From b5aa564683cbf650c30afc192dc9a9d1dffea763 Mon Sep 17 00:00:00 2001
From: Hamza Alqurneh <hamza@simplify9.com>
Date: Wed, 16 Sep 2026 11:50:40 +0300
Subject: [PATCH] fix: name the account on the forced password change, and
 offer a way out
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The screen is reached by redirect, so whoever lands there did not ask for
it: it now says which account it means, and offers signing in as someone
else. Without that it was a trap — every route redirects back to it, so
reaching it on the wrong account left no way in but clearing cookies.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../src/pages/auth/ChangePassword.tsx         | 27 ++++++++++++++++++-
 1 file changed, 26 insertions(+), 1 deletion(-)

diff --git a/SW.Bitween.Web/ClientApp/src/pages/auth/ChangePassword.tsx b/SW.Bitween.Web/ClientApp/src/pages/auth/ChangePassword.tsx
index b10e1e26..51d00677 100644
--- a/SW.Bitween.Web/ClientApp/src/pages/auth/ChangePassword.tsx
+++ b/SW.Bitween.Web/ClientApp/src/pages/auth/ChangePassword.tsx
@@ -18,7 +18,7 @@ import { AuthLayout } from "./AuthLayout";
  * lets them out of it.
  */
 export function ChangePasswordPage() {
-  const { refresh } = useSession();
+  const { session, refresh, signOut } = useSession();
 
   const [currentPassword, setCurrentPassword] = useState("");
   const [newPassword, setNewPassword] = useState("");
@@ -60,6 +60,15 @@ export function ChangePasswordPage() {
         This account still has the password it shipped with, which is publicly known. Pick your own
         to carry on — nothing else is available until you do.
       </p>
+      {/*
+        Named, because the page is reached by redirect rather than by choice: whoever lands here
+        did not ask for it and has no other way to tell which account is being talked about.
+      */}
+      {session && (
+        <p className="mt-3 rounded-md bg-ink-50 px-3 py-2 text-sm text-ink-600">
+          Signed in as <span className="font-medium text-ink-900">{session.user.email}</span>
+        </p>
+      )}
 
       <form onSubmit={submit} className="mt-7 space-y-4">
         <Field label="Current password" htmlFor="current-password">
@@ -97,6 +106,22 @@ export function ChangePasswordPage() {
           {change.isPending ? "Saving…" : "Set password"}
         </Button>
       </form>
+
+      {/*
+        The way out. Without it this screen is a trap: every route redirects back here, so someone
+        who reached it on the wrong account — or who does not know this password — has no way to
+        sign in as anyone else short of clearing their cookies.
+      */}
+      <p className="mt-6 text-center text-sm text-ink-500">
+        Not your account?{" "}
+        <button
+          type="button"
+          onClick={() => void signOut()}
+          className="font-medium text-ink-900 underline underline-offset-2 hover:text-ink-700"
+        >
+          Sign in as someone else
+        </button>
+      </p>
     </AuthLayout>
   );
 }