[lasdf1234]

Cherry-pick Information:

• Original commit: d7e8b22
• Target branch: branch-1.3
• Status: Clean cherry-pick adapted for branch-1.3 (no conflict markers).

What changes were proposed in this pull request?

Backport #13926 / #13925 to branch-1.3:

• Require oldPassword for self password changes and verify it against the stored hash
• Move password changes to PUT /api/idp/users/{user}/password with newPassword / optional oldPassword
• Allow authenticated non-admin users to GET their own user and PUT their own password
• Service admins resetting another user send only newPassword and must omit oldPassword

Backport notes

• branch-1.3 does not include the local-user enabled flag / PUT .../enabled API from main, so that part of [#13925] improvement(idp-basic): Require currentPassword for self password change #13926 is omitted.
• Replaces auto cherry-pick #13956, which landed with unresolved conflict markers.

Why are the changes needed?

Self-service (and admin self) password change previously accepted only the new password. Callers with a valid Basic session could change a password without proving knowledge of the existing password again.

Fix: #13925

Does this PR introduce any user-facing change?

Yes.

• Password change path: PUT /api/idp/users/{user}/password
• Self-change body: {"newPassword":"...","oldPassword":"..."}
• Admin reset of another user: {"newPassword":"..."} (must omit oldPassword)
• Create-user still uses password

How was this patch tested?

• ./gradlew :plugins:idp-basic:test --tests org.apache.gravitino.idp.TestIdpUserGroupManager --tests org.apache.gravitino.idp.dto.requests.TestChangePasswordRequest --tests org.apache.gravitino.idp.web.rest.TestIdpOperations --tests org.apache.gravitino.idp.web.rest.TestIdpAuthorizationFilter -PskipITs
• ./gradlew :docs:build

Made with Cursor

[github-actions]

Code Coverage Report

Overall Project	69.4% +0.17%	🟢
Files changed	89.25%	🟢

Module	Coverage
aliyun	19.74%	🔴
api	47.41%	🟢
authorization-common	85.96%	🟢
authorization-ranger	10.17%	🔴
aws	53.54%	🟢
aws-bundle	0.0%	🔴
azure	32.1%	🔴
azure-bundle	0.0%	🔴
catalog-common	19.13%	🔴
catalog-fileset	80.73%	🟢
catalog-glue	71.33%	🟢
catalog-hive	80.55%	🟢
catalog-jdbc-clickhouse	84.7%	🟢
catalog-jdbc-common	51.02%	🟢
catalog-jdbc-doris	85.44% +2.51%	🟢
catalog-jdbc-hologres	54.03%	🟢
catalog-jdbc-mysql	81.8%	🟢
catalog-jdbc-oceanbase	78.8%	🟢
catalog-jdbc-postgresql	83.62%	🟢
catalog-jdbc-starrocks	79.44%	🟢
catalog-kafka	75.49%	🟢
catalog-lakehouse-generic	76.11%	🟢
catalog-lakehouse-hudi	79.1%	🟢
catalog-lakehouse-iceberg	85.9%	🟢
catalog-lakehouse-paimon	82.17%	🟢
catalog-model	77.99%	🟢
cli	44.51%	🟢
client-java	78.45%	🟢
client-java-runtime	0.0%	🔴
common	51.51%	🟢
core	83.8%	🟢
filesystem-hadoop3	77.68%	🟢
flink	18.07%	🔴
flink-common	50.82%	🟢
flink-runtime	0.0%	🔴
gcp	32.2%	🔴
hadoop-common	15.43%	🔴
hive-metastore-common	62.61%	🟢
hive-metastore3-libs	58.8%	🟢
iceberg-aliyun-bundle	0.0%	🔴
iceberg-common	61.01%	🟢
iceberg-rest-server	75.63%	🟢
idp-basic	86.94% +1.72%	🟢
integration-test-common	0.0%	🔴
jobs	60.37%	🟢
lance-common	35.51%	🔴
lance-rest-server	79.88%	🟢
lineage	59.39%	🟢
optimizer	82.92%	🟢
optimizer-api	42.56%	🟢
server	89.66%	🟢
server-common	79.25%	🟢
spark	28.57%	🔴
spark-common	48.61%	🟢
trino-connector	62.84%	🟢

Files

Module	File	Coverage
catalog-jdbc-doris	DorisTableOperations.java	87.81%	🟢
idp-basic	IdpCredentialValidator.java	100.0%	🟢
	ChangePasswordRequest.java	100.0%	🟢
	IdpUserOperations.java	96.55%	🟢
	IdpRESTUtils.java	95.65%	🟢
	IdpUserGroupManager.java	92.94%	🟢
	IdpAuthorizationFilter.java	78.57%	🟢