feat: add bearer-authenticated password change API

Add POST /api/v1/password endpoint accepting a JSON body
(username, old_password, new_password) protected by a shared
Bearer token (CHANGE_API_SECRET / -change-api-secret). It verifies
the current password via an LDAP bind before applying the change,
matching the alps "password" plugin bearer flow.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

change.go

@@ -1,12 +1,29 @@
 package main
 
 import (
+	"crypto/subtle"
+	"encoding/json"
 	"errors"
+	"flag"
 	"log"
 	"net/http"
+	"os"
+	"strings"
 	"unicode"
 )
 
+// changeAPISecret is the shared Bearer token protecting the JSON password change
+// API (POST /api/v1/password). If empty, the API is disabled.
+var changeAPISecret string
+
+func init() {
+	if val, ok := os.LookupEnv("CHANGE_API_SECRET"); ok {
+		changeAPISecret = val
+	}
+
+	flag.StringVar(&changeAPISecret, "change-api-secret", changeAPISecret, "Bearer token protecting the JSON password change API")
+}
+
 func checkPasswdConstraint(password string) error {
 	if len(password) < 12 {
 		return errors.New("too short, please choose a password at least 12 characters long")
@@ -118,3 +135,118 @@ func changePassword(w http.ResponseWriter, r *http.Request) {
 
 	displayMsg(w, "Password successfully changed!", http.StatusOK)
 }
+
+// changePasswordAPIRequest is the JSON body accepted by changePasswordAPI.
+// The field names match the default payload_mapping targets of the alps
+// "password" plugin.
+type changePasswordAPIRequest struct {
+	Username    string `json:"username"`
+	OldPassword string `json:"old_password"`
+	NewPassword string `json:"new_password"`
+}
+
+// checkChangeAPIAuthorization validates the Bearer token of an incoming request
+// against the configured shared secret in constant time.
+func checkChangeAPIAuthorization(r *http.Request) bool {
+	if changeAPISecret == "" {
+		return false
+	}
+
+	fields := strings.Fields(r.Header.Get("Authorization"))
+	if len(fields) != 2 || !strings.EqualFold(fields[0], "Bearer") {
+		return false
+	}
+
+	return subtle.ConstantTimeCompare([]byte(fields[1]), []byte(changeAPISecret)) == 1
+}
+
+func writeJSON(w http.ResponseWriter, status int, payload any) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	json.NewEncoder(w).Encode(payload)
+}
+
+func writeJSONError(w http.ResponseWriter, status int, msg string) {
+	writeJSON(w, status, map[string]string{"error": msg})
+}
+
+// changePasswordAPI changes a user's password through a JSON API protected by a
+// Bearer token. Unlike the HTML form flow it is meant to be called by a trusted
+// backend (e.g. the alps "password" plugin), but it still verifies the user's
+// current password via an LDAP bind before applying the change.
+func changePasswordAPI(w http.ResponseWriter, r *http.Request) {
+	if !changeLimiter.Allow(remoteIP(r)) {
+		writeJSONError(w, http.StatusTooManyRequests, "Too many requests. Please try again later.")
+		return
+	}
+
+	if changeAPISecret == "" {
+		writeJSONError(w, http.StatusServiceUnavailable, "Password change API is not configured.")
+		return
+	}
+
+	if !checkChangeAPIAuthorization(r) {
+		writeJSONError(w, http.StatusUnauthorized, "Invalid or missing Bearer token.")
+		return
+	}
+
+	var req changePasswordAPIRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		writeJSONError(w, http.StatusBadRequest, "Invalid JSON body.")
+		return
+	}
+
+	if req.Username == "" {
+		writeJSONError(w, http.StatusBadRequest, "Please provide a valid username.")
+		return
+	}
+	if req.OldPassword == "" || req.NewPassword == "" {
+		writeJSONError(w, http.StatusBadRequest, "Old and new passwords are required.")
+		return
+	}
+	if err := checkPasswdConstraint(req.NewPassword); err != nil {
+		writeJSONError(w, http.StatusNotAcceptable, "The password you chose doesn't respect all constraints: "+err.Error())
+		return
+	}
+
+	internalErr := func(err error) {
+		log.Println(err)
+		writeJSONError(w, http.StatusInternalServerError, "Unable to process your request. Please try again later.")
+	}
+
+	conn, err := myLDAP.Connect()
+	if err != nil || conn == nil {
+		internalErr(err)
+		return
+	}
+	defer conn.Close()
+
+	if err := conn.ServiceBind(); err != nil {
+		internalErr(err)
+		return
+	}
+
+	dn, err := conn.SearchDN(req.Username, true)
+	if err != nil {
+		log.Println(err)
+		// User not found: perform a dummy bind to prevent username enumeration via timing.
+		conn.Bind("cn=dummy,"+myLDAP.BaseDN, req.OldPassword)
+		writeJSONError(w, http.StatusUnauthorized, "Invalid login or password.")
+		return
+	}
+
+	if err := conn.Bind(dn, req.OldPassword); err != nil {
+		log.Println(err)
+		writeJSONError(w, http.StatusUnauthorized, "Invalid login or password.")
+		return
+	}
+
+	if err := conn.ChangePassword(dn, req.NewPassword); err != nil {
+		internalErr(err)
+		return
+	}
+
+	log.Printf("Password changed via API for %s", dn)
+
+	writeJSON(w, http.StatusOK, map[string]string{"message": "Password successfully changed"})
+}