From ea523b8c3789e43d7a7a90b60f9c2b7a72ff89f6 Mon Sep 17 00:00:00 2001 From: Bryan Van Deusen Date: Thu, 8 Oct 2026 20:14:45 -0400 Subject: [PATCH] feat(account): change your own password on the Account page (milestone 497) Step #5428 "Account page: change your own password" of milestone 497 "Passwords: change your own, and reset it by email". A Password section in the page's one form, for local accounts: current, new, again. Blank keeps the password; a new one signs out every other browser (sessions_since) and keeps this one. A wrong current password counts toward the login throttle. Audited as account.password_changed. Co-Authored-By: Claude Opus 5.5 --- steward/account/routes.py | 65 +++++++++-- steward/audit/service.py | 3 + steward/templates/account/index.html | 30 ++++- tests/integration/test_account_time_zone.py | 2 +- tests/integration/test_passwords.py | 115 ++++++++++++++++++++ 5 files changed, 204 insertions(+), 11 deletions(-) create mode 100644 tests/integration/test_passwords.py diff --git a/steward/account/routes.py b/steward/account/routes.py index 557ee8e..2fc2aa9 100644 --- a/steward/account/routes.py +++ b/steward/account/routes.py @@ -1,8 +1,13 @@ """The signed-in user's own account (milestone 490): the time zone every -page writes its times in, and their email (milestone 495). Any role reaches -it, for themselves only.""" +page writes its times in, their email (milestone 495) and, for a local +account, their password (milestone 497). Any role reaches it, for +themselves only.""" from __future__ import annotations +import time +from datetime import datetime, timezone + +import bcrypt from quart import Blueprint, abort, current_app, redirect, render_template, request, session from steward.auth.middleware import require_role @@ -14,6 +19,38 @@ account_bp = Blueprint("account", __name__, url_prefix="/account") _SOURCES = {"local": "a Steward password", "ldap": "LDAP", "oidc": "single sign-on"} +def _password_matches(user: User, password: str) -> bool: + try: + return bcrypt.checkpw(password.encode(), user.password_hash.encode()) + except ValueError: # not a bcrypt hash: no password matches it + return False + + +def _change_password(user: User, form) -> bool: + """Apply the Password section: False when it was left blank, True when the + password changed; ValueError says why it can't. Every other browser signed + in as this account is signed out (#5427).""" + from steward.auth.throttle import login_throttle + from steward.core.proxy import client_ip + from steward.settings.users import _hash, password_problem + new = form.get("new_password") or "" + if not new or user.auth_source != "local": + return False + ip = client_ip() + if login_throttle.retry_after(ip, current_app.config.get("LOGIN_MAX_FAILURES", 5), + current_app.config.get("LOGIN_LOCKOUT_MINUTES", 15) * 60): + raise ValueError("Too many wrong passwords from this address. Try again later.") + if not _password_matches(user, form.get("current_password") or ""): + login_throttle.failed(ip) + raise ValueError("Your current password isn't right, so nothing was saved.") + problem = password_problem(new, form.get("new_confirm") or "") + if problem: + raise ValueError(problem) + user.password_hash = _hash(new) + user.sessions_since = datetime.now(timezone.utc) + return True + + async def _me(db) -> User: # A share link opens widgets read-only; it has no account. user_id = session.get("user_id") @@ -39,15 +76,25 @@ async def account(error: str | None = None, status: int = 200): "account/index.html", user=user, source=_SOURCES.get(user.auth_source, user.auth_source), zone_name=zone_name, zone_title=zone_name.split("/", 1)[-1].replace("_", " "), zone_label=formatting.tz_label(tz), zones=formatting.zones_by_region(), - defaults=defaults, error=error), status + defaults=defaults, error=error, min_password=_min_password(), + done=_DONE.get(request.args.get("done", ""))), status + + +_DONE = {"saved": "Saved.", + "password": "Saved. Your password is changed; anywhere else you were signed in, you're signed out."} + + +def _min_password() -> int: + from steward.settings.users import MIN_PASSWORD + return MIN_PASSWORD @account_bp.post("/") @require_role(UserRole.viewer) async def account_save(): - """The page's one form: your time zone, your address and whether you're - emailed alerts and the weekly report (milestone 495). Nothing is saved - unless all of it is valid.""" + """The page's one form: your time zone, your address, whether you're + emailed alerts and the weekly report (milestone 495), and a new password + (milestone 497). Nothing is saved unless all of it is valid.""" from sqlalchemy.exc import IntegrityError from steward.core.audit import log_audit from steward.core.mail import apply_email_form @@ -64,17 +111,21 @@ async def account_save(): raise ValueError(error) before = user.time_zone user.time_zone = name + password_changed = _change_password(user, form) except ValueError as exc: return await account(str(exc), 400) except IntegrityError: return await account("Another account already uses that address.", 400) session["tz"] = name + if password_changed: + session["login_at"] = time.time() # this session carries on under the new password + await log_audit(current_app, user.id, user.username, "account.password_changed") if before != name: await log_audit(current_app, user.id, user.username, "account.time_zone", detail={"time_zone": name, "was": before or "UTC"}) if changes: await log_audit(current_app, user.id, user.username, "account.email", detail=changes) - return redirect("/account/") + return redirect("/account/?done=" + ("password" if password_changed else "saved")) @account_bp.post("/time-zone/adopt") diff --git a/steward/audit/service.py b/steward/audit/service.py index ceaf61a..67c4f72 100644 --- a/steward/audit/service.py +++ b/steward/audit/service.py @@ -120,6 +120,9 @@ ACTIONS = { "auth.setup": "set up Steward", "account.time_zone": "set their time zone", "account.email": "changed their email settings", + "account.password_changed": "changed their password", + "user.password_reset_requested": "asked for a password reset email", + "user.password_reset_by_email": "reset their password from an emailed link", "user.created": "added user", "user.renamed": "renamed user", "user.role_changed": "changed the role of user", diff --git a/steward/templates/account/index.html b/steward/templates/account/index.html index 852c3d9..beeecb7 100644 --- a/steward/templates/account/index.html +++ b/steward/templates/account/index.html @@ -1,6 +1,7 @@ {# account/index.html — the signed-in user's own account (milestone 490): who - they are, the time zone every page writes its times in, and their email - (milestone 495). One form, one Save. #} + they are, the time zone every page writes its times in, their email + (milestone 495) and a local account's password (milestone 497). One form, + one Save. #} {% extends "base.html" %} {% from "_macros.html" import page_header, zone_select %} {% from "account/_email_choices.html" import email_section with context %} @@ -13,7 +14,8 @@ · times show in {{ zone_title }} ({{ zone_label }})

-{% if error %}{% endif %} +{% if error %} +{% elif done %}
{{ done }}
{% endif %}
{{ csrf_field() }}
@@ -27,6 +29,28 @@ {{ email_section(user, defaults, "your time zone") }} +
+

Password

+ {% if user.auth_source == "local" %} +

Leave these empty to keep your password. A new one signs you out everywhere else you're signed in.

+
+ + +
+
+ + + At least {{ min_password }} characters. +
+
+ + +
+ {% else %} +

You sign in with {{ source }}, so your password is changed there, not in Steward.

+ {% endif %} +
+
{% endblock %} diff --git a/tests/integration/test_account_time_zone.py b/tests/integration/test_account_time_zone.py index 3297b13..cf2c88b 100644 --- a/tests/integration/test_account_time_zone.py +++ b/tests/integration/test_account_time_zone.py @@ -76,7 +76,7 @@ def test_the_browser_zone_is_adopted_once_and_the_account_page_changes_it(app): assert "times show in New York (E" in page # EDT or EST assert '' in page assert "/account/time-zone/adopt" not in page # nothing left to adopt - assert out["save"] == (302, "/account/") and out["after_save"] == "Europe/London" + assert out["save"] == (302, "/account/?done=saved") and out["after_save"] == "Europe/London" status, body = out["refused"] assert status == 400 and "Nowhere is not a time zone Steward knows." in body assert out["after_refused"] == "Europe/London" and out["session_tz"] == "Europe/London" diff --git a/tests/integration/test_passwords.py b/tests/integration/test_passwords.py new file mode 100644 index 0000000..cc4e1ed --- /dev/null +++ b/tests/integration/test_passwords.py @@ -0,0 +1,115 @@ +"""Integration: local users manage their own password (milestone 497): change +it on the Account page, or reset it from an emailed link. The routes run +for real against Postgres; only mail delivery is replaced.""" +from __future__ import annotations + +import asyncio +import json +import os +import time +import uuid + +import bcrypt +import pytest + +pytestmark = pytest.mark.integration + +CSRF = {"X-CSRF-Token": "test-token"} + + +@pytest.fixture +def app(): + if not os.environ.get("STEWARD_DATABASE_URL"): + pytest.skip("needs Postgres") + from steward.app import create_app + from steward.auth.throttle import login_throttle + login_throttle._failures.clear() # wrong passwords below count against this address + app = create_app(testing=False) + yield app + login_throttle._failures.clear() + + +async def _local(app, password="old password", source="local"): + """A local account with a real password, and a browser signed in as it.""" + from steward.models.users import User, UserRole + uid = str(uuid.uuid4()) + name = f"pw-{uid[:8]}" + async with app.db_sessionmaker() as s: + async with s.begin(): + s.add(User(id=uid, username=name, email=f"{name}@example.com", role=UserRole.viewer, + password_hash=bcrypt.hashpw(password.encode(), bcrypt.gensalt()).decode(), + is_active=True, auth_source=source, time_zone="Europe/London")) + return uid, name, await _signed_in(app, uid, name) + + +async def _signed_in(app, uid, name, ago=60): + client = app.test_client() + async with client.session_transaction() as sess: + sess.update(user_id=uid, user_role="viewer", username=name, _csrf="test-token", + login_at=time.time() - ago) + return client + + +async def _user(app, uid): + from steward.models.users import User + async with app.db_sessionmaker() as s: + return await s.get(User, uid) + + +async def _audits(app, uid): + from sqlalchemy import select + from steward.models.audit import AuditEvent + async with app.db_sessionmaker() as s: + rows = (await s.execute(select(AuditEvent).where(AuditEvent.user_id == uid) + .order_by(AuditEvent.timestamp))).scalars().all() + return [(r.action, json.loads(r.detail_json or "{}")) for r in rows] + + +def _checks(user, password): + return bcrypt.checkpw(password.encode(), user.password_hash.encode()) + + +def test_a_local_user_changes_their_password_and_their_other_browsers_sign_out(app): + async def _go(): + uid, name, me = await _local(app) + elsewhere = await _signed_in(app, uid, name, ago=120) + page = await (await me.get("/account/")).get_data(as_text=True) + assert 'name="current_password"' in page and 'name="new_password"' in page + keep = {"time_zone": "Europe/London", "email": f"{name}@example.com"} + + # Blank: the rest saves and the password stays. + resp = await me.post("/account/", headers=CSRF, form=keep | {"current_password": "old password"}) + assert resp.headers["Location"] == "/account/?done=saved" + assert _checks(await _user(app, uid), "old password") + + resp = await me.post("/account/", headers=CSRF, form=keep | { + "current_password": "wrong one", "new_password": "new password", "new_confirm": "new password"}) + assert resp.status_code == 400 and "current password isn" in await resp.get_data(as_text=True) + resp = await me.post("/account/", headers=CSRF, form=keep | { + "current_password": "old password", "new_password": "new password", "new_confirm": "other"}) + assert resp.status_code == 400 and "passwords don" in await resp.get_data(as_text=True) + assert _checks(await _user(app, uid), "old password") + + resp = await me.post("/account/", headers=CSRF, form=keep | { + "current_password": "old password", "new_password": "new password", "new_confirm": "new password"}) + assert resp.headers["Location"] == "/account/?done=password" + assert _checks(await _user(app, uid), "new password") + page = await (await me.get(resp.headers["Location"])).get_data(as_text=True) + assert "Your password is changed" in page # still signed in here + assert (await elsewhere.get("/account/")).status_code == 302 # signed out there + assert "account.password_changed" in [a for a, _ in await _audits(app, uid)] + + asyncio.run(_go()) + + +def test_an_sso_account_has_no_password_to_change(app): + async def _go(): + uid, name, me = await _local(app, source="oidc") + page = await (await me.get("/account/")).get_data(as_text=True) + assert 'name="new_password"' not in page and "changed there, not in Steward" in page + resp = await me.post("/account/", headers=CSRF, form={ + "time_zone": "Europe/London", "email": f"{name}@example.com", + "current_password": "old password", "new_password": "new password", "new_confirm": "new password"}) + assert resp.status_code == 302 and _checks(await _user(app, uid), "old password") + + asyncio.run(_go())