pws reset

web/src/pages/admin/permissions/logic.rs

@@ -9,14 +9,17 @@ use crate::{
     AppState,
     auth::{
         AddRoleRequest, AssignUserRoleRequest, GrantPermissionRequest, RemoveRoleRequest,
-        RevokePermissionRequest,
+        ResetUserPasswordRequest, RevokePermissionRequest,
     },
     services::{authenticated_request, reject_cross_site},
 };
 
 use super::{
     loader,
-    state::{AddRoleForm, AssignRoleForm, LoadError, PermissionForm, RoleForm, Selection},
+    state::{
+        AddRoleForm, AssignRoleForm, LoadError, PermissionForm, ResetPasswordForm, RoleForm,
+        Selection,
+    },
     ui,
 };
 
@@ -123,6 +126,29 @@ pub(crate) async fn assign_user_role(
     }).await
 }
 
+pub(crate) async fn reset_user_password(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Form(form): Form<ResetPasswordForm>,
+) -> Response {
+    let destination = "/admin/permissions?updated=true";
+    let request_headers = headers.clone();
+    mutate(&headers, destination, async move {
+        let mut auth = state.auth;
+        auth.reset_user_password(authenticated_request(
+            &request_headers,
+            ResetUserPasswordRequest {
+                username: form.username,
+                new_password: form.new_password,
+                new_password_confirmation: form.new_password_confirmation,
+            },
+        ).map_err(|_| "Missing session".to_string())?)
+            .await
+            .map_err(|error| error.message().to_string())?;
+        Ok(())
+    }).await
+}
+
 async fn mutate<F>(headers: &HeaderMap, destination: &str, operation: F) -> Response
 where
     F: std::future::Future<Output = Result<(), String>>,

web/src/pages/admin/permissions/mod.rs

@@ -15,4 +15,5 @@ pub(crate) fn router() -> Router<AppState> {
         .route("/admin/permissions/grant", post(logic::grant))
         .route("/admin/permissions/revoke", post(logic::revoke))
         .route("/admin/permissions/users/role", post(logic::assign_user_role))
+        .route("/admin/permissions/users/password", post(logic::reset_user_password))
 }

web/src/pages/admin/permissions/state.rs

@@ -33,6 +33,13 @@ pub(crate) struct AssignRoleForm {
     pub role: String,
 }
 
+#[derive(Clone, Debug, Default, serde::Deserialize)]
+pub(crate) struct ResetPasswordForm {
+    pub username: String,
+    pub new_password: String,
+    pub new_password_confirmation: String,
+}
+
 pub(crate) struct PermissionPageState {
     pub nav: crate::ui::Nav,
     pub roles: Vec<Role>,
@@ -78,6 +85,14 @@ impl PermissionPageState {
             .find(|role| role.name == self.selected_role)
             .is_some_and(|role| !role.built_in && role.kind == "data")
     }
+
+    pub(crate) fn can_reset_password(&self, user: &UserSummary) -> bool {
+        match self.nav.role.as_str() {
+            "superadmin" => user.role != "superadmin",
+            "admin" => !matches!(user.role.as_str(), "superadmin" | "admin"),
+            _ => false,
+        }
+    }
 }
 
 pub(crate) enum LoadError {

web/src/pages/login/logic.rs

@@ -1,68 +1,55 @@
 use axum::{
     Form,
-    extract::{Query, State},
+    extract::State,
     http::{HeaderMap, HeaderValue, StatusCode, header},
     response::{Html, IntoResponse, Response},
 };
 use tonic::Request;
 
-use crate::{AppState, auth::{LoginRequest, SetInitialPasswordRequest}, services::reject_cross_site, ui::Nav};
+use crate::{
+    AppState,
+    auth::{ChangePasswordRequest, LoginRequest},
+    services::{authenticated_request, reject_cross_site},
+    ui::Nav,
+};
 
-use super::{state::{InitialPasswordInput, LoginInput, LoginQuery}, ui};
+use super::{state::{ChangePasswordInput, LoginInput}, ui};
 
 pub(crate) async fn login_page(
     headers: HeaderMap,
-    Query(query): Query<LoginQuery>,
 ) -> Html<String> {
-    Html(ui::render_page(
-        Nav::new(&headers, "login"),
-        query.initial_password_set,
-    ))
+    Html(ui::render_page(Nav::new(&headers, "login")))
 }
 
-pub(crate) async fn initial_password_page(headers: HeaderMap) -> Html<String> {
-    Html(ui::render_initial_password_page(Nav::new(&headers, "login")))
+pub(crate) async fn password_page(headers: HeaderMap) -> Response {
+    if authenticated_request(&headers, ()).is_err() {
+        return axum::response::Redirect::to("/login").into_response();
+    }
+    Html(ui::render_password_page(Nav::new(&headers, ""))).into_response()
 }
 
-pub(crate) async fn set_initial_password(
+pub(crate) async fn change_password(
     State(state): State<AppState>,
     headers: HeaderMap,
-    Form(input): Form<InitialPasswordInput>,
+    Form(input): Form<ChangePasswordInput>,
 ) -> Response {
     if let Some(rejection) = reject_cross_site(&headers) {
         return rejection;
     }
-    let username = input.username.trim();
-    if !matches!(username, "admin" | "superadmin") {
-        return error(
-            StatusCode::UNPROCESSABLE_ENTITY,
-            "Only the bootstrap admin or superadmin account can be claimed here.",
-        );
-    }
+    let request = match authenticated_request(&headers, ChangePasswordRequest {
+        current_password: input.current_password,
+        new_password: input.new_password,
+        new_password_confirmation: input.new_password_confirmation,
+    }) {
+        Ok(request) => request,
+        Err(_) => return axum::response::Redirect::to("/login").into_response(),
+    };
     let mut auth = state.auth;
-    match auth
-        .set_initial_password(tonic::Request::new(SetInitialPasswordRequest {
-            username: username.to_string(),
-            password: input.password,
-            password_confirmation: input.password_confirmation,
-        }))
-        .await
-    {
-        Ok(_) => {
-            let mut response = StatusCode::SEE_OTHER.into_response();
-            response.headers_mut().insert(
-                header::LOCATION,
-                HeaderValue::from_static("/login?initial_password_set=1"),
-            );
-            response.headers_mut().insert(
-                "hx-redirect",
-                HeaderValue::from_static("/login?initial_password_set=1"),
-            );
-            response
-        }
+    match auth.change_password(request).await {
+        Ok(_) => Html(ui::render_password_success()).into_response(),
         Err(status) => (
             StatusCode::UNPROCESSABLE_ENTITY,
-            Html(ui::render_initial_password_error(status.message())),
+            Html(ui::render_password_error(status.message())),
         )
             .into_response(),
     }

web/src/pages/login/mod.rs

@@ -14,8 +14,5 @@ pub(crate) mod ui;
 pub(crate) fn router() -> Router<AppState> {
     Router::new()
         .route("/login", get(logic::login_page).post(logic::login))
-        .route(
-            "/initial-password",
-            get(logic::initial_password_page).post(logic::set_initial_password),
-        )
+        .route("/password", get(logic::password_page).post(logic::change_password))
 }

web/src/pages/login/state.rs

@@ -5,15 +5,10 @@ pub(crate) struct LoginInput {
     pub password: String,
 }
 
-#[derive(Default, serde::Deserialize)]
-pub(crate) struct LoginQuery {
-    #[serde(default)]
-    pub initial_password_set: bool,
-}
-
 #[derive(serde::Deserialize)]
-pub(crate) struct InitialPasswordInput {
-    pub username: String,
-    pub password: String,
-    pub password_confirmation: String,
+pub(crate) struct ChangePasswordInput {
+    #[serde(default)]
+    pub current_password: String,
+    pub new_password: String,
+    pub new_password_confirmation: String,
 }

web/src/pages/login/ui.rs

@@ -7,17 +7,10 @@ use crate::ui::{Alert, Nav, render};
 #[template(path = "pages/login/login.html")]
 struct LoginPage {
     nav: Nav,
-    initial_password_set: bool,
 }
 
-pub(crate) fn render_page(
-    nav: Nav,
-    initial_password_set: bool,
-) -> String {
-    render(&LoginPage {
-        nav,
-        initial_password_set,
-    })
+pub(crate) fn render_page(nav: Nav) -> String {
+    render(&LoginPage { nav })
 }
 
 /// POST /login — the #login-status swap when the credentials are rejected.
@@ -26,15 +19,19 @@ pub(crate) fn render_error(message: &str) -> String {
 }
 
 #[derive(Template)]
-#[template(path = "pages/login/initial_password.html")]
-struct InitialPasswordPage {
+#[template(path = "pages/login/password.html")]
+struct PasswordPage {
     nav: Nav,
 }
 
-pub(crate) fn render_initial_password_page(nav: Nav) -> String {
-    render(&InitialPasswordPage { nav })
+pub(crate) fn render_password_page(nav: Nav) -> String {
+    render(&PasswordPage { nav })
 }
 
-pub(crate) fn render_initial_password_error(message: &str) -> String {
-    render(&Alert::error("Could not claim the bootstrap account", message))
+pub(crate) fn render_password_error(message: &str) -> String {
+    render(&Alert::error("Could not change password", message))
+}
+
+pub(crate) fn render_password_success() -> String {
+    render(&Alert::success("Password changed", "Your new password is active."))
 }