- Password reset by email isn't switched on yet. Contact your project admin and
- they'll set a new password for you. Once you're signed in you can change it
- yourself from the menu in the top-right corner.
-
diff --git a/html/login.js b/html/login.js
index f95e8f3..fe02769 100644
--- a/html/login.js
+++ b/html/login.js
@@ -1,26 +1,20 @@
/* Login page logic for the Work Package Suite.
- Three views on one page:
- • sign in posts to /api/auth/login. On success the server sets an
- HttpOnly session cookie (not readable here — that's the
- point) and we redirect to ?next= or the home page.
- • forgot password posts to /api/auth/forgot-password, which emails a
- single-use link. Only offered when the server reports
- email is actually configured (/api/auth/reset-available);
- otherwise we say to ask an admin.
- • set a new password shown when the page is opened as login.html?reset=
- from that email. Posts to /api/auth/reset-password.
+ One view. Sign in posts to /api/auth/login, the server authenticates by binding
+ to the domain over LDAPS (D13), and on success sets an HttpOnly session cookie —
+ not readable from here, which is the point — after which we redirect to ?next=
+ or the home page. The password entered is the person's WINDOWS password.
- The reset token stays in the URL only until it's used; on success we strip it
- from the address bar so it isn't left in history or copied out of the bar. */
+ There is no forgot-password flow and no reset view: the suite holds no password
+ to reset. "Forgot password?" is a plain external link to Okta in login.html, so
+ there is deliberately no click handler for it here — one that called
+ preventDefault() would swallow the navigation. */
(function () {
'use strict';
var errorBox = document.getElementById('error');
var okBox = document.getElementById('ok');
- function show(el) { if (el) el.style.display = ''; }
- function hide(el) { if (el) el.style.display = 'none'; }
function byId(id) { return document.getElementById(id); }
function showError(msg) {
@@ -28,11 +22,6 @@
errorBox.textContent = msg;
errorBox.classList.add('show');
}
- function showOk(msg) {
- errorBox.classList.remove('show');
- okBox.textContent = msg;
- okBox.classList.add('show');
- }
function clearBanners() {
errorBox.classList.remove('show');
okBox.classList.remove('show');
@@ -49,10 +38,6 @@
return 'index.html';
}
- function resetToken() {
- try { return new URLSearchParams(location.search).get('reset') || ''; } catch (e) { return ''; }
- }
-
function postJson(url, payload) {
return fetch(url, {
method: 'POST',
@@ -70,18 +55,11 @@
return (typeof d === 'string' && d) ? d : fallback;
}
- function view(which) {
- clearBanners();
- ['login', 'forgot', 'reset'].forEach(function (v) {
- (which === v ? show : hide)(byId('view-' + v));
- });
- }
-
// ── sign in ────────────────────────────────────────────────────────────────
var form = byId('login-form');
var submitBtn = byId('submit');
- // Guarded because a cached older login.html may not have the reset views; an
- // unguarded addEventListener on null would break sign-in itself.
+ // Guarded: an unguarded addEventListener on null would break sign-in itself if a
+ // cached older login.html were served.
if (!form || !submitBtn) return;
form.addEventListener('submit', function (e) {
e.preventDefault();
@@ -98,6 +76,10 @@
if (res.status === 401) showError('Invalid username or password.');
else if (res.status === 403) showError(detail(res, 'Your account is disabled.'));
else if (res.status === 429) showError(detail(res, 'Too many failed attempts. Try again later.'));
+ // 503 means the directory is unreachable or misconfigured — OUR fault, not a
+ // wrong password. Saying so stops people hunting for a password they no
+ // longer have while a deploy is broken.
+ else if (res.status === 503) showError(detail(res, 'Sign-in is temporarily unavailable. Contact IT.'));
else showError(detail(res, 'Sign-in failed (HTTP ' + res.status + ').'));
submitBtn.disabled = false;
submitBtn.textContent = 'Sign in';
@@ -109,107 +91,4 @@
});
});
- // ── forgot password ────────────────────────────────────────────────────────
- var resetAvailable = null; // null = not checked yet
-
- function checkResetAvailable() {
- if (resetAvailable !== null) return Promise.resolve(resetAvailable);
- return fetch('/api/auth/reset-available')
- .then(function (r) { return r.ok ? r.json() : null; })
- .then(function (j) { resetAvailable = !!(j && j.enabled); return resetAvailable; })
- .catch(function () { resetAvailable = false; return false; });
- }
-
- (byId('forgot-link') || {addEventListener: function(){}}).addEventListener('click', function (e) {
- e.preventDefault();
- view('forgot');
- // Prefill from the sign-in box so nobody types their username twice.
- var u = byId('username').value.trim();
- if (u) byId('forgot-username').value = u;
- checkResetAvailable().then(function (enabled) {
- // With email off there's nothing to submit — say so and hide the form.
- (enabled ? hide : show)(byId('forgot-unavailable'));
- (enabled ? show : hide)(byId('forgot-form'));
- if (enabled) byId('forgot-username').focus();
- });
- });
-
- (byId('back-to-login') || {addEventListener: function(){}}).addEventListener('click', function (e) {
- e.preventDefault();
- view('login');
- });
-
- var forgotForm = byId('forgot-form') || document.createElement('form');
- var forgotBtn = byId('forgot-submit') || document.createElement('button');
- forgotForm.addEventListener('submit', function (e) {
- e.preventDefault();
- clearBanners();
- var who = byId('forgot-username').value.trim();
- if (!who) { showError('Enter your username or email.'); return; }
- forgotBtn.disabled = true;
- forgotBtn.textContent = 'Sending…';
- postJson('/api/auth/forgot-password', { username: who })
- .then(function (res) {
- if (res.status === 503) {
- showError(detail(res, "Password reset by email isn't available. Ask an administrator."));
- } else if (res.ok) {
- // Deliberately the same message whether or not the account exists.
- showOk('If that account exists, a reset link is on its way. The link expires in an hour.');
- hide(forgotForm);
- } else {
- showError(detail(res, 'Could not send the reset email (HTTP ' + res.status + ').'));
- }
- forgotBtn.disabled = false;
- forgotBtn.textContent = 'Email me a reset link';
- })
- .catch(function () {
- showError('Could not reach the server. Check your connection and try again.');
- forgotBtn.disabled = false;
- forgotBtn.textContent = 'Email me a reset link';
- });
- });
-
- // ── set a new password (from the emailed link) ──────────────────────────────
- (byId('reset-to-login') || {addEventListener: function(){}}).addEventListener('click', function (e) {
- e.preventDefault();
- view('login');
- });
-
- var resetForm = byId('reset-form') || document.createElement('form');
- var resetBtn = byId('reset-submit') || document.createElement('button');
- resetForm.addEventListener('submit', function (e) {
- e.preventDefault();
- clearBanners();
- var token = resetToken();
- var pw = byId('new-password').value;
- var pw2 = byId('new-password2').value;
- if (!token) { showError('This reset link is incomplete. Request a new one.'); return; }
- if (pw !== pw2) { showError('The two passwords do not match.'); return; }
- if (pw.length < 12) { showError('Password must be at least 12 characters.'); return; }
-
- resetBtn.disabled = true;
- resetBtn.textContent = 'Saving…';
- postJson('/api/auth/reset-password', { token: token, new_password: pw })
- .then(function (res) {
- if (res.ok) {
- // Take the token out of the URL before anything else — it's spent.
- try { history.replaceState(null, '', 'login.html'); } catch (err) {}
- view('login');
- showOk('Password updated. Sign in with your new password.');
- byId('username').focus();
- return;
- }
- showError(detail(res, 'Could not set your password (HTTP ' + res.status + ').'));
- resetBtn.disabled = false;
- resetBtn.textContent = 'Set password & sign in';
- })
- .catch(function () {
- showError('Could not reach the server. Check your connection and try again.');
- resetBtn.disabled = false;
- resetBtn.textContent = 'Set password & sign in';
- });
- });
-
- // Arriving from the reset email opens straight into the new-password view.
- if (resetToken()) view('reset');
})();
diff --git a/html/users.html b/html/users.html
index 1e9fa2b..066da61 100644
--- a/html/users.html
+++ b/html/users.html
@@ -26,9 +26,8 @@
room for "Assistant Project Manager" without pushing Actions off screen. */
#users-table table td:nth-child(3){ max-width:230px; overflow:hidden; text-overflow:ellipsis; }
#users-banner:not(:empty), #scope-banner:not(:empty){ margin-bottom:var(--s3); }
- /* The create form is a lot of fields; give the password one room to breathe and
+ /* The create form is a lot of fields; let them wrap and
let the project picker take a full row of its own. */
- #nu-password{ flex:1 1 200px; }
#nu-projects{ margin-top:var(--s2); }
#nu-projects .pickrow{ padding:var(--s1) var(--s1); }
/* A manager with one project doesn't need a scrolling picker; a manager with
@@ -88,7 +87,6 @@
-
diff --git a/html/users.js b/html/users.js
index 2a32c77..ab5bea3 100644
--- a/html/users.js
+++ b/html/users.js
@@ -183,11 +183,12 @@ function managerRow(u){
: projRoleReadonly(u, can, why);
const actions = [];
- if(can && !me) actions.push('');
if(can && !me) actions.push('');
if(can && !me) actions.push('');
- if(me) actions.push('');
+ // D13: no self-service action left on your own row — the domain owns the password
+ // and role changes are never self-applied.
+ if(me) actions.push('you');
if(!can && !me) actions.push('read-only');
return ''+
@@ -254,19 +255,6 @@ function projAccessCell(u){
// ── row actions ───────────────────────────────────────────────────────────────
// Each one reloads on failure so a control can never sit there showing a value the
// server refused.
-async function resetPw(id, username){
- // The min-12 rule was stated in the prompt label and enforced only by the
- // server round-trip; the kit's validate() answers AT the input instead.
- const pw = await wpPromptDialog({title:'Reset password',
- message:'Set a new password for "'+username+'". Their existing sessions are signed out.',
- label:'New password (min 12 characters)',
- validate:v => (v && v.length >= 12) ? '' : 'At least 12 characters.'});
- if(pw === null) return;
- const { status, json } = await api('POST','/api/auth/users/'+id+'/password',{new_password:pw});
- if(status === 200) toast('Password reset for '+username+'. Their existing sessions are signed out.');
- else wpAlertDialog({title:'Reset failed', message:'Could not reset the password: '+apiError(status, json)});
-}
-
async function toggleActive(id, makeActive){
const { status, json } = await api('POST','/api/auth/users/'+id+'/active',{is_active:makeActive});
if(status === 200) loadUsers();
@@ -345,24 +333,22 @@ async function createUser(){
const msg = document.getElementById('users-create-msg');
const val = id => (document.getElementById(id)||{}).value || '';
const username = val('nu-username').trim();
- const password = val('nu-password');
const project_ids = [...document.querySelectorAll('#nu-project-list input[type=checkbox]:checked')]
.map(c => c.value);
const say = (color, text) => { msg.style.color = color; msg.textContent = text; };
if(!username){ say('var(--red)','Username is required.'); return; }
- if(password.length < 12){ say('var(--red)','Password must be at least 12 characters.'); return; }
if(_scope.scope !== 'all' && !project_ids.length){
say('var(--red)','Pick at least one project — you administer users per project.'); return;
}
say('var(--muted)','Creating…');
const { status, json } = await api('POST','/api/auth/users',{
- username, password, project_ids,
+ username, project_ids,
full_name: val('nu-fullname').trim(), email: val('nu-email').trim(),
role: val('nu-role'), project_role: val('nu-project-role'),
});
if(status === 200){
say('var(--green)','✓ Created '+username+'.');
- ['nu-username','nu-fullname','nu-email','nu-password'].forEach(id => document.getElementById(id).value = '');
+ ['nu-username','nu-fullname','nu-email'].forEach(id => document.getElementById(id).value = '');
loadUsers();
} else {
say('var(--red)','✕ '+apiError(status, json, 'Could not create the account'));
diff --git a/html/wp-sidenav.js b/html/wp-sidenav.js
index 3ca490e..aa38868 100644
--- a/html/wp-sidenav.js
+++ b/html/wp-sidenav.js
@@ -53,7 +53,6 @@
{ section: 'Account' },
{ action: 'wpPreferences', icon: '◷', label: 'Language & time',
sub: 'Dates, numbers and time zone' },
- { action: 'wpChangePassword', icon: '⚿', label: 'Password', sub: 'Change your password' },
];
function esc(v) {