Strongloop REST API: change password - rest

Question

I would like to implement a simple "change password" so that an authorised user can do so.
Experimenting with the explorer, I managed to write an ACL for the user model (my extension of the default User) that allow a user to change its data:
{
"principalType": "ROLE",
"principalId": "$owner",
"accessType": "WRITE",
"permission": "ALLOW"
}
However, when I try from explorer the endpoint PUT /users/{id} with new credentials, it fails silently, i.e., it returns ok, but perform no password change:
REQUEST:
http://localhost:3000/api/users/6?access_token=6CVOuMZCLB8deH7e5t8xJtzDlWjU98WUCRCSGO6zdjW0bhSR6Z20vddl7dIWepF8
DATA:
{
"credentials":
{"email":"pepito#example.com", "password": "ppito"}
}
(User 6 is already authenticated).
RESPONSE:
{
"realm": null,
"username": "pepito",
"credentials": {
"email": "pepito#example.com",
"password": "ppito"
},
"challenges": null,
"email": "pepito#example.com",
"emailVerified": true,
"verificationToken": "2a9c25fa6e858db5894f98cd3f0be3694041f148781896cb5775ff30da1f367c7843ac4b60013fd47c34c6f1a862a5cabb77cf2807c101da7f2acfcdd8853ec7",
"status": null,
"created": null,
"lastUpdated": null,
"id": 6
}
However, the password remain unchanged (tried with logout/login from the explorer).
Could you help me?

Answer 1

Dealing with password is different game. In order to change the password use the following code:
var AccessToken = Customer.app.models.AccessToken;
AccessToken.findById(access_token, function (err, token) {
if (err) cb(err);
else {
Customer.findById(token.userId, function (err, user) {
if (err) {
cb(err);
}
if (user == null || user == undefined) cb(new Error('user is undefined'));
user.updateAttribute('password', password, function (err, user) {
if (err) {
cb(err);
}
cb(null, 'success');
});
});
}
})
updateAttribute is what allows you to make the updates.
I've never been able to change password from swagger.