feat(auth): update password reset page UI and policy by mulldug · Pull Request #149 · OpenStackweb/openstackid

mulldug · 2026-07-30T18:29:54Z

https://app.clickup.com/t/9014802374/86b9txpuj

Replace email field outline with filled/disabled style
Add password visibility toggle with eye icon
Add confirm field match indicator (empty circle / green check / red X)
Add password requirements list derived from config
Add help link below the card
Disable submit button until all requirements pass and fields match
Update card title and subheader to FN branding
Fix min password length to 10 (was 8) and add + to allowed special chars pattern
Add AUTH_PASSWORD_MIN_LENGTH, AUTH_PASSWORD_SHAPE_LIST, and AUTH_PASSWORD_ALLOWED_SPECIAL_CHARACTERS_TEXT config keys
Update local dev docs: queue drain command and config cache notes

Summary by CodeRabbit

New Features
- Improved the password reset form with password visibility controls and live confirmation indicators.
- Added clearer password requirements, including a minimum 10-character length, required components, and permitted special characters.
- Prevented submission until password requirements and confirmation checks are satisfied.
- Added a “Need help?” contact link and updated the submit button to “Set password.”
Documentation
- Expanded local development guidance for frontend builds, captcha testing, password-reset email processing, log checks, and configuration updates.

- Replace email field outline with filled/disabled style - Add password visibility toggle with eye icon - Add confirm field match indicator (empty circle / green check / red X) - Add password requirements list derived from config - Add help link below the card - Disable submit button until all requirements pass and fields match - Update card title and subheader to FN branding - Fix min password length to 10 (was 8) and add + to allowed special chars pattern - Add AUTH_PASSWORD_MIN_LENGTH, AUTH_PASSWORD_SHAPE_LIST, and AUTH_PASSWORD_ALLOWED_SPECIAL_CHARACTERS_TEXT config keys - Update local dev docs: queue drain command and config cache notes

coderabbitai · 2026-07-30T18:30:13Z

Warning

Review limit reached

@mulldug, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 23 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 3e82d021-cd20-45ec-9789-477bbbb0e144

📥 Commits

Reviewing files that changed from the base of the PR and between 8e3299e and 65506e9.

📒 Files selected for processing (5)

database/seeds/TestSeeder.php
resources/js/reset_password/reset_password.module.scss
tests/OIDCProtocolTestCase.php
tests/PasswordChangeRevokeTokenTest.php
tests/UserApiTest.php

📝 Walkthrough

Walkthrough

The password reset flow now exposes additional password-policy text, provides visibility and confirmation feedback in the frontend, tightens submission validation, updates styling and copy, and documents local asset, captcha, queue, log, and configuration workflows.

Changes

Password reset experience

Layer / File(s)	Summary
Password policy configuration and view wiring `config/auth.php`, `resources/views/auth/passwords/reset.blade.php`, `.env.example`	Adds environment-backed password-policy display settings, changes the default minimum password length to 10, and changes the submit label to “Set password”.
Reset form behavior and presentation `resources/js/reset_password/reset_password.js`, `resources/js/reset_password/reset_password.module.scss`	Adds password visibility toggling, confirmation indicators, structured requirements, stricter submit validation, updated copy, help contact, and supporting layout styles.
Local frontend and reset-flow instructions `LOCAL_DEVELOPMENT_HOWTO.md`	Documents asset builds, Turnstile test keys, Redis queue processing, password-reset link lookup, and config-cache clearing.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant User
  participant ResetPage as reset.blade.php
  participant ResetUI as reset_password.js
  participant Config as config/auth.php
  Config->>ResetPage: provide password policy settings
  ResetPage->>ResetUI: pass passwordPolicy
  User->>ResetUI: enter password and confirmation
  ResetUI->>User: show visibility and match indicators
  ResetUI->>User: enable submission only when fields are valid

Possibly related PRs

OpenStackweb/openstackid#121: Migrated the reset-password flow from reCAPTCHA to Turnstile, which this PR documents for local development.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main password reset UI and password policy changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

Fix failing CI checks

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch feat/new-password-restyle

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-07-30T18:31:32Z

📘 OpenAPI / Swagger preview

➡️ https://OpenStackweb.github.io/openstackid/openapi/pr-149/

This page is automatically updated on each push to this PR.

coderabbitai

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@config/auth.php`:
- Around line 106-109: Update the default fallback for AUTH_PASSWORD_MIN_LENGTH
in the password configuration to 10 instead of 8, preserving the existing
environment-variable override behavior.

In `@resources/js/reset_password/reset_password.js`:
- Line 211: Render passwordPolicy.allowed_special_characters_text as a normal
React child in resources/js/reset_password/reset_password.js:211, removing
dangerouslySetInnerHTML. In resources/views/auth/passwords/reset.blade.php:27,
serialize the configured value with Illuminate\Support\Js::from(...) before
embedding it in the script block.
- Around line 151-157: Update the password visibility IconButton to provide a
dynamic accessible name reflecting show versus hide state. Add
screen-reader-visible status text for the confirmation indicator covering
matching, mismatching, and empty confirmation states, while preserving the
existing visual icons and behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: e0d6a357-a410-4cd2-b08b-d5afc11d090d

📥 Commits

Reviewing files that changed from the base of the PR and between 83eaa4a and ba52678.

📒 Files selected for processing (6)

.env.example
LOCAL_DEVELOPMENT_HOWTO.md
config/auth.php
resources/js/reset_password/reset_password.js
resources/js/reset_password/reset_password.module.scss
resources/views/auth/passwords/reset.blade.php

💤 Files with no reviewable changes (1)

.env.example

- Add aria-label to password visibility toggle reflecting show/hide state - Add sr-only aria-live region for confirm field match status - Replace dangerouslySetInnerHTML with plain React child for special characters text; use Js::from() in blade template to safely serialize the value without HTML entity encoding - Update password_min_length default from 8 to 10 to match policy

github-actions · 2026-07-31T15:56:24Z

📘 OpenAPI / Swagger preview

➡️ https://OpenStackweb.github.io/openstackid/openapi/pr-149/

This page is automatically updated on each push to this PR.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@resources/js/reset_password/reset_password.module.scss`:
- Line 90: In the .sr_only style rule, replace the deprecated clip declaration
with clip-path: inset(50%) while preserving the existing visually hidden
behavior and other declarations.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 6e14e557-4608-46e6-b98d-6ce84565ae49

📥 Commits

Reviewing files that changed from the base of the PR and between ba52678 and 8e3299e.

📒 Files selected for processing (4)

config/auth.php
resources/js/reset_password/reset_password.js
resources/js/reset_password/reset_password.module.scss
resources/views/auth/passwords/reset.blade.php

🚧 Files skipped from review as they are similar to previous changes (3)

config/auth.php
resources/views/auth/passwords/reset.blade.php
resources/js/reset_password/reset_password.js

Replace test passwords (8–9 chars) with a new one (10 chars) across TestSeeder and four test files so the suite passes against the updated auth.password_min_length default.

github-actions · 2026-07-31T16:27:20Z

📘 OpenAPI / Swagger preview

➡️ https://OpenStackweb.github.io/openstackid/openapi/pr-149/

This page is automatically updated on each push to this PR.

github-actions · 2026-07-31T16:33:21Z

📘 OpenAPI / Swagger preview

➡️ https://OpenStackweb.github.io/openstackid/openapi/pr-149/

This page is automatically updated on each push to this PR.

coderabbitai Bot reviewed Jul 30, 2026

View reviewed changes

Comment thread config/auth.php

Comment thread resources/js/reset_password/reset_password.js

Comment thread resources/js/reset_password/reset_password.js Outdated

coderabbitai Bot reviewed Jul 31, 2026

View reviewed changes

Comment thread resources/js/reset_password/reset_password.module.scss Outdated

test: update test passwords to meet 10-character minimum policy

5eb77d2

Replace test passwords (8–9 chars) with a new one (10 chars) across TestSeeder and four test files so the suite passes against the updated auth.password_min_length default.

style(auth): replace deprecated clip with clip-path in .sr_only

65506e9

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(auth): update password reset page UI and policy - #149

feat(auth): update password reset page UI and policy#149
mulldug wants to merge 4 commits into
mainfrom
feat/new-password-restyle

mulldug commented Jul 30, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 30, 2026 •

edited

Loading

Review limit reached

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

github-actions Bot commented Jul 30, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jul 31, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

github-actions Bot commented Jul 31, 2026

Uh oh!

github-actions Bot commented Jul 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

mulldug commented Jul 30, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

github-actions Bot commented Jul 30, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jul 31, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented Jul 31, 2026

Uh oh!

github-actions Bot commented Jul 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

mulldug commented Jul 30, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 30, 2026 •

edited

Loading