7e4ddf0b01
* feat(auth): password reset & invite flows for web + admin (#34) Wires end-to-end the previously orphaned password_reset.html and password_setup.html templates, adds the missing POST /auth/password/reset handler (closes #34), and restores the Reset action in the admin user UI (which origin/main had removed precisely because the flow was broken). Web flow - GET /auth/password/reset — renders the set-new-password form - POST /auth/password/reset — 'Forgot Password?' request; emails link, anti-enumeration (same response for unknown email) - POST /auth/password/reset/confirm — validates token + 24h TTL, sets new password, clears token, logs user in - GET /auth/password/setup — renders the setup form (invite link landing) - POST /auth/password/setup/request — signup-tab 'Request Access' (email-only) - POST /auth/password/setup/confirm — 7-day TTL, sets password + name, logs in - Reuses LOCAL_DEV_MODE pattern from email.py: logs the link loudly so developers can use the flow without an SMTP/SendGrid transport Admin flow - POST /api/users accepts send_invite → returns invite_url + invite_email_sent - POST /api/users/{id}/reset-password now returns a full reset_url pointing at the dedicated password-reset endpoint (NOT the magic-link verifier, which would log the user in without prompting for a new password) - admin_users.html: restored Reset row action, copyable reset/invite link modals, invite checkbox on create, reworded 'magic-link not wired' notes Backward compat - JSON POST /auth/password/setup kept unchanged (existing tests pass) - Active-account gate applied to reset/setup flows (matches password_login) Tests: 21 new cases (tests/test_password_flows.py) covering GET renders, request/confirm happy + error paths, TTLs, anti-enumeration, and admin invite/reset URL responses. Full suite: 1309 passed. Closes #34 * fix(admin-users): allow horizontal scroll when actions overflow Four action buttons (Tokens, Reset, Set pwd, Delete) can exceed the viewport on narrow screens. Switch .users-table-wrap from overflow: hidden to overflow-x: auto so the table scrolls instead of clipping, and lock row-actions buttons to a single nowrap line. * fix(admin-users): override base 800px container so table can use full width The base layout caps .container at 800px, so the table was always being clipped regardless of viewport. Unclamp the container on this page and widen the inner page cap to 1400px. * fix(auth): address Devin review — harden JSON setup, anti-enumeration, preserve email case Addresses findings from Devin review on PR #37: 1. JSON POST /auth/password/setup now enforces the same SETUP_TOKEN_TTL (7 days) and active-account check as the web flow. An expired token or a deactivated user can no longer bypass the gate by posting JSON. Existing test fixture seeds setup_token_created=now so backward-compat tests continue to pass. 2. GET /auth/password/setup no longer looks up the user to pre-fill name. The form renders identically regardless of whether the email exists, consistent with anti-enumeration in POST /setup/request. 3. reset_request / setup_request no longer lowercase the submitted email. The rest of the codebase (password_login, magic-link, admin create) uses case-sensitive lookups, so normalizing only here would silently fail for mixed-case accounts. Tests: 6 new cases covering expired-JSON-setup, missing-created-timestamp, deactivated-user-rejection, mixed-case email preservation, and the anti-enumeration property of GET /setup.
57 lines
1.9 KiB
HTML
57 lines
1.9 KiB
HTML
{% extends "base.html" %}
|
|
|
|
{% block title %}Reset Password - {{ config.INSTANCE_NAME }}{% endblock %}
|
|
|
|
{% block content %}
|
|
<div class="login-container">
|
|
<div class="login-card">
|
|
<h2>Reset Your Password</h2>
|
|
<p class="login-description">
|
|
Enter a new password for your account.
|
|
</p>
|
|
|
|
<div class="account-email">
|
|
<strong>{{ email }}</strong>
|
|
</div>
|
|
|
|
{% if error %}
|
|
<div class="flash flash-error">{{ error }}</div>
|
|
{% endif %}
|
|
|
|
<form method="POST" action="/auth/password/reset/confirm" class="login-form">
|
|
<input type="hidden" name="email" value="{{ email }}">
|
|
<input type="hidden" name="token" value="{{ token }}">
|
|
|
|
<div class="form-group">
|
|
<label for="password">New Password</label>
|
|
<input type="password"
|
|
id="password"
|
|
name="password"
|
|
placeholder="Create a strong password"
|
|
required
|
|
autocomplete="new-password"
|
|
minlength="8"
|
|
autofocus>
|
|
<small class="form-hint">At least 8 characters.</small>
|
|
</div>
|
|
|
|
<div class="form-group">
|
|
<label for="confirm_password">Confirm Password</label>
|
|
<input type="password"
|
|
id="confirm_password"
|
|
name="confirm_password"
|
|
placeholder="Re-enter your password"
|
|
required
|
|
autocomplete="new-password"
|
|
minlength="8">
|
|
</div>
|
|
|
|
<button type="submit" class="btn btn-primary btn-block">Reset Password</button>
|
|
</form>
|
|
|
|
<div class="login-links">
|
|
<a href="/login/password" class="btn btn-link">Back to Login</a>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
{% endblock %}
|