pages: Add rate-limit reset ticket button to the wizard (3/3 split of #1371) - #1375
Open
RudraBJoshi wants to merge 4 commits into
Open
pages: Add rate-limit reset ticket button to the wizard (3/3 split of #1371)#1375RudraBJoshi wants to merge 4 commits into
RudraBJoshi wants to merge 4 commits into
Conversation
New /support page: a topic list (currently just "Password Reset") that deep-links via ?topic=reset straight into a "Let's Reset Your Password" wizard, skipping the topic list -- used by "Forgot your password?" links elsewhere so /support can grow to cover more than password reset later without adding friction. The wizard animates through GitHub ID entry -> school Google OAuth sign-in -> new password, calling Spring's OAuth-verified reset endpoints (/mvc/person/reset/oauth/verify, /mvc/person/reset/oauth/complete). The Google ID token is only relayed raw to the backend; the digit-match/identity check happens server-side, not in this client code. Client-side password checks: 8-character minimum and confirm-match, with inline feedback (styled via the new .password-length validation class, referenced by this code but never previously defined). Exports GOOGLE_CLIENT_ID once from config.js instead of copy-pasting it into every page that needs Google sign-in, and login.md picks up that shared import too. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Adds a "Request a Ticket Instead" button to the OAuth password-reset wizard, shown when the reset rate limit is hit (429); it posts to Spring's /mvc/person/reset/ticket endpoint so an admin can grant more attempts from the person/read portal. Doesn't require the OAuth step to have succeeded, since the whole point is to cover the case where the user can't get through it right now. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Companion to a spring-side fix that force-expires a uid's MVC sessions after /reset/oauth/complete succeeds: that invalidates the account's sessions server-side, but doesn't clear any cookies the browser completing the reset happens to be holding. Call Spring's /logout (best-effort) right before redirecting to /login so this browser's cookies get cleared too. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- showResetOAuthStatus(): build the status message via createElement/ textContent instead of innerHTML string interpolation. - startOAuthReset(): show an inline error if the Google GSI script hasn't loaded, and clear the sign-in container before rendering so re-entering the step doesn't stack a second button. - submitOAuthResetPassword(): route password/mismatch errors through the existing inline validation message instead of alert(). - .support-topic-item <li>: add role="button" tabindex="0" plus a delegated keydown listener, so it's keyboard-activatable. - resetUid/resetNewPassword/resetConfirmPassword: add matching aria-labels (previously placeholder-only accessible names). - Move the inline <style> block and inline style="..." attributes into the same SCSS partial used on pwd-reset-support/p2-support-page (elements/forms/support.scss). - login.md's signup Google client id now reads from one shared _config.yml value via Liquid instead of being hardcoded. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Splitting #1371 into smaller, independently-reviewable PRs across spring/flask/pages. This one covers ticketing for password reset attempts.
Depends on #1374 (merge that first) — this branch includes #1374's support-page commit since GitHub can't base a PR on a branch that only exists in this fork. Once #1374 merges, this diff will shrink to just this PR's own changes.
Adds a "Request a Ticket Instead" button to the OAuth reset wizard, shown when the reset rate limit is hit (429); it posts to Spring's
/mvc/person/reset/ticketendpoint so an admin can grant more attempts.Original PR: #1371