weichen/Agent-System-Frontend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Wire login recovery flow: redeem key entry and restricted set-password gate

Browse Source 
Why: The 2026-10-13 login contract makes username/password the default
login, replaces the browser ask_ tab with a one-time recovery key
entry, requires the forced set-password gate to drop the current
password field, and routes admin password recovery through admin-issued
login keys instead of direct password resets.

Evidence: vitest 218 passed, npm run build OK, check-knip 43<=43,
design-guard green (SELF, local run in task worktree).

Impact: LoginPage gains a redeem-only key tab (no key persistence);
ChangePasswordGate shows server-confirmed owner plus new/confirm only
and returns to the login page after success (reloginRequired); App
gates on sessionScope=set_password_only; UsersPanel replaces reset
password with issue/revoke login key UI showing plaintext once.

Refs: Dev task feature/svc-login-recovery-flow; backend companion
commit 467718a.
This commit is contained in:
weichen
2026-10-13 03:42:23 +00:00
parent dcd2699933
commit 9fc7da2ace
6 changed files with 186 additions and 82 deletions
Download Patch File Download Diff File Expand all files Collapse all files
e2e/changepw-form.playwright.ts
+8 -3
View File
@@ -20,11 +20,16 @@ async function login(page: Page) {
const gate = page.getByText('修改密码')
const gated = await gate.waitFor({ state: 'visible', timeout: 5_000 }).then(() => true).catch(() => false)
if (gated) {
// 受限设密门（2026-10-13 合同）：只有新密码/确认两框，无当前密码输入。
const pwInputs = page.locator('.lg-card input[type="password"]')
await pwInputs.nth(0).fill(PASSWORD)
await pwInputs.nth(0).fill(PASSWORD2)
await pwInputs.nth(1).fill(PASSWORD2)
await pwInputs.nth(2).fill(PASSWORD2)
await page.getByRole('button', { name: '设置新密码并进入' }).click()
await page.getByRole('button', { name: '设置新密码', exact: true }).click()
// 设密成功后服务端销毁会话：完成页唯一出口是回密码登录页重新登录。
await page.getByRole('button', { name: '返回登录' }).click()
await page.getByPlaceholder('由管理员分配').fill(OWNER)
await page.getByPlaceholder('初始密码或常用密码').fill(PASSWORD2)
await page.getByRole('button', { name: '登录', exact: true }).click()
} else {
await page.getByPlaceholder('初始密码或常用密码').fill(PASSWORD2)
await page.getByRole('button', { name: '登录', exact: true }).click()