#1557 Disallow player from using /email setpassword more than once

src/test/java/fr/xephi/authme/command/executable/email/EmailSetPasswordCommandTest.java

@@ -24,13 +24,13 @@ import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.verifyZeroInteractions;
 
 /**
- * Tests for {@link SetPasswordCommand}.
+ * Tests for {@link EmailSetPasswordCommand}.
  */
 @RunWith(MockitoJUnitRunner.class)
-public class SetPasswordCommandTest {
+public class EmailSetPasswordCommandTest {
 
     @InjectMocks
-    private SetPasswordCommand command;
+    private EmailSetPasswordCommand command;
 
     @Mock
     private DataSource dataSource;
@@ -70,6 +70,7 @@ public class SetPasswordCommandTest {
         // then
         verify(validationService).validatePassword("abc123", name);
         verify(dataSource).updatePassword(name, hashedPassword);
+        verify(recoveryService).removeFromSuccessfulRecovery(player);
         verify(commonService).send(player, MessageKey.PASSWORD_CHANGED_SUCCESS);
     }
 
@@ -101,7 +102,7 @@ public class SetPasswordCommandTest {
         command.runCommand(player, Collections.singletonList("abc123"));
 
         // then
-        verifyZeroInteractions(validationService);
-        verifyZeroInteractions(dataSource);
+        verifyZeroInteractions(validationService, dataSource);
+        verify(commonService).send(player, MessageKey.CHANGE_PASSWORD_EXPIRED);
     }
 }

src/test/java/fr/xephi/authme/service/PasswordRecoveryServiceTest.java

@@ -3,6 +3,7 @@ package fr.xephi.authme.service;
 import ch.jalu.injector.testing.BeforeInjecting;
 import ch.jalu.injector.testing.DelayedInjectionRunner;
 import ch.jalu.injector.testing.InjectDelayed;
+import fr.xephi.authme.TestHelper;
 import fr.xephi.authme.datasource.DataSource;
 import fr.xephi.authme.mail.EmailService;
 import fr.xephi.authme.message.MessageKey;
@@ -14,6 +15,8 @@ import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.mockito.Mock;
 
+import static org.hamcrest.Matchers.equalTo;
+import static org.junit.Assert.assertThat;
 import static org.mockito.BDDMockito.given;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.verify;
@@ -70,4 +73,50 @@ public class PasswordRecoveryServiceTest {
         verify(emailService).sendRecoveryCode(name, email, code);
         verify(commonService).send(player, MessageKey.RECOVERY_CODE_SENT);
     }
+
+    @Test
+    public void shouldKeepTrackOfSuccessfulRecoversByIp() {
+        // given
+        Player bobby = mock(Player.class);
+        TestHelper.mockPlayerIp(bobby, "192.168.8.8");
+        given(bobby.getName()).willReturn("bobby");
+
+        Player bobby2 = mock(Player.class);
+        TestHelper.mockPlayerIp(bobby2, "127.0.0.1");
+        given(bobby2.getName()).willReturn("bobby");
+
+        Player other = mock(Player.class);
+        TestHelper.mockPlayerIp(other, "192.168.8.8");
+        given(other.getName()).willReturn("other");
+
+        // when
+        recoveryService.addSuccessfulRecovery(bobby);
+
+        // then
+        assertThat(recoveryService.canChangePassword(bobby), equalTo(true));
+        assertThat(recoveryService.canChangePassword(bobby2), equalTo(false));
+        assertThat(recoveryService.canChangePassword(other), equalTo(false));
+    }
+
+    @Test
+    public void shouldRemovePlayerFromSuccessfulRecovers() {
+        // given
+        Player bobby = mock(Player.class);
+        TestHelper.mockPlayerIp(bobby, "192.168.8.8");
+        given(bobby.getName()).willReturn("bobby");
+        recoveryService.addSuccessfulRecovery(bobby);
+
+        Player other = mock(Player.class);
+        TestHelper.mockPlayerIp(other, "8.8.8.8");
+        given(other.getName()).willReturn("other");
+        recoveryService.addSuccessfulRecovery(other);
+
+        // when
+        recoveryService.removeFromSuccessfulRecovery(other);
+
+
+        // then
+        assertThat(recoveryService.canChangePassword(bobby), equalTo(true));
+        assertThat(recoveryService.canChangePassword(other), equalTo(false));
+    }
 }