Skip to content

Name the account on the forced password change, and offer a way out #313

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
AhmadRAbuhussein merged 1 commit into from
Sep 16, 2026
Merged

Name the account on the forced password change, and offer a way out #313

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 26 additions & 1 deletion SW.Bitween.Web/ClientApp/src/pages/auth/ChangePassword.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ import { AuthLayout } from "./AuthLayout";
* lets them out of it.
*/
export function ChangePasswordPage() {
const { refresh } = useSession();
const { session, refresh, signOut } = useSession();

const [currentPassword, setCurrentPassword] = useState("");
const [newPassword, setNewPassword] = useState("");
Expand Down Expand Up @@ -60,6 +60,15 @@ export function ChangePasswordPage() {
This account still has the password it shipped with, which is publicly known. Pick your own
to carry on — nothing else is available until you do.
</p>
{/*
Named, because the page is reached by redirect rather than by choice: whoever lands here
did not ask for it and has no other way to tell which account is being talked about.
*/}
{session && (
<p className="mt-3 rounded-md bg-ink-50 px-3 py-2 text-sm text-ink-600">
Signed in as <span className="font-medium text-ink-900">{session.user.email}</span>
</p>
)}

<form onSubmit={submit} className="mt-7 space-y-4">
<Field label="Current password" htmlFor="current-password">
Expand Down Expand Up @@ -97,6 +106,22 @@ export function ChangePasswordPage() {
{change.isPending ? "Saving…" : "Set password"}
</Button>
</form>

{/*
The way out. Without it this screen is a trap: every route redirects back here, so someone
who reached it on the wrong account — or who does not know this password — has no way to
sign in as anyone else short of clearing their cookies.
*/}
<p className="mt-6 text-center text-sm text-ink-500">
Not your account?{" "}
<button
type="button"
onClick={() => void signOut()}
className="font-medium text-ink-900 underline underline-offset-2 hover:text-ink-700"
>
Sign in as someone else
</button>
</p>
</AuthLayout>
);
}
Loading