Merge branch 'main' into koda/137-user-edit-flow

app/Http/Controllers/Settings/SecurityController.php

@@ -6,6 +6,7 @@ use App\Http\Controllers\Controller;
 use App\Http\Requests\Settings\PasswordUpdateRequest;
 use App\Http\Requests\Settings\TwoFactorAuthenticationRequest;
 use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
 use Illuminate\Routing\Controllers\HasMiddleware;
 use Illuminate\Routing\Controllers\Middleware;
 use Inertia\Inertia;
@@ -31,10 +32,9 @@ class SecurityController extends Controller implements HasMiddleware
     public function edit(TwoFactorAuthenticationRequest $request): Response
     {
         $user = $request->user();
+
         $props = [
             'canManageTwoFactor' => Features::canManageTwoFactorAuthentication(),
-            'mustChangePassword' => (bool) $user->must_change_password_on_next_login,
-            'status' => session('status'),
         ];
 
         if (Features::canManageTwoFactorAuthentication()) {
@@ -47,18 +47,37 @@ class SecurityController extends Controller implements HasMiddleware
         return Inertia::render('settings/Security', $props);
     }
 
+    /**
+     * Show the dedicated forced password change page.
+     */
+    public function editForcedPassword(Request $request): Response|RedirectResponse
+    {
+        if (! $request->user()->must_change_password_on_next_login) {
+            return to_route('dashboard');
+        }
+
+        return Inertia::render('auth/ForcePasswordChange', [
+            'status' => session('status'),
+        ]);
+    }
+
     /**
      * Update the user's password.
      */
     public function update(PasswordUpdateRequest $request): RedirectResponse
     {
         $user = $request->user();
+        $mustChangePassword = (bool) $user->must_change_password_on_next_login;
 
         $user->update([
             'must_change_password_on_next_login' => false,
             'password' => $request->password,
         ]);
 
+        if ($mustChangePassword) {
+            return redirect()->intended(route('dashboard'));
+        }
+
         return back();
     }
 }

app/Http/Middleware/RequirePasswordChange.php

@@ -23,16 +23,18 @@ class RequirePasswordChange
 
         if ($request->routeIs([
             'logout',
-            'password.confirm',
-            'password.confirm.*',
-            'security.edit',
+            'password.force-change.edit',
             'user-password.update',
         ])) {
             return $next($request);
         }
 
+        if ($request->isMethod('get') && ! $request->expectsJson()) {
+            $request->session()->put('url.intended', $request->fullUrl());
+        }
+
         return redirect()
-            ->route('security.edit')
+            ->route('password.force-change.edit')
             ->with('status', 'You must change your password before continuing.');
     }
 }

app/Http/Requests/Settings/PasswordUpdateRequest.php

@@ -19,7 +19,19 @@ class PasswordUpdateRequest extends FormRequest
     {
         return [
             'current_password' => $this->currentPasswordRules(),
-            'password' => $this->passwordRules(),
+            'password' => [...$this->passwordRules(), 'different:current_password'],
+        ];
+    }
+
+    /**
+     * Get the custom validation messages for the request.
+     *
+     * @return array<string, string>
+     */
+    public function messages(): array
+    {
+        return [
+            'password.different' => 'The new password must be different from your current password.',
         ];
     }
 }