spring: Add Flask password-sync utility (1/4 split of #168) - #169
spring: Add Flask password-sync utility (1/4 split of #168)#169RudraBJoshi wants to merge 2 commits into
Conversation
FlaskPasswordSync calls Flask's internal sync endpoint (POST /api/internal/sync-password) with a shared secret (INTERNAL_SYNC_KEY), so a password reset completed on Spring also lands on the Flask account for the same uid. Not wired up to any caller yet -- that's the OAuth-verified reset flow, next PR in the stack. Best-effort: a sync failure is logged, not fatal to whatever already-successful operation triggered it. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Ensures any Claude Code session working in this repo automatically sees that .clauderc (one directory up, at the prodsys root) has the project structure, ongoing work, deploy requirements, and known gaps -- CLAUDE.md is auto-loaded into context at session start, .clauderc on its own is not.
|
This should be tied to Profile Password reset |
|
The process from the logged-in Reset Password should use this utility. IF Login -> Profile/Reset Password button -> Delete all Cookies -> Reset Flask -> Reset Spring (if the Spring account does not exist, create it) -> Force Logout -> Return to the login page. IF Logout -> we need to put them through an identification process, probably by sending them an email. On the email confirmation link, you can reset their Flask password to a temporary password. The next login should force them to reset their password. I don't believe we want to do more than reset Flask as we may have several needs for recovery and we should have that sequence in one place. |
Addresses jm1021's review feedback on PR Open-Coding-Society#169/flask Open-Coding-Society#74 ("tied to Profile Password reset") reinterpreted for the current architecture: the profile page's direct password field was removed in a later PR in the same stack in favor of routing everyone through this OAuth wizard, so "tied to profile reset" now means "tied to the wizard's completion". Track MVC logins in a SessionRegistry (tracking only, no session cap) and force-expire a uid's sessions after /reset/oauth/complete succeeds, closing the previously-documented gap where the JWT path invalidated on password change but the MVC HttpSession path didn't. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
Addressed in split/spring/s2-oauth-verified-reset (spring #170): reinterpreted for the current architecture since the profile page's own direct password-change field was removed in a later PR (pages #1371) in favor of routing everyone -- logged in or not -- through the same OAuth-verified reset wizard. |
2 participants
Splitting #168 into smaller, independently-reviewable PRs across spring/flask/pages. This one covers password database syncing.
Adds
FlaskPasswordSync, a standalone utility that calls Flask'sPOST /api/internal/sync-passwordwith a shared secret, so a Spring-side reset can keep Flask's password in sync. Not wired up to any caller yet — that happens in the next PR in this stack, which depends on this class existing.Stack: this PR → "Add OAuth + student ID verified password reset flow" and "Refuse to sync a plaintext password to Flask..." both branch from here.
Original PR: #168