Name the account on the forced password change, and offer a way out

[hamzahalq]

Follow-up to the forced password change added in #311.

That screen is reached by redirect rather than by choice, and it was a dead end: it never said which account it was talking about, and every route redirects back to it — so landing on it with the wrong account left no way in short of clearing cookies.

Now it names the account and offers signing in as someone else.

Why the screen exists at all

The seeded administrator ships with a password published in this repository. Until that password is replaced, the account's token grants nothing, so there is no usable app to land in — every page would refuse. The dead-end screen is the honest presentation of a dead-end token; a banner inside the app would stop a browser and nobody using curl.

It only fires for accounts still holding the shipped password. Everyone else signs in and lands on the dashboard as before.

Verified

Driven in a real browser against a local database with the flag set:

• sign in → lands on /change-password, headed "Choose a password", showing Signed in as admin@Bitween.systems
• any other route → redirected back
• token carries 0 permissions; GET /api/partners → 401
• "Sign in as someone else" → signs out, returns to /login
• after choosing a password → lands on /dashboard, /partners opens

Typecheck and the 344 client tests pass.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: simplify9/coderabbit/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 015a128e-1e2c-478d-a8f2-72ed4f5ccf47

📥 Commits

Reviewing files that changed from the base of the PR and between c9186d6 and b5aa564.

📒 Files selected for processing (1)

• SW.Bitween.Web/ClientApp/src/pages/auth/ChangePassword.tsx

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

🔇 Additional comments (1)

SW.Bitween.Web/ClientApp/src/pages/auth/ChangePassword.tsx (1)

21-21: LGTM!

Also applies to: 63-71, 109-124

---

📝 Summary

Summary

• ChangePasswordPage now displays the signed-in account email.
• It adds “Sign in as someone else”, which calls signOut() and returns the user to login.
• The change targets accounts using the shipped administrator password. Other accounts keep the normal dashboard flow.

Risk: risk:low

Security-sensitive areas

• Forced password-change routing.
• Session identity display.
• Sign-out and authentication state handling.
• Password replacement flow.

Test coverage impact

• The PR objectives report browser, routing, token-permission, sign-out, password-replacement, client-type checks, and 344 client tests.
• The requested source inspection failed because the repository could not be cloned. These results cannot be independently verified.

Operational concerns

• No migration or deployment change is identified.
• Rollback requires reverting the client change.
• Confirm that sign-out clears the relevant session state and returns the user to login.

Walkthrough

The change password page now shows the signed-in account email and provides a button to sign out and use another account.

Changes

Change password account context

Layer / File(s)	Summary
Account context and sign-out SW.Bitween.Web/ClientApp/src/pages/auth/ChangePassword.tsx	ChangePasswordPage reads session and signOut from useSession(). It displays the session email and calls signOut() from the alternate-account button.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested labels: security, risk:critical

Suggested reviewers: ahmadrabuhussein

Merge Risk: ⚪ Minimal · up to b5aa5

The update appears limited to showing the active account and providing an alternate sign-in exit, with no unresolved merge-blocking risk identified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies both main changes: showing the account name during the forced password change and providing an exit path.
Description check	✅ Passed	The description directly explains the forced password-change flow, the account identification, and the sign-out option. It also documents verification results.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Warning

Git: CodeRabbit could not clone the repository, so clone-backed analysis was skipped and this review may be incomplete. Verify repository clone access, such as SSH credentials, before requesting another full review. If clone access is intentionally unavailable, use path_filters to narrow the review scope.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}