Add a link to the password reset view in "Your profile" when logged in

[teolemon]

What

• Add a link to the password reset view in "Your profile" when logged in
• We could probably tweak the view to autofill the username/email in that case

Part of

• 👥 User management (tracker) #1382

[Sudhanva-Nadiger]

Can I work on this?

[M123-dev]

Sure @Sudhanva-Nadiger

[Sudhanva-Nadiger]

I have a doubt! currently, we have reset password api which sends email to the registered email. should we do the same here in the page too ?

[Sudhanva-Nadiger]

we do have reset password functionality in perl api but in dart API, we only have one functionality directly mentioned type as send_email, if we change can dynamically mention the type in reset password we can directly provide this feature without sending an email @teolemon and @M123-dev

[Sudhanva-Nadiger]

@monsieurtanuki could you clear my doubt? Thanks

[monsieurtanuki]

@Sudhanva-Nadiger I don't know what is the best practice, but sending an email does seem appropriate.

If one day users comment on the app saying that "it's the best app in the world except that when you want to reset your password you have to receive an email", we'll see.

[Sudhanva-Nadiger]

As an inspiration, we can take the Gmail process!
It asks for the password first if forgotten it does the usual procedure of sending an email to reset it, but if we remember the password we can directly reset it

[M123-dev]

Looks okay to me. We should only check if we even have a way to reset the password without the email

[Sudhanva-Nadiger]

I think we have that functionality written in perl api https://github.com/openfoodfacts/openfoodfacts-server/blob/main/templates/web/pages/reset_password/reset_password.tt.html

[Sudhanva-Nadiger]

@M123-dev Have worked on it! Please have a look at it. Thanks!

• Things done :
  • Add a link to reset the password in a user profile.
  • If the user remembers the password he can directly reset the password(TODO)
  • If the user doesn't remember the password, he/she can reset the password with the user name already filled in the field.
• Below is the demo of what I have mentioned

resetPassword.mp4

[M123-dev]

Looks good, now we have to ask for the old password

[Sudhanva-Nadiger]

Yeah, if user don't remember remember it he has option to go to forgot password link which is provided. if user remembers then s(he) can reset it directly !

[Sudhanva-Nadiger]

So what should we do ?

I think we have that functionality written in perl api https://github.com/openfoodfacts/openfoodfacts-server/blob/main/templates/web/pages/reset_password/reset_password.tt.html

?

[M123-dev]

I don't know perl or what looks like a template file @VaiTon can probably answer if it is possible to reset without email

[VaiTon]

@Sudhanva-Nadiger AFAIK that file is to show the "Forgotten password?" screen, but it should be indeed possible to reset the password without sending an email. For example, on the website, you can go to https://world.openfoodfacts.org/cgi/user.pl and, if you're logged in, you can change your password with the "Password" and "Confirm password" fields.

For the API side of the thing, I don't really know if there is a JSON endpoint for that, as the field is submitted trough post and a multipart request. I therefore invoke the help of @alexgarel and @stephanegigandet for this one

[stephanegigandet]

We currently don't have clean APIs to reset or to change passwords. While you can use /cgi/user.pl to send what the form expect, and then try to parse the resulting HTML, I don't recommend it, as it can easily get broken.

Also I think this issue title is quite confusing, this is about changing one's password, not resetting it (because it's forgotten).

As a matter of fact, the web version of this is not very good: we allow users to change their password if they are logged in even if they don't know the old one.

So my recommendation would be to wait for a proper API to be available.

[Sudhanva-Nadiger]

@stephanegigandet any updates on this one ?

[stephanegigandet]

@Sudhanva-Nadiger not yet

[alexgarel]

@Sudhanva-Nadiger the very best would be to have Ory integrated server side ! (There are Open PR that do most of the work). That would open many use case. But we need someone to take it !

[Sudhanva-Nadiger]

Could you elaborate it a bit ! 😐

[alexgarel]

@Sudhanva-Nadiger see: https://gist.github.com/LandonPattison/21839d41101923fe1564f653d90ffa6f