AuthSetPassword Function is able to create a new User

[marvinside]

File: auth.go Function: AuthSetPassword()

The function is able to create a new User if the passed userId does not exists. This seems to be very bad behavior for the Name AuthSetPassword.

[marvinside]

e234d35: This Function now throws an Error and Prints a Stacktrace if it would otherwise create a new user.

[marvinside]

This seems to be in Use at 2 locations in the code:

• userctrl.go:277
  • Function users.CreateUser is called before
• userctrl.go:624
  • This just changes a password

[psilva261]

It might look strange but the sign up code doesn't use transaction (yet). So if there is a failure in between INSERTs, you'd have a half setup user. That's why there was an "UPSERT" in the code, making the function repeatable after failure ("idempotent").

Reason why they are so few transactions in the code: they can be slow, if you use a lot of them or if they are long. Also they don't exactly improve readability...