diff --git a/SW.Bitween.Web/ClientApp/src/pages/auth/ChangePassword.tsx b/SW.Bitween.Web/ClientApp/src/pages/auth/ChangePassword.tsx index b10e1e26..51d00677 100644 --- a/SW.Bitween.Web/ClientApp/src/pages/auth/ChangePassword.tsx +++ b/SW.Bitween.Web/ClientApp/src/pages/auth/ChangePassword.tsx @@ -18,7 +18,7 @@ import { AuthLayout } from "./AuthLayout"; * lets them out of it. */ export function ChangePasswordPage() { - const { refresh } = useSession(); + const { session, refresh, signOut } = useSession(); const [currentPassword, setCurrentPassword] = useState(""); const [newPassword, setNewPassword] = useState(""); @@ -60,6 +60,15 @@ export function ChangePasswordPage() { This account still has the password it shipped with, which is publicly known. Pick your own to carry on — nothing else is available until you do.
+ {/* + Named, because the page is reached by redirect rather than by choice: whoever lands here + did not ask for it and has no other way to tell which account is being talked about. + */} + {session && ( ++ Signed in as {session.user.email} +
+ )} + + {/* + The way out. Without it this screen is a trap: every route redirects back here, so someone + who reached it on the wrong account — or who does not know this password — has no way to + sign in as anyone else short of clearing their cookies. + */} ++ Not your account?{" "} + +
); }