Merge branch '24606-force-password-reset-on-next-login' into 'master'

Force new password after password reset via API

Closes #24606

See merge request !8933

1 files changed, 7 insertions, 0 deletions

diff --git a/spec/requests/api/users_spec.rb b/spec/requests/api/users_spec.rb
index 5bf5bf0739e..8692f9da976 100644
--- a/spec/requests/api/users_spec.rb
+++ b/spec/requests/api/users_spec.rb
@@ -305,6 +305,13 @@ describe API::Users, api: true  do
       expect(user.reload.bio).to eq('new test bio')
     end
 
+    it "updates user with new password and forces reset on next login" do
+      put api("/users/#{user.id}", admin), password: '12345678'
+
+      expect(response).to have_http_status(200)
+      expect(user.reload.password_expires_at).to be <= Time.now
+    end
+
     it "updates user with organization" do
       put api("/users/#{user.id}", admin), { organization: 'GitLab' }