From 32dff2063392d1119a104baf22334b4df58b8d4d Mon Sep 17 00:00:00 2001
From: Charles Zhao <charleszhao@silverhand.io>
Date: Wed, 8 Mar 2023 20:34:17 +0800
Subject: [PATCH] fix(core): user should be able to set password even if they
 do not have one (#3331)

---
 .../Profile/containers/ChangePasswordModal/index.tsx      | 8 +-------
 packages/core/src/routes-me/user.ts                       | 6 ++++--
 2 files changed, 5 insertions(+), 9 deletions(-)

diff --git a/packages/console/src/pages/Profile/containers/ChangePasswordModal/index.tsx b/packages/console/src/pages/Profile/containers/ChangePasswordModal/index.tsx
index c812a336e..601f39bbb 100644
--- a/packages/console/src/pages/Profile/containers/ChangePasswordModal/index.tsx
+++ b/packages/console/src/pages/Profile/containers/ChangePasswordModal/index.tsx
@@ -90,13 +90,7 @@ const ChangePasswordModal = () => {
   };
 
   return (
-    <MainFlowLikeModal
-      title="profile.password.set_password"
-      onClose={onClose}
-      onGoBack={() => {
-        navigate('../verify-password', { state });
-      }}
-    >
+    <MainFlowLikeModal title="profile.password.set_password" onClose={onClose} onGoBack={onClose}>
       <TextInput
         placeholder={t('profile.password.password')}
         {...register('newPassword', {
diff --git a/packages/core/src/routes-me/user.ts b/packages/core/src/routes-me/user.ts
index 606df65a1..86707c5a7 100644
--- a/packages/core/src/routes-me/user.ts
+++ b/packages/core/src/routes-me/user.ts
@@ -133,7 +133,7 @@ export default function userRoutes<T extends AuthedMeRouter>(
       const { id: userId } = ctx.auth;
       const { password } = ctx.guard.body;
 
-      const { isSuspended } = await findUserById(userId);
+      const { isSuspended, passwordEncrypted: oldPasswordEncrypted } = await findUserById(userId);
 
       assertThat(!isSuspended, new RequestError({ code: 'user.suspended', status: 401 }));
 
@@ -142,7 +142,9 @@ export default function userRoutes<T extends AuthedMeRouter>(
 
       assertThat(sessionId, new RequestError({ code: 'session.not_found', status: 401 }));
 
-      await checkVerificationStatus(userId, sessionId);
+      if (oldPasswordEncrypted) {
+        await checkVerificationStatus(userId, sessionId);
+      }
 
       const { passwordEncrypted, passwordEncryptionMethod } = await encryptUserPassword(password);
       await updateUserById(userId, { passwordEncrypted, passwordEncryptionMethod });