salix/modules/worker/back/methods/worker/setPassword.js

const ForbiddenError = require('vn-loopback/util/forbiddenError');
module.exports = Self => {
    Self.remoteMethodCtx('setPassword', {
        description: 'Set a new password',
        accepts: [{
            arg: 'id',
            type: 'number',
            required: true,
            description: 'The worker id',
            http: {source: 'path'}
        }, {
            arg: 'newPass',
            type: 'String',
            required: true,
            description: 'The new worker password'
        }],
        http: {
            path: `/:id/setPassword`,
            verb: 'PATCH'
        }
    });
    Self.setPassword = async(ctx, id, newPass, options) => {
        const models = Self.app.models;
        const myOptions = {};
        let tx;

        if (typeof options == 'object')
            Object.assign(myOptions, options);
        if (!myOptions.transaction) {
            tx = await Self.beginTransaction({});
            myOptions.transaction = tx;
        }
        try {
            const isSubordinate = await Self.isSubordinate(ctx, id, myOptions);
            if (!isSubordinate) throw new ForbiddenError('They\'re not your subordinate');

            await models.Account.setUnverifiedPassword(id, newPass, myOptions);

            if (tx) await tx.commit();
        } catch (e) {
            if (tx) await tx.rollback();
            throw e;
        }
    };
};