本地数据库版本部署的用户无法修改密码[Bug]

[whistle003]

📦 部署环境

Docker

📌 软件版本

1.15.18

💻 系统环境

Windows

🌐 浏览器

Chrome

🐛 问题描述

本地数据库版本部署的用户无法修改密码，只能logto后台reset随机密码，希望可以添加功能支持自定义密码

📷 复现步骤

No response

🚦 期望结果

No response

📝 补充信息

No response

[lobehubbot]

👀 @whistle003

Thank you for raising an issue. We will investigate into the matter and get back to you as soon as possible.
Please make sure you have given us as much context as possible.
非常感谢您提交 issue。我们会尽快调查此事，并尽快回复您。 请确保您已经提供了尽可能多的背景信息。

[lobehubbot]

Bot detected the issue body's language is not English, translate it automatically. 👯👭🏻🧑‍🤝‍🧑👫🧑🏿‍🤝‍🧑🏻👩🏾‍🤝‍👨🏿👬🏿

---

📦 Deployment environment

Docker

📌 Software version

1.15.18

💻 System environment

Windows

🌐 Browser

Chrome

🐛 Problem description

Users deployed in the local database version cannot change their passwords. They can only log to the background to reset a random password. It is hoped that functions can be added to support custom passwords.

📷 Steps to reproduce

No response

🚦 Expected results

No response

📝 Supplementary information

No response

[dosubot[bot]]

本地数据库版本部署的用户无法修改密码的问题可能是由于当前代码库中缺少相关功能实现。根据现有信息，LobeChat 目前没有明确的用户密码修改功能实现。

解决方案建议

1. 实现用户密码修改功能：

   • 在后端添加一个 API 端点，用于处理用户密码修改请求。
   • 在前端添加一个用户界面，允许用户输入当前密码和新密码。

2. 安全措施：

   • 确保新密码符合密码强度要求，如包含大小写字母、数字和特殊字符等。
   • 检查新密码是否在已知的数据泄露中出现过。

3. 数据库更新：

   • 更新数据库模式以支持存储用户密码的哈希值。
   • 确保在数据库中安全地存储和检索用户密码。

参考资料

• 数据库模式：nextauth_authenticators 表用于存储用户凭证 ^[1]。
• 安全措施：包括密码强度检查和数据泄露检查 ^[2]。

希望这些建议能帮助你解决问题。如果需要进一步的帮助，请随时告知。

To continue talking to Dosu, mention @dosu.

[lobehubbot]

Bot detected the issue body's language is not English, translate it automatically. 👯👭🏻🧑‍🤝‍🧑👫🧑🏿‍🤝‍🧑🏻👩🏾‍🤝‍👨🏿👬🏿

---

The problem that users deployed in the local database version cannot change their passwords may be due to the lack of related functionality in the current code base. According to the available information, LobeChat currently does not have a clear implementation of the user password modification function.

Solution suggestions

1. Realize user password modification function:

   • Add an API endpoint to the backend for handling user password change requests.
   • Add a user interface to the frontend that allows users to enter their current and new passwords.

2. Safety Measures:

   • Make sure the new password meets password strength requirements, such as containing uppercase and lowercase letters, numbers, and special characters.
   • Check if the new password has been used in a known data breach.

3. Database update:

   • Update database schema to support storing hashes of user passwords.
   • Ensure user passwords are stored and retrieved securely in the database.

References

• Database schema: nextauth_authenticators table is used to store user credentials^{[[1]](https://github.com/lobehub/lobe-chat/blob/main/src/database/server/migrations/meta/ 0008_snapshot.json)}.
• Security measures: including password strength check and data leakage check^{[2]< /sup>.}

Hope these suggestions help you solve your problem. If further assistance is needed, please feel free to let me know.

To continue talking to Dosu, mention @dosu.

[cy948]

lobechat本身不使用密码登录，你需要看看所使用的sso provider是否提供该服务。

[lobehubbot]

Bot detected the issue body's language is not English, translate it automatically. 👯👭🏻🧑‍🤝‍🧑👫🧑🏿‍🤝‍🧑🏻👩🏾‍🤝‍👨🏿👬🏿

---

Lobechat itself does not use a password to log in, you need to see if the SSO provider you are using provides this service.