.incorrect = Mot de passe incorrect
 password.length.minimum = Le mot de passe doit être au moins {{minimum}} caractères.
+password.must.match = Le mot de passe et la confirmation du mot de passe doivent correspondre
+password.same = Le nouveau mot de passe doit être différent du mot de passe actuel
 password.update = Mettre à jour mot de passe
 password.weak = Le mot de passe est trop facile à deviner. Inclure au moins une lettre majuscule, un chiffre et un caractère spécial.
 patient\ id\ not\ found\ response = Envoyer cette réponse si les validations passent, mais l'ID du patient n'est pas retrouvé.

api/resources/translations/messages-id.properties

@@ -884,6 +884,7 @@ partner.supporting =
 partner.tab.partners = 
 password.incorrect = Kata sandi tidak benar.
 password.length.minimum = Kata sandi harus setidaknya {{minimum}} karakter.
+password.must.match = Kata sandi dan konfirmasi kata sandi harus cocok
 password.update = Perbaharui Kata Sandi
 password.weak = Kata sandinya terlalu mudah. Sertakan setidaknya 1 huruf besar, 1 angka, dan 1 karakter khusus.
 patient\ id\ not\ found\ response = Kirim pesan respon ini bila lolos validasi tetapi Medic ID tidak ditemukan

api/resources/translations/messages-ne.properties

@@ -400,6 +400,11 @@ bulkdelete.confirm.title = रेकर्ड मेटाउने हो?
 bulkdelete.confirm.title.plural = चयन गरिएका रेकर्डहरू मेट्ने हो?
 call = कल
 case_id = केस आईडी
+change.password.confirm.password = पासवर्ड पुष्टि गर्नुहोस्
+change.password.hint = ठूला अक्षर, अङ्क र चिन्हहरूको मिश्रण भएको एउटा भरपर्दो पासवर्ड सिर्जना गर्नुहोस्
+change.password.new.password = नयाँ पासवर्ड
+change.password.submit = पासवर्ड परिवर्तन गर्नुहोस्
+change.password.title = आफ्नो पासवर्ड परिवर्तन गर्नुहोस्
 child_birth_date = बच्चाको जन्म मिति
 child_birth_outcome = बच्चाको जन्मावस्था
 child_birth_weight = बच्चाको जन्म तौल
@@ -964,8 +969,11 @@ partner.logo.upload = पार्टनर लोगो अपलोड गर
 partner.name.field = पार्टनरको नाम
 partner.supporting = सहयोगी पार्टनरहरू
 partner.tab.partners = पार्टनरहरू
+password.current.incorrect = वर्तमान पासवर्ड गलत छ
 password.incorrect = पासवर्ड मिलेन।
 password.length.minimum = पासवर्ड कम्तीमा {{minimum}} अक्षरको हुनुपर्छ।
+password.must.match = तपाईंले पासवर्ड हाल्नुहोस् र पासवर्ड पुष्टि गर्नुहोस् नामक फिल्डमा हाल्नुभएको पासवर्ड एउटै छैन। फेरि प्रयास गर्नुहोस्।
+password.same = नयाँ पासवर्ड वर्तमान पासवर्ड भन्दा फरक हुनुपर्छ
 password.update = अपडेट पासवर्ड
 password.weak = यो पासवर्ड कमजोर छ।
 patient\ id\ not\ found\ response = बिरामिको आईडी नपाइएमा पठाइने सन्देश

api/resources/translations/messages-sw.properties

@@ -402,6 +402,11 @@ bulkdelete.confirm.title = Futa rekodi?
 bulkdelete.confirm.title.plural = Ungependa kufuta rekodi ulizochagua?
 call = Piga simu
 case_id = Kitambulisho cha kesi
+change.password.confirm.password = Thibitisha nenosiri
+change.password.hint = Tumia herufi kubwa, nambari na herufi maalum.
+change.password.new.password = Nenosiri mpya
+change.password.submit = Badilisha nenosiri
+change.password.title = Badilisha nenosiri lako
 child_birth_date = Tarehe ya kuzaliwa mtoto
 child_birth_outcome = Matokeo ya mtoto mzaliwa
 child_birth_weight = Uzani wa mtoto mzaliwa
@@ -964,8 +969,11 @@ partner.logo.upload = Pakia nembo ya mshirika
 partner.name.field = Jina la mshirika
 partner.supporting = Washirika wanaounga mkono
 partner.tab.partners = Washirika
+password.current.incorrect = Nenosiri la sasa si sahihi
 password.incorrect = Nenosiri si sahihi
 password.length.minimum = Nenosiri inapaswa kuwa na wahusika {{minimum}} kwenda juu
+password.must.match = Nenosiri na uthibitisho wa nenosiri lazima zilingane
+password.same = Nenosiri mpya lazima liwe tofauti na nenosiri la sasa
 password.update = Badilisha nenosiri
 password.weak = Nywila ni rahisi sana nadhani. Jumuisha anuwai ya herufi ili kuifanya iwe ngumu zaidi.
 patient\ id\ not\ found\ response = Tuma ujumbe wa majibu ufuatao kama validations zimepitishwa lakini ID ya mgonjwa haiko

api/src/auth.js

@@ -76,6 +76,27 @@ module.exports = {
       });
   },
 
+  checkPasswordChange: async (req) => {
+    if (!req.userCtx || !req.userCtx.name) {
+      const error = new Error('Not logged in');
+      error.code = 401;
+      error.error = 'Not logged in';
+      throw error;
+    }
+
+    if (roles.isDbAdmin(req.userCtx)) {
+      return;
+    }
+
+    const user = await users.getUserDoc(req.userCtx.name);
+    if (user.password_change_required && !user.token_login) {
+      const error = new Error('Password change required');
+      error.code = 403;
+      error.error = 'Password change required';
+      throw error;
+    }
+  },
+
   /**
    * Extract Basic Auth credentials from a request
    *