diff --git a/SW.Bitween.Web/ClientApp/src/pages/auth/ChangePassword.tsx b/SW.Bitween.Web/ClientApp/src/pages/auth/ChangePassword.tsx index b10e1e26..51d00677 100644 --- a/SW.Bitween.Web/ClientApp/src/pages/auth/ChangePassword.tsx +++ b/SW.Bitween.Web/ClientApp/src/pages/auth/ChangePassword.tsx @@ -18,7 +18,7 @@ import { AuthLayout } from "./AuthLayout"; * lets them out of it. */ export function ChangePasswordPage() { - const { refresh } = useSession(); + const { session, refresh, signOut } = useSession(); const [currentPassword, setCurrentPassword] = useState(""); const [newPassword, setNewPassword] = useState(""); @@ -60,6 +60,15 @@ export function ChangePasswordPage() { This account still has the password it shipped with, which is publicly known. Pick your own to carry on — nothing else is available until you do.

+ {/* + Named, because the page is reached by redirect rather than by choice: whoever lands here + did not ask for it and has no other way to tell which account is being talked about. + */} + {session && ( +

+ Signed in as {session.user.email} +

+ )}
@@ -97,6 +106,22 @@ export function ChangePasswordPage() { {change.isPending ? "Saving…" : "Set password"} + + {/* + The way out. Without it this screen is a trap: every route redirects back here, so someone + who reached it on the wrong account — or who does not know this password — has no way to + sign in as anyone else short of clearing their cookies. + */} +

+ Not your account?{" "} + +

); }