From 221cd401997aa7eb21525e090ffdf52a10210c6d Mon Sep 17 00:00:00 2001
From: Julien Fontanet <julien.fontanet@isonoe.net>
Date: Mon, 31 Jul 2023 11:51:45 +0200
Subject: [PATCH] fix(xo-server/updateUser): can remove password

---
 packages/xo-server/src/xo-mixins/subjects.mjs | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/packages/xo-server/src/xo-mixins/subjects.mjs b/packages/xo-server/src/xo-mixins/subjects.mjs
index 9c7287d51..df20cd9cf 100644
--- a/packages/xo-server/src/xo-mixins/subjects.mjs
+++ b/packages/xo-server/src/xo-mixins/subjects.mjs
@@ -150,8 +150,8 @@ export default class {
     if (permission) {
       user.permission = permission
     }
-    if (password) {
-      user.pw_hash = await hash(password)
+    if (password !== undefined) {
+      user.pw_hash = password === null ? undefined : await hash(password)
     }
 
     const newPreferences = { ...user.preferences }
@@ -179,6 +179,10 @@ export default class {
       user.authProviders = isEmpty(newAuthProviders) ? undefined : newAuthProviders
     }
 
+    if (user.pw_hash === undefined && isEmpty(user.authProviders) && id === this.apiContext?.user.id) {
+      throw new Error('current user cannot be without password and auth providers')
+    }
+
     // TODO: remove
     user.email = user.name
     delete user.name