Skip to content

[login] Rework reset password functionality#10977

Open
HachemJ wants to merge 11 commits into
aces:mainfrom
HachemJ:ReworkResetPasswordFunctionality
Open

[login] Rework reset password functionality#10977
HachemJ wants to merge 11 commits into
aces:mainfrom
HachemJ:ReworkResetPasswordFunctionality

Conversation

@HachemJ

@HachemJ HachemJ commented Jul 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Brief summary of changes

This PR redesigns the password reset workflow by removing the legacy password expiration mechanism and replacing it with a token lifecycle managed through user_password_reset.

Changes

  • Remove PasswordChangeRequired from the schema and backend.
  • Add the new password reset database patch.
  • Introduce token states (NULL, Used, Superseded).
  • Make token validity depend on creation time (20-minute window).
  • Limit users to three active reset tokens.
  • Mark successfully used tokens as Used and invalidate remaining active tokens as Superseded.
  • Refactor the backend to use the new reset flow.
  • Update frontend password reset behaviour and messaging.
  • Remove obsolete password expiration logic.
  • Update tests, fixtures, and helper utilities.

Testing instructions (if applicable)

@github-actions github-actions Bot added Language: SQL PR or issue that update SQL code RaisinBread PR or issue introducing/requiring improvements to the Raidinbread dataset Language: PHP PR or issue that update PHP code Language: Javascript PR or issue that update Javascript code Module: dashboard PR or issue related to dashboard module Module: login PR or issue related to login module Module: user_accounts PR or issue related to the user_accounts module Multilingual Any tasks related to making LORIS multilingual labels Jul 22, 2026
@driusan

driusan commented Jul 22, 2026

Copy link
Copy Markdown
Collaborator

@HachemJ Can you send this to main instead of 29? I think it's too late in the release testing to incorporate a change this significant

@HachemJ

HachemJ commented Jul 22, 2026

Copy link
Copy Markdown
Contributor Author

@HachemJ Can you send this to main instead of 29? I think it's too late in the release testing to incorporate a change this significant

Sure

@HachemJ
HachemJ force-pushed the ReworkResetPasswordFunctionality branch from bebd151 to b7f347a Compare July 22, 2026 16:24
@github-actions github-actions Bot added Module: statistics PR or issue related to statistics module Module: issue_tracker PR or issue related to issue tracker module Module: dqt PR or issue related to (old) dqt module Module: acknowledgements PR or issue related to acknowledgements module Module: api PR or issue related to api module Module: api_docs PR or issue related to api_docs module labels Jul 22, 2026
@HachemJ
HachemJ changed the base branch from 29.0-release to main July 22, 2026 16:25
@github-actions github-actions Bot added Module: battery_manager PR or issue related to battery_manager module Module: behavioural_qc PR or issue related behavioural_qc module Module: brainbrowser PR or issue related to brainbrowser module Module: bvl_feedback PR or issue related to bvl_feedback module Module: candidate_list PR or issue related to candidate_list module Module: candidate_parameters PR or issue related to candidate_parameters module Module: candidate_profile PR or issue related to candidate_profile module Module: configuration PR or issue related to configuration module Module: conflict_resolver PR or issue related to conflict_resolver module Module: create_timepoint PR or issue related to create_timepoint module Module: datadict PR or issue related to (old) datadict module Module: dictionary PR or issue related to (new) dictionary module labels Jul 22, 2026
@github-actions github-actions Bot added Module: schedule_module PR or issue related to the schedule_manager module Module: server_processes_manager PR or issue related to the server_processes_manger Module: survey_accounts PR or issue related to the survey_accounts module Module: timepoint_list PR or issue related to the timepoint_list module Module: dicom_archive PR or issue related to dicom_archive module Module: data_release PR or issue related to data_release module Module: dataquery PR or issue related to (new) dataquery module Module: redcap PR or issue related to redcap module labels Jul 22, 2026
HachemJ added 11 commits July 22, 2026 12:37
@HachemJ
rework reset password functionality to send reset link instead
0d962a3
@HachemJ
run DB_dump_table_data.php script to export changes to raisinbread
2c4e2e9
@HachemJ
adapt test plans to changes, add error message on frontend when link …
3124c4f 
…is expired or invalid, change query to find count directly instead of using count function on array and reset ALL valid reset tokens when the password was successfully updated
@HachemJ
drop new user_password_reset table that depends on the users table be…
a4563fc 
…fore it
@HachemJ
add info to TestPlan.md, Clean up expired tokens when forgot password…
a81a07c 
… form is submitted, clean up expired token when reset password form is submitted if older than 20 minutes
@HachemJ
replace active flag with status enum('Used', 'Superseded') instead
faabe86
@HachemJ
cleanup
e02cd9e
@HachemJ
more cleanup
1c483ce
@HachemJ
remove non relevant code since rework
ebe94e1
@HachemJ
fix failing tests
3ca3504
@HachemJ
refactor hardcoded numbers into constants and fix php and js lint
0f013da
@HachemJ
HachemJ force-pushed the ReworkResetPasswordFunctionality branch from b7f347a to 0f013da Compare July 22, 2026 16:38
@HachemJ HachemJ removed Module: statistics PR or issue related to statistics module Module: issue_tracker PR or issue related to issue tracker module Module: dqt PR or issue related to (old) dqt module Module: acknowledgements PR or issue related to acknowledgements module Module: api PR or issue related to api module Module: api_docs PR or issue related to api_docs module Module: battery_manager PR or issue related to battery_manager module Module: behavioural_qc PR or issue related behavioural_qc module Module: brainbrowser PR or issue related to brainbrowser module Module: bvl_feedback PR or issue related to bvl_feedback module labels Jul 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

Language: Javascript PR or issue that update Javascript code Language: PHP PR or issue that update PHP code Language: SQL PR or issue that update SQL code Module: login PR or issue related to login module Multilingual Any tasks related to making LORIS multilingual RaisinBread PR or issue introducing/requiring improvements to the Raidinbread dataset

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@HachemJ @driusan