🐛 fix: generate token for the user whose password is created not api caller

src/main/kotlin/com/hypto/iam/server/apis/TokenApi.kt

@@ -112,7 +112,7 @@ fun Route.tokenApi() {
         }
     }
 
-    authenticate("sub-org-basic-auth") {
+    authenticate("sub-org-basic-auth", "bearer-auth") {
         post("/organizations/{organization_id}/sub_organizations/token") {
             generateToken(call, context)
         }

src/main/kotlin/com/hypto/iam/server/apis/UsersApi.kt

@@ -423,8 +423,10 @@ fun Route.resetPasswordApi() {
 }
 
 fun Route.createUserPasswordApi() {
+    val gson: Gson by inject()
     val usersService: UsersService by inject()
     val passcodeRepo: PasscodeRepo by inject()
+    val tokenService: TokenService by inject()
 
     postWithPermission(
         listOf(
@@ -466,13 +468,19 @@ fun Route.createUserPasswordApi() {
             require(passcode.email == inviteeUser.email) { "Email in passcode does not match email in request" }
         }
 
-        usersService.createUserPassword(
-            organizationId,
-            subOrganizationName,
-            userId,
-            request.password,
-        )
+        val user =
+            usersService.createUserPassword(
+                organizationId,
+                subOrganizationName,
+                userId,
+                request.password,
+            )
 
-        generateToken(call, context)
+        val tokenResponse = tokenService.generateJwtToken(ResourceHrn(user.hrn))
+        call.respondText(
+            text = gson.toJson(tokenResponse),
+            contentType = ContentType.Application.Json,
+            status = HttpStatusCode.Created,
+        )
     }
 }

src/main/kotlin/com/hypto/iam/server/service/UsersService.kt

@@ -328,7 +328,7 @@ class UsersServiceImpl : KoinComponent, UsersService {
         subOrganizationName: String?,
         userId: String,
         password: String,
-    ) {
+    ): User {
         val user = getUser(organizationId, subOrganizationName, userId)
         organizationRepo.findById(organizationId)
             ?: throw EntityNotFoundException("Invalid organization id")
@@ -357,6 +357,7 @@ class UsersServiceImpl : KoinComponent, UsersService {
             verified = true,
             loginAccess = true,
         )
+        return getUser(organizationId, subOrganizationName, userId)
     }
 
     override suspend fun listUsers(
@@ -614,7 +615,7 @@ interface UsersService {
         subOrganizationName: String?,
         userId: String,
         password: String,
-    )
+    ): User
 
     suspend fun changeUserPassword(
         organizationId: String,

src/test/kotlin/com/hypto/iam/server/apis/SubOrganizationUserApiTest.kt

@@ -19,6 +19,7 @@ import com.hypto.iam.server.models.CreateUserRequest
 import com.hypto.iam.server.models.CreateUserResponse
 import com.hypto.iam.server.models.PolicyAssociationRequest
 import com.hypto.iam.server.models.ResetPasswordRequest
+import com.hypto.iam.server.models.TokenResponse
 import com.hypto.iam.server.models.UpdateUserRequest
 import com.hypto.iam.server.models.User
 import com.hypto.iam.server.models.UserPaginatedResponse
@@ -1188,19 +1189,38 @@ class SubOrganizationUserApiTest : AbstractContainerBaseTest() {
                         header(HttpHeaders.ContentType, ContentType.Application.Json.toString())
                         setBody(gson.toJson(CreateUserPasswordRequest("testPassword@Hash1")))
                     }.apply {
-                        assertEquals(HttpStatusCode.OK, status)
+                        assertEquals(HttpStatusCode.Created, status)
                         assertEquals(
                             ContentType.Application.Json.withCharset(Charsets.UTF_8),
                             contentType(),
                         )
                     }
 
-                assertEquals(HttpStatusCode.OK, response.status)
+                assertEquals(HttpStatusCode.Created, response.status)
                 assertEquals(
                     ContentType.Application.Json.withCharset(Charsets.UTF_8),
                     response.contentType(),
                 )
 
+                val createPasswordResponse = gson.fromJson(response.bodyAsText(), TokenResponse::class.java)
+
+                client.post(
+                    "/organizations/${organization.id}/sub_organizations/token",
+                ) {
+                    header(HttpHeaders.ContentType, ContentType.Application.Json.toString())
+                    header(HttpHeaders.Authorization, "Bearer " + createPasswordResponse.token)
+                }.apply {
+                    assertEquals(HttpStatusCode.OK, status)
+                    assertEquals(
+                        ContentType.Application.Json.withCharset(Charsets.UTF_8),
+                        contentType(),
+                    )
+                    assertEquals(
+                        organization.id,
+                        headers[Constants.X_ORGANIZATION_HEADER],
+                    )
+                }
+
                 // Check if password is created by logging in
                 coEvery {
                     cognitoClient.adminGetUser(any<AdminGetUserRequest>())