def test_api_team_patch_password():
    """Can a user change their team password /api/v1/teams/me if logged in as the captain"""
    app = create_ctfd(user_mode="teams")
    with app.app_context():
        user1 = gen_user(
            app.db, name="user1", email="user1@examplectf.com", password="captain"
        )  # ID 2
        user2 = gen_user(app.db, name="user2", email="user2@examplectf.com")  # ID 3
        team = gen_team(app.db)
        team.members.append(user1)
        team.members.append(user2)
        team.captain_id = 2
        user1.team_id = team.id
        user2.team_id = team.id
        app.db.session.commit()
        with login_as_user(app, name="user2") as client:
            r = client.patch(
                "/api/v1/teams/me",
                json={"confirm": "password", "password": "new_password"},
            )
            assert r.status_code == 403

            assert r.get_json() == {
                "errors": {"": ["Only team captains can edit team information"]},
                "success": False,
            }

            team = Teams.query.filter_by(id=1).first()
            assert (
                verify_password(plaintext="new_password", ciphertext=team.password)
                is False
            )

        with login_as_user(app, name="user1", password="captain") as client:
            # Test that invalid passwords aren't accepted
            r = client.patch(
                "/api/v1/teams/me",
                json={"confirm": "incorrect_password", "password": "new_password"},
            )
            assert r.status_code == 400
            assert (
                verify_password(plaintext="new_password", ciphertext=team.password)
                is False
            )

            # Test that the team's password is accepted
            r = client.patch(
                "/api/v1/teams/me",
                json={"confirm": "password", "password": "new_password"},
            )
            assert r.status_code == 200
            team = Teams.query.filter_by(id=1).first()
            assert verify_password(plaintext="new_password", ciphertext=team.password)

            # Test that the captain's password is also accepted
            r = client.patch(
                "/api/v1/teams/me",
                json={"confirm": "captain", "password": "captain_password"},
            )
            assert r.status_code == 200
            team = Teams.query.filter_by(id=1).first()
            assert verify_password(
                plaintext="captain_password", ciphertext=team.password
            )
Can a user change their team password /api/v1/teams/me if logged in as the captain
tests/api/v1/test_teams.py