pws reset

web/CHANGELOG.md

@@ -25,8 +25,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   its grant matrix for every editable data role. Creating a table redirects to
   that table in the definition workspace so its initial grants can be assigned
   immediately.
-- **Bootstrap administrator claim** — `/initial-password` consumes
-  `SetInitialPassword` for the one-time `admin` and `superadmin` setup flow.
+- **Password management** — `/password` consumes `ChangePassword` for the
+  signed-in user, while the user table consumes `ResetUserPassword` for
+  administrator resets allowed by the backend role hierarchy.
 - **`TableDefinition.ListColumnTypes`** — called by the add-table and
   table-definition loaders. The whole response is consumed: `name`, `group`,
   `declarable`, `compound`, `spelling`, `requires_currency`, `creation_only`,

web/src/lib.rs

@@ -247,12 +247,9 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn fresh_installation_can_open_the_initial_password_form() {
-        let (status, body) = get("/initial-password").await;
-        assert!(status.is_success());
-        assert!(body.contains("Claim bootstrap administrator"));
-        assert!(body.contains("value=\"admin\""));
-        assert!(body.contains("value=\"superadmin\""));
+    async fn password_page_requires_a_session() {
+        let (status, _) = get("/password").await;
+        assert_eq!(status, axum::http::StatusCode::SEE_OTHER);
     }
 
     /// The register form carries every user-provided `RegisterRequest` field.

web/src/pages/admin/permissions/logic.rs

@@ -9,14 +9,17 @@ use crate::{
     AppState,
     auth::{
         AddRoleRequest, AssignUserRoleRequest, GrantPermissionRequest, RemoveRoleRequest,
-        RevokePermissionRequest,
+        ResetUserPasswordRequest, RevokePermissionRequest,
     },
     services::{authenticated_request, reject_cross_site},
 };
 
 use super::{
     loader,
-    state::{AddRoleForm, AssignRoleForm, LoadError, PermissionForm, RoleForm, Selection},
+    state::{
+        AddRoleForm, AssignRoleForm, LoadError, PermissionForm, ResetPasswordForm, RoleForm,
+        Selection,
+    },
     ui,
 };
 
@@ -123,6 +126,29 @@ pub(crate) async fn assign_user_role(
     }).await
 }
 
+pub(crate) async fn reset_user_password(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Form(form): Form<ResetPasswordForm>,
+) -> Response {
+    let destination = "/admin/permissions?updated=true";
+    let request_headers = headers.clone();
+    mutate(&headers, destination, async move {
+        let mut auth = state.auth;
+        auth.reset_user_password(authenticated_request(
+            &request_headers,
+            ResetUserPasswordRequest {
+                username: form.username,
+                new_password: form.new_password,
+                new_password_confirmation: form.new_password_confirmation,
+            },
+        ).map_err(|_| "Missing session".to_string())?)
+            .await
+            .map_err(|error| error.message().to_string())?;
+        Ok(())
+    }).await
+}
+
 async fn mutate<F>(headers: &HeaderMap, destination: &str, operation: F) -> Response
 where
     F: std::future::Future<Output = Result<(), String>>,

web/src/pages/admin/permissions/mod.rs

@@ -15,4 +15,5 @@ pub(crate) fn router() -> Router<AppState> {
         .route("/admin/permissions/grant", post(logic::grant))
         .route("/admin/permissions/revoke", post(logic::revoke))
         .route("/admin/permissions/users/role", post(logic::assign_user_role))
+        .route("/admin/permissions/users/password", post(logic::reset_user_password))
 }

web/src/pages/admin/permissions/state.rs

@@ -33,6 +33,13 @@ pub(crate) struct AssignRoleForm {
     pub role: String,
 }
 
+#[derive(Clone, Debug, Default, serde::Deserialize)]
+pub(crate) struct ResetPasswordForm {
+    pub username: String,
+    pub new_password: String,
+    pub new_password_confirmation: String,
+}
+
 pub(crate) struct PermissionPageState {
     pub nav: crate::ui::Nav,
     pub roles: Vec<Role>,
@@ -78,6 +85,14 @@ impl PermissionPageState {
             .find(|role| role.name == self.selected_role)
             .is_some_and(|role| !role.built_in && role.kind == "data")
     }
+
+    pub(crate) fn can_reset_password(&self, user: &UserSummary) -> bool {
+        match self.nav.role.as_str() {
+            "superadmin" => user.role != "superadmin",
+            "admin" => !matches!(user.role.as_str(), "superadmin" | "admin"),
+            _ => false,
+        }
+    }
 }
 
 pub(crate) enum LoadError {

web/src/pages/login/logic.rs

@@ -1,68 +1,55 @@
 use axum::{
     Form,
-    extract::{Query, State},
+    extract::State,
     http::{HeaderMap, HeaderValue, StatusCode, header},
     response::{Html, IntoResponse, Response},
 };
 use tonic::Request;
 
-use crate::{AppState, auth::{LoginRequest, SetInitialPasswordRequest}, services::reject_cross_site, ui::Nav};
+use crate::{
+    AppState,
+    auth::{ChangePasswordRequest, LoginRequest},
+    services::{authenticated_request, reject_cross_site},
+    ui::Nav,
+};
 
-use super::{state::{InitialPasswordInput, LoginInput, LoginQuery}, ui};
+use super::{state::{ChangePasswordInput, LoginInput}, ui};
 
 pub(crate) async fn login_page(
     headers: HeaderMap,
-    Query(query): Query<LoginQuery>,
 ) -> Html<String> {
-    Html(ui::render_page(
-        Nav::new(&headers, "login"),
-        query.initial_password_set,
-    ))
+    Html(ui::render_page(Nav::new(&headers, "login")))
 }
 
-pub(crate) async fn initial_password_page(headers: HeaderMap) -> Html<String> {
-    Html(ui::render_initial_password_page(Nav::new(&headers, "login")))
+pub(crate) async fn password_page(headers: HeaderMap) -> Response {
+    if authenticated_request(&headers, ()).is_err() {
+        return axum::response::Redirect::to("/login").into_response();
+    }
+    Html(ui::render_password_page(Nav::new(&headers, ""))).into_response()
 }
 
-pub(crate) async fn set_initial_password(
+pub(crate) async fn change_password(
     State(state): State<AppState>,
     headers: HeaderMap,
-    Form(input): Form<InitialPasswordInput>,
+    Form(input): Form<ChangePasswordInput>,
 ) -> Response {
     if let Some(rejection) = reject_cross_site(&headers) {
         return rejection;
     }
-    let username = input.username.trim();
-    if !matches!(username, "admin" | "superadmin") {
-        return error(
-            StatusCode::UNPROCESSABLE_ENTITY,
-            "Only the bootstrap admin or superadmin account can be claimed here.",
-        );
-    }
+    let request = match authenticated_request(&headers, ChangePasswordRequest {
+        current_password: input.current_password,
+        new_password: input.new_password,
+        new_password_confirmation: input.new_password_confirmation,
+    }) {
+        Ok(request) => request,
+        Err(_) => return axum::response::Redirect::to("/login").into_response(),
+    };
     let mut auth = state.auth;
-    match auth
-        .set_initial_password(tonic::Request::new(SetInitialPasswordRequest {
-            username: username.to_string(),
-            password: input.password,
-            password_confirmation: input.password_confirmation,
-        }))
-        .await
-    {
-        Ok(_) => {
-            let mut response = StatusCode::SEE_OTHER.into_response();
-            response.headers_mut().insert(
-                header::LOCATION,
-                HeaderValue::from_static("/login?initial_password_set=1"),
-            );
-            response.headers_mut().insert(
-                "hx-redirect",
-                HeaderValue::from_static("/login?initial_password_set=1"),
-            );
-            response
-        }
+    match auth.change_password(request).await {
+        Ok(_) => Html(ui::render_password_success()).into_response(),
         Err(status) => (
             StatusCode::UNPROCESSABLE_ENTITY,
-            Html(ui::render_initial_password_error(status.message())),
+            Html(ui::render_password_error(status.message())),
         )
             .into_response(),
     }

web/src/pages/login/mod.rs

@@ -14,8 +14,5 @@ pub(crate) mod ui;
 pub(crate) fn router() -> Router<AppState> {
     Router::new()
         .route("/login", get(logic::login_page).post(logic::login))
-        .route(
-            "/initial-password",
-            get(logic::initial_password_page).post(logic::set_initial_password),
-        )
+        .route("/password", get(logic::password_page).post(logic::change_password))
 }

web/src/pages/login/state.rs

@@ -5,15 +5,10 @@ pub(crate) struct LoginInput {
     pub password: String,
 }
 
-#[derive(Default, serde::Deserialize)]
-pub(crate) struct LoginQuery {
-    #[serde(default)]
-    pub initial_password_set: bool,
-}
-
 #[derive(serde::Deserialize)]
-pub(crate) struct InitialPasswordInput {
-    pub username: String,
-    pub password: String,
-    pub password_confirmation: String,
+pub(crate) struct ChangePasswordInput {
+    #[serde(default)]
+    pub current_password: String,
+    pub new_password: String,
+    pub new_password_confirmation: String,
 }

web/src/pages/login/ui.rs

@@ -7,17 +7,10 @@ use crate::ui::{Alert, Nav, render};
 #[template(path = "pages/login/login.html")]
 struct LoginPage {
     nav: Nav,
-    initial_password_set: bool,
 }
 
-pub(crate) fn render_page(
-    nav: Nav,
-    initial_password_set: bool,
-) -> String {
-    render(&LoginPage {
-        nav,
-        initial_password_set,
-    })
+pub(crate) fn render_page(nav: Nav) -> String {
+    render(&LoginPage { nav })
 }
 
 /// POST /login — the #login-status swap when the credentials are rejected.
@@ -26,15 +19,19 @@ pub(crate) fn render_error(message: &str) -> String {
 }
 
 #[derive(Template)]
-#[template(path = "pages/login/initial_password.html")]
-struct InitialPasswordPage {
+#[template(path = "pages/login/password.html")]
+struct PasswordPage {
     nav: Nav,
 }
 
-pub(crate) fn render_initial_password_page(nav: Nav) -> String {
-    render(&InitialPasswordPage { nav })
+pub(crate) fn render_password_page(nav: Nav) -> String {
+    render(&PasswordPage { nav })
 }
 
-pub(crate) fn render_initial_password_error(message: &str) -> String {
-    render(&Alert::error("Could not claim the bootstrap account", message))
+pub(crate) fn render_password_error(message: &str) -> String {
+    render(&Alert::error("Could not change password", message))
+}
+
+pub(crate) fn render_password_success() -> String {
+    render(&Alert::success("Password changed", "Your new password is active."))
 }

web/templates/pages/admin/permissions/permissions.html

@@ -13,7 +13,7 @@
     <div class="actions"><a href="/admin">← Admin panel</a></div>
   </section>
 
-  {% if page.updated %}<p class="notice">Authorization updated. The current session remains valid and all subsequent requests use the new policy.</p>{% endif %}
+  {% if page.updated %}<p class="notice">Administration updated. The current session remains valid and all subsequent requests use the new state.</p>{% endif %}
 
   {% if page.can_manage_roles %}
   <section class="panel">
@@ -84,7 +84,7 @@
   <section class="panel">
     <h2>Users</h2>
     <table class="builder-table">
-      <thead><tr><th>Username</th><th>Email</th><th>Current role</th><th>Assign role</th></tr></thead>
+      <thead><tr><th>Username</th><th>Email</th><th>Current role</th><th>Assign role</th><th>Reset password</th></tr></thead>
       <tbody>{% for user in page.users %}<tr>
         <td>{{ user.username }}</td><td>{{ user.email }}</td><td>{{ user.role }}</td>
         <td><form hx-post="/admin/permissions/users/role" hx-target="#permission-status" class="actions">
@@ -92,6 +92,12 @@
           <select name="role">{% for role in page.assignable_roles() %}<option value="{{ role.name }}" {% if user.role == role.name %}selected{% endif %}>{{ role.name }}</option>{% endfor %}</select>
           <button type="submit">Assign</button>
         </form></td>
+        <td>{% if page.can_reset_password(user) %}<form hx-post="/admin/permissions/users/password" hx-target="#permission-status" class="actions">
+          <input type="hidden" name="username" value="{{ user.username }}">
+          <input name="new_password" type="password" autocomplete="new-password" placeholder="New password" required>
+          <input name="new_password_confirmation" type="password" autocomplete="new-password" placeholder="Confirm password" required>
+          <button type="submit">Reset</button>
+        </form>{% endif %}</td>
       </tr>{% endfor %}</tbody>
     </table>
   </section>

web/templates/pages/login/initial_password.html

@@ -1,20 +0,0 @@
-{% extends "ui/base.html" %}
-
-{% block title %}Claim administrator{% endblock %}
-
-{% block content %}
-<main class="login-main">
-  <form class="login-card" hx-post="/initial-password" hx-target="#initial-password-status" hx-swap="innerHTML" hx-disabled-elt="button" novalidate>
-    <h1>Claim bootstrap administrator</h1>
-    <p class="hint">This works once for a fresh passwordless <code>admin</code> or <code>superadmin</code> account.</p>
-    <label>Account
-      <select name="username"><option value="admin">admin</option><option value="superadmin">superadmin</option></select>
-    </label>
-    <label>Password<input name="password" type="password" autocomplete="new-password" required></label>
-    <label>Confirm password<input name="password_confirmation" type="password" autocomplete="new-password" required></label>
-    <button type="submit">Set initial password</button>
-    <p class="login-alt"><a href="/login">Back to sign in</a></p>
-    <div id="initial-password-status" aria-live="polite"></div>
-  </form>
-</main>
-{% endblock %}

web/templates/pages/login/login.html

@@ -8,12 +8,10 @@
   <form class="login-card" hx-post="/login" hx-target="#login-status" hx-swap="innerHTML"
         hx-disabled-elt="button" novalidate>
     <h1>Sign in</h1>
-    {% if initial_password_set %}<p class="notice">The initial password was set. You can sign in now.</p>{% endif %}
     <label>Username or email<input name="identifier" autocomplete="username"></label>
     <label>Password <span>(optional)</span><input name="password" type="password" autocomplete="current-password"></label>
     <button type="submit">Login</button>
     <p class="login-alt">No account yet? <a href="/register">Register</a></p>
-    <p class="login-alt">Fresh installation? <a href="/initial-password">Claim a bootstrap administrator</a></p>
     <div id="login-status" aria-live="polite"></div>
   </form>
 </main>

web/templates/pages/login/password.html

@@ -0,0 +1,17 @@
+{% extends "ui/base.html" %}
+
+{% block title %}Change password{% endblock %}
+
+{% block content %}
+<main class="login-main">
+  <form class="login-card" hx-post="/password" hx-target="#password-status" hx-swap="innerHTML" hx-disabled-elt="button" novalidate>
+    <h1>Change password</h1>
+    <p class="hint">For a freshly seeded admin or superadmin account, leave the current password empty.</p>
+    <label>Current password<input name="current_password" type="password" autocomplete="current-password"></label>
+    <label>New password<input name="new_password" type="password" autocomplete="new-password" required></label>
+    <label>Confirm new password<input name="new_password_confirmation" type="password" autocomplete="new-password" required></label>
+    <button type="submit">Change password</button>
+    <div id="password-status" aria-live="polite"></div>
+  </form>
+</main>
+{% endblock %}

web/templates/ui/navbar.html

@@ -27,6 +27,7 @@
 		{% if nav.can_import %}<li><a href="/admin/import" class="font-medium text-on-surface underline-offset-2 hover:text-primary focus:outline-hidden focus:underline dark:text-on-surface-dark dark:hover:text-primary-dark">Import</a></li>{% endif %}
 		{% if nav.can_export %}<li><a href="/admin/export" class="font-medium text-on-surface underline-offset-2 hover:text-primary focus:outline-hidden focus:underline dark:text-on-surface-dark dark:hover:text-primary-dark">Export</a></li>{% endif %}
 		{% if nav.authenticated %}
+			<li><a href="/password" class="font-medium text-on-surface underline-offset-2 hover:text-primary focus:outline-hidden focus:underline dark:text-on-surface-dark dark:hover:text-primary-dark">Password</a></li>
 			<li><form hx-post="/logout" hx-swap="none"><button type="submit" class="font-medium text-on-surface underline-offset-2 hover:text-primary focus:outline-hidden focus:underline dark:text-on-surface-dark dark:hover:text-primary-dark">Log out</button></form></li>
 		{% else %}
 			<li><a href="/login" class="{% if nav.active == "login" %}font-bold text-primary dark:text-primary-dark{% else %}font-medium text-on-surface dark:text-on-surface-dark dark:hover:text-primary-dark{% endif %} underline-offset-2 hover:text-primary focus:outline-hidden focus:underline" {% if nav.active == "login" %}aria-current="page"{% endif %}>Login</a></li>
@@ -49,6 +50,7 @@
 		{% if nav.can_import %}<li class="py-4"><a href="/admin/import" class="w-full text-lg font-medium text-on-surface focus:underline dark:text-on-surface-dark">Import</a></li>{% endif %}
 		{% if nav.can_export %}<li class="py-4"><a href="/admin/export" class="w-full text-lg font-medium text-on-surface focus:underline dark:text-on-surface-dark">Export</a></li>{% endif %}
 		{% if nav.authenticated %}
+			<li class="py-4"><a href="/password" class="w-full text-lg font-medium text-on-surface focus:underline dark:text-on-surface-dark">Password</a></li>
 			<li class="py-4"><form hx-post="/logout" hx-swap="none"><button type="submit" class="w-full text-left text-lg font-medium text-on-surface focus:underline dark:text-on-surface-dark">Log out</button></form></li>
 		{% else %}
 			<li class="py-4"><a href="/login" class="w-full text-lg {% if nav.active == "login" %}font-bold text-primary dark:text-primary-dark{% else %}font-medium text-on-surface dark:text-on-surface-dark{% endif %} focus:underline" {% if nav.active == "login" %}aria-current="page"{% endif %}>Login</a></li>