From 704dd6c26e8524d81d62dedeb2def3e3ef616e41 Mon Sep 17 00:00:00 2001
From: Koda <koda@twyco.de>
Date: Fri, 22 May 2026 21:10:14 +0000
Subject: [PATCH] Polish forced password change flow

---
 .../Settings/PasswordUpdateRequest.php        | 14 +++++++-
 .../js/pages/auth/ForcePasswordChange.vue     | 13 ++++++-
 tests/Feature/Settings/SecurityTest.php       | 36 +++++++++++++++++++
 3 files changed, 61 insertions(+), 2 deletions(-)

diff --git a/app/Http/Requests/Settings/PasswordUpdateRequest.php b/app/Http/Requests/Settings/PasswordUpdateRequest.php
index 0e5ff2f..6536ae5 100644
--- a/app/Http/Requests/Settings/PasswordUpdateRequest.php
+++ b/app/Http/Requests/Settings/PasswordUpdateRequest.php
@@ -19,7 +19,19 @@ class PasswordUpdateRequest extends FormRequest
     {
         return [
             'current_password' => $this->currentPasswordRules(),
-            'password' => $this->passwordRules(),
+            'password' => [...$this->passwordRules(), 'different:current_password'],
+        ];
+    }
+
+    /**
+     * Get the custom validation messages for the request.
+     *
+     * @return array<string, string>
+     */
+    public function messages(): array
+    {
+        return [
+            'password.different' => 'The new password must be different from your current password.',
         ];
     }
 }
diff --git a/resources/js/pages/auth/ForcePasswordChange.vue b/resources/js/pages/auth/ForcePasswordChange.vue
index 9c27640..29f9e79 100644
--- a/resources/js/pages/auth/ForcePasswordChange.vue
+++ b/resources/js/pages/auth/ForcePasswordChange.vue
@@ -1,5 +1,6 @@
 <script setup lang="ts">
-import { Form, Head } from '@inertiajs/vue3';
+import { Form, Head, Link } from '@inertiajs/vue3';
+import { LogOut } from 'lucide-vue-next';
 import SecurityController from '@/actions/App/Http/Controllers/Settings/SecurityController';
 import InputError from '@/components/InputError.vue';
 import PasswordInput from '@/components/PasswordInput.vue';
@@ -7,6 +8,7 @@ import { Button } from '@/components/ui/button';
 import { Label } from '@/components/ui/label';
 import { Spinner } from '@/components/ui/spinner';
 import AuthLayout from '@/layouts/AuthLayout.vue';
+import { logout } from '@/routes';
 
 withDefaults(
     defineProps<{
@@ -25,6 +27,15 @@ withDefaults(
     >
         <Head title="Change your password" />
 
+        <div class="mb-6 flex justify-end">
+            <Button as-child variant="ghost" size="sm">
+                <Link :href="logout()" as="button">
+                    <LogOut class="size-4" />
+                    Log out
+                </Link>
+            </Button>
+        </div>
+
         <div
             v-if="status"
             class="mb-6 rounded-xl border border-amber-200 bg-amber-50 px-4 py-3 text-sm text-amber-900"
diff --git a/tests/Feature/Settings/SecurityTest.php b/tests/Feature/Settings/SecurityTest.php
index 9928d22..50816ea 100644
--- a/tests/Feature/Settings/SecurityTest.php
+++ b/tests/Feature/Settings/SecurityTest.php
@@ -109,6 +109,20 @@ class SecurityTest extends TestCase
         $this->actingAs($user)
             ->get(route('password.force-change.edit'))
             ->assertOk()
+            ->assertInertia(fn (Assert $page) => $page
+                ->component('auth/ForcePasswordChange')
+                ->where('status', null),
+            );
+    }
+
+    public function test_forced_password_change_page_exposes_a_logout_action()
+    {
+        $user = User::factory()->create([
+            'must_change_password_on_next_login' => true,
+        ]);
+
+        $this->actingAs($user)
+            ->get(route('password.force-change.edit'))
             ->assertInertia(fn (Assert $page) => $page
                 ->component('auth/ForcePasswordChange'),
             );
@@ -213,4 +227,26 @@ class SecurityTest extends TestCase
             ->assertSessionHasErrors('current_password')
             ->assertRedirect(route('security.edit'));
     }
+
+    public function test_new_password_must_be_different_from_the_current_password()
+    {
+        $user = User::factory()->create();
+
+        $response = $this
+            ->actingAs($user)
+            ->from(route('security.edit'))
+            ->put(route('user-password.update'), [
+                'current_password' => 'password',
+                'password' => 'password',
+                'password_confirmation' => 'password',
+            ]);
+
+        $response
+            ->assertSessionHasErrors([
+                'password' => 'The new password must be different from your current password.',
+            ])
+            ->assertRedirect(route('security.edit'));
+
+        $this->assertTrue(Hash::check('password', $user->fresh()->password));
+    }
 }