Refine forced password change flow

app/Http/Controllers/Settings/SecurityController.php

@@ -6,6 +6,7 @@ use App\Http\Controllers\Controller;
 use App\Http\Requests\Settings\PasswordUpdateRequest;
 use App\Http\Requests\Settings\TwoFactorAuthenticationRequest;
 use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
 use Illuminate\Routing\Controllers\HasMiddleware;
 use Illuminate\Routing\Controllers\Middleware;
 use Inertia\Inertia;
@@ -28,9 +29,14 @@ class SecurityController extends Controller implements HasMiddleware
     /**
      * Show the user's security settings page.
      */
-    public function edit(TwoFactorAuthenticationRequest $request): Response
+    public function edit(TwoFactorAuthenticationRequest $request): Response|RedirectResponse
     {
         $user = $request->user();
+
+        if ($user->must_change_password_on_next_login) {
+            return to_route('password.force-change.edit');
+        }
+
         $props = [
             'canManageTwoFactor' => Features::canManageTwoFactorAuthentication(),
             'mustChangePassword' => (bool) $user->must_change_password_on_next_login,
@@ -47,18 +53,37 @@ class SecurityController extends Controller implements HasMiddleware
         return Inertia::render('settings/Security', $props);
     }
 
+    /**
+     * Show the dedicated forced password change page.
+     */
+    public function editForcedPassword(Request $request): Response|RedirectResponse
+    {
+        if (! $request->user()->must_change_password_on_next_login) {
+            return to_route('dashboard');
+        }
+
+        return Inertia::render('auth/ForcePasswordChange', [
+            'status' => session('status'),
+        ]);
+    }
+
     /**
      * Update the user's password.
      */
     public function update(PasswordUpdateRequest $request): RedirectResponse
     {
         $user = $request->user();
+        $mustChangePassword = (bool) $user->must_change_password_on_next_login;
 
         $user->update([
             'must_change_password_on_next_login' => false,
             'password' => $request->password,
         ]);
 
+        if ($mustChangePassword) {
+            return redirect()->intended(route('dashboard'));
+        }
+
         return back();
     }
 }

app/Http/Middleware/RequirePasswordChange.php

@@ -25,14 +25,19 @@ class RequirePasswordChange
             'logout',
             'password.confirm',
             'password.confirm.*',
+            'password.force-change.edit',
             'security.edit',
             'user-password.update',
         ])) {
             return $next($request);
         }
 
+        if ($request->isMethod('get') && ! $request->expectsJson()) {
+            $request->session()->put('url.intended', $request->fullUrl());
+        }
+
         return redirect()
-            ->route('security.edit')
+            ->route('password.force-change.edit')
             ->with('status', 'You must change your password before continuing.');
     }
 }

resources/js/pages/auth/ForcePasswordChange.vue

@@ -0,0 +1,104 @@
+<script setup lang="ts">
+import { Form, Head } from '@inertiajs/vue3';
+import SecurityController from '@/actions/App/Http/Controllers/Settings/SecurityController';
+import InputError from '@/components/InputError.vue';
+import PasswordInput from '@/components/PasswordInput.vue';
+import { Button } from '@/components/ui/button';
+import { Label } from '@/components/ui/label';
+import { Spinner } from '@/components/ui/spinner';
+import AuthLayout from '@/layouts/AuthLayout.vue';
+
+withDefaults(
+    defineProps<{
+        status?: string | null;
+    }>(),
+    {
+        status: null,
+    },
+);
+</script>
+
+<template>
+    <AuthLayout
+        title="Change your password"
+        description="You must update your password before you can continue using the application."
+    >
+        <Head title="Change your password" />
+
+        <div
+            v-if="status"
+            class="mb-6 rounded-xl border border-amber-200 bg-amber-50 px-4 py-3 text-sm text-amber-900"
+        >
+            {{ status }}
+        </div>
+
+        <Form
+            v-bind="SecurityController.update.form()"
+            reset-on-success
+            :reset-on-error="[
+                'password',
+                'password_confirmation',
+                'current_password',
+            ]"
+            v-slot="{ errors, processing }"
+        >
+            <div class="space-y-6">
+                <div class="grid gap-2">
+                    <Label htmlFor="current_password">Current password</Label>
+                    <PasswordInput
+                        id="current_password"
+                        name="current_password"
+                        class="mt-1 block w-full"
+                        required
+                        autocomplete="current-password"
+                        autofocus
+                        placeholder="Current password"
+                    />
+
+                    <InputError :message="errors.current_password" />
+                </div>
+
+                <div class="grid gap-2">
+                    <Label htmlFor="password">New password</Label>
+                    <PasswordInput
+                        id="password"
+                        name="password"
+                        class="mt-1 block w-full"
+                        required
+                        autocomplete="new-password"
+                        placeholder="New password"
+                    />
+
+                    <InputError :message="errors.password" />
+                </div>
+
+                <div class="grid gap-2">
+                    <Label htmlFor="password_confirmation">
+                        Confirm new password
+                    </Label>
+                    <PasswordInput
+                        id="password_confirmation"
+                        name="password_confirmation"
+                        class="mt-1 block w-full"
+                        required
+                        autocomplete="new-password"
+                        placeholder="Confirm new password"
+                    />
+
+                    <InputError :message="errors.password_confirmation" />
+                </div>
+
+                <div class="flex items-center">
+                    <Button
+                        class="w-full"
+                        :disabled="processing"
+                        data-test="force-password-change-button"
+                    >
+                        <Spinner v-if="processing" />
+                        Save new password
+                    </Button>
+                </div>
+            </div>
+        </Form>
+    </AuthLayout>
+</template>

routes/web/settings.php

@@ -19,6 +19,13 @@ Route::middleware('auth')
             });
     });
 
+Route::middleware(['auth', 'verified'])
+    ->controller(SecurityController::class)
+    ->group(function (): void {
+        Route::get('user/force-password-change', 'editForcedPassword')
+            ->name('password.force-change.edit');
+    });
+
 Route::middleware(['auth', 'verified'])
     ->prefix('settings')
     ->group(function (): void {

tests/Feature/Auth/AuthenticationTest.php

@@ -33,7 +33,7 @@ class AuthenticationTest extends TestCase
         $response->assertRedirect(route('dashboard', absolute: false));
     }
 
-    public function test_users_who_must_change_their_password_are_redirected_to_security_settings_after_login()
+    public function test_users_who_must_change_their_password_are_redirected_to_the_dedicated_force_change_page_after_login()
     {
         $user = User::factory()->create([
             'must_change_password_on_next_login' => true,
@@ -46,7 +46,8 @@ class AuthenticationTest extends TestCase
 
         $this->assertAuthenticated();
         $response->assertInertia(fn (Assert $page) => $page
-            ->component('auth/ConfirmPassword'),
+            ->component('auth/ForcePasswordChange')
+            ->where('status', 'You must change your password before continuing.'),
         );
     }
 

tests/Feature/Settings/SecurityTest.php

@@ -97,7 +97,40 @@ class SecurityTest extends TestCase
 
         $this->actingAs($user)
             ->get(route('dashboard'))
-            ->assertRedirect(route('security.edit'));
+            ->assertRedirect(route('password.force-change.edit'));
+    }
+
+    public function test_users_who_must_change_their_password_can_view_the_dedicated_force_change_page()
+    {
+        $user = User::factory()->create([
+            'must_change_password_on_next_login' => true,
+        ]);
+
+        $this->actingAs($user)
+            ->get(route('password.force-change.edit'))
+            ->assertOk()
+            ->assertInertia(fn (Assert $page) => $page
+                ->component('auth/ForcePasswordChange'),
+            );
+    }
+
+    public function test_users_who_must_change_their_password_are_not_sent_to_the_normal_security_page()
+    {
+        $this->skipUnlessFortifyFeature(Features::twoFactorAuthentication());
+
+        Features::twoFactorAuthentication([
+            'confirm' => true,
+            'confirmPassword' => true,
+        ]);
+
+        $user = User::factory()->create([
+            'must_change_password_on_next_login' => true,
+        ]);
+
+        $this->actingAs($user)
+            ->withSession(['auth.password_confirmed_at' => time()])
+            ->get(route('security.edit'))
+            ->assertRedirect(route('password.force-change.edit'));
     }
 
     public function test_password_can_be_updated()
@@ -135,11 +168,34 @@ class SecurityTest extends TestCase
                 'password_confirmation' => 'new-password',
             ])
             ->assertSessionHasNoErrors()
-            ->assertRedirect(route('security.edit'));
+            ->assertRedirect(route('dashboard'));
 
         $this->assertFalse((bool) $user->refresh()->must_change_password_on_next_login);
     }
 
+    public function test_forced_password_change_returns_the_user_to_their_intended_page_after_updating()
+    {
+        $user = User::factory()->create([
+            'must_change_password_on_next_login' => true,
+        ]);
+
+        $this->actingAs($user)
+            ->get(route('dashboard'));
+
+        $this->actingAs($user)
+            ->from(route('password.force-change.edit'))
+            ->put(route('user-password.update'), [
+                'current_password' => 'password',
+                'password' => 'new-password',
+                'password_confirmation' => 'new-password',
+            ])
+            ->assertSessionHasNoErrors()
+            ->assertRedirect(route('dashboard'));
+
+        $this->assertFalse((bool) $user->refresh()->must_change_password_on_next_login);
+        $this->assertTrue(Hash::check('new-password', $user->password));
+    }
+
     public function test_correct_password_must_be_provided_to_update_password()
     {
         $user = User::factory()->create();