Refine forced password change flow

app/Http/Controllers/Settings/SecurityController.php

@@ -6,6 +6,7 @@ use App\Http\Controllers\Controller;
 use App\Http\Requests\Settings\PasswordUpdateRequest;
 use App\Http\Requests\Settings\TwoFactorAuthenticationRequest;
 use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
 use Illuminate\Routing\Controllers\HasMiddleware;
 use Illuminate\Routing\Controllers\Middleware;
 use Inertia\Inertia;
@@ -28,9 +29,14 @@ class SecurityController extends Controller implements HasMiddleware
     /**
      * Show the user's security settings page.
      */
-    public function edit(TwoFactorAuthenticationRequest $request): Response
+    public function edit(TwoFactorAuthenticationRequest $request): Response|RedirectResponse
     {
         $user = $request->user();
+
+        if ($user->must_change_password_on_next_login) {
+            return to_route('password.force-change.edit');
+        }
+
         $props = [
             'canManageTwoFactor' => Features::canManageTwoFactorAuthentication(),
             'mustChangePassword' => (bool) $user->must_change_password_on_next_login,
@@ -47,18 +53,37 @@ class SecurityController extends Controller implements HasMiddleware
         return Inertia::render('settings/Security', $props);
     }
 
+    /**
+     * Show the dedicated forced password change page.
+     */
+    public function editForcedPassword(Request $request): Response|RedirectResponse
+    {
+        if (! $request->user()->must_change_password_on_next_login) {
+            return to_route('dashboard');
+        }
+
+        return Inertia::render('auth/ForcePasswordChange', [
+            'status' => session('status'),
+        ]);
+    }
+
     /**
      * Update the user's password.
      */
     public function update(PasswordUpdateRequest $request): RedirectResponse
     {
         $user = $request->user();
+        $mustChangePassword = (bool) $user->must_change_password_on_next_login;
 
         $user->update([
             'must_change_password_on_next_login' => false,
             'password' => $request->password,
         ]);
 
+        if ($mustChangePassword) {
+            return redirect()->intended(route('dashboard'));
+        }
+
         return back();
     }
 }