salix/modules/account/back/models/account.js

const ForbiddenError = require('vn-loopback/util/forbiddenError');
const {models} = require('vn-loopback/server/server');

module.exports = Self => {
    require('../methods/account/sync')(Self);
    require('../methods/account/sync-by-id')(Self);
    require('../methods/account/sync-all')(Self);
    require('../methods/account/login')(Self);
    require('../methods/account/logout')(Self);
    require('../methods/account/change-password')(Self);
    require('../methods/account/set-password')(Self);

    Self.setUnverifiedPassword = async(id, pass, options) => {
        const user = await models.VnUser.findById(id, null, options);
        if (user.emailVerified) throw new ForbiddenError('This password can only be changed by the user themselves');

        await models.VnUser.setPassword(id, pass, options);
        await user.updateAttribute('emailVerified', true, options);
    };
};