User Details & Org security settings for Password Reset #1307

New Issue

MrUnknownDE · 2026-04-05T18:50:45+02:00

MrUnknownDE commented

2026-04-05 18:50:45 +02:00

Originally created by @adrianeastles on 6/27/2025

Community Contribution License Agreement

By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.

Description

Problem/Motivation:
Orgs currently lack the flexibility to reset passwords for internal users. Additionally, improving user management by making "Name" a more prominent field and defaulting to a more intuitive tab for user details will enhance usability.

Solution/Approach:
This pull request introduces a comprehensive set of changes to address user management for password reset and basic user details. I've added a dedicated "Security" tab within settings menu, allowing administrators to define the password reset token's validity period. This is implemented with a new API endpoint, updated backend logic for password resets, and corresponding frontend changes. I've also refined the user creation and management flows to incorporate the user's name more effectively and adjusted the default user details view for better UX.

Key Features & Changes:

Configurable Password Reset Token Expiration:
- A new "Security" tab has been added to organization settings, accessible alongside the "General" tab.
- Organizations can now set password reset token expiration from 1 to 24 hours (default: 1 hour).
- This setting is applied globally for all password resets within that organization.
New API Endpoint for Security Settings:
- Implemented updateOrgSecurity (PUT /org/{orgId}/security) for securely updating organization security parameters. This endpoint is protected with proper admin authorization.
Enhanced Password Reset Functionality:
- The password reset process now dynamically uses the organization-specific expiry setting retrieved from the database.
User Details and Account Creation Enhancements:
- Added a "Name" field to user details, visible in user management and prompted during user account creation.
- The default tab when viewing user details has been changed from "Access Controls" to "Details" for improved navigation.

Technical Details:

Backend Changes:

server/routers/org/updateOrgSecurity.ts: Defines the new API endpoint responsible for handling updates to organization security settings, including the passwordResetTokenExpiryHours.
server/routers/external.ts: Adds the PUT /org/{orgId}/security route, making the new endpoint accessible.
server/routers/user/adminResetUserPassword.ts: Modified to fetch and use the passwordResetTokenExpiryHours from the organization's settings when generating a password reset token.

Frontend Changes:

src/app/[orgId]/settings/general/layout.tsx: Updated to include navigation to the new "Security" tab within the organization settings layout.
src/app/[orgId]/settings/general/security/page.tsx: Contains the React component for the security settings form, allowing administrators to configure the token expiration.
src/app/[orgId]/settings/access/users/[userId]/page.tsx: Modified the default page to "Details" tab when viewing individual user profiles.

Database Integration:

A new column, passwordResetTokenExpiryHours, has been added to the orgs table.
This column is designed with backward compatibility in mind, ensuring existing organizations default to a 1-hour expiration.

How to test?

Scenario 1: Configure Password Reset Token Expiration

Log in as an organization administrator.
Navigate to Organization Settings.
Click on the newly added Security tab.
Observe the "Password Reset Token Expiration" field, defaulting to 1 hour.
Change the value to 12 hours and click Save.
Verify that a success message is displayed.
(Optional, for backend verification): If you have access to the database, check the orgs table for the corresponding organization and confirm passwordResetTokenExpiryHours is set to 12.
As the same administrator, go to Access Controls -> Users.
Select a user and initiate a Password Reset.
Use the password reset link that was sent to the user (e.g., via email or a temporary display) and successfully create a new password.
Repeat steps 5-10 with a different value (e.g., 1 hour, 24 hours) to ensure the range works. Also, test entering an invalid value (e.g., 0, 25, text) and confirm appropriate validation errors.

Scenario 2: User Name and Default Tab

Log in as an organization administrator.
Navigate to Access Controls -> Users.
Click Add User.
Fill in the user details, ensuring the Name field is present and you can input a value. Complete the user creation.
After the user is created, click on the newly created user's entry in the list.
Confirm that when the user's details page loads, the Details tab is selected by default (not "Access Controls").
Verify that the "Name" you entered during creation is correctly displayed.

Screenshots

If you have SMTP set up, an email with the password reset link will be sent to the user.
If no SMTP is set up, you can generate the link directly within the UI.

User Account Password Reset Screen.

Password Reset Option No SMTP

Password Reset Option With SMTP & Email UI

User Password Reset UI Dialog (After getting the URL)

Two-factor authentication prompt when resetting password via generated link

*Originally created by @adrianeastles on 6/27/2025* ## Community Contribution License Agreement By creating this pull request, I grant the project maintainers an unlimited, perpetual license to use, modify, and redistribute these contributions under any terms they choose, including both the AGPLv3 and the Fossorial Commercial license terms. I represent that I have the right to grant this license for all contributed content. ## Description **Problem/Motivation:** Orgs currently lack the flexibility to reset passwords for internal users. Additionally, improving user management by making "Name" a more prominent field and defaulting to a more intuitive tab for user details will enhance usability. **Solution/Approach:** This pull request introduces a comprehensive set of changes to address user management for password reset and basic user details. I've added a dedicated "Security" tab within settings menu, allowing administrators to define the password reset token's validity period. This is implemented with a new API endpoint, updated backend logic for password resets, and corresponding frontend changes. I've also refined the user creation and management flows to incorporate the user's name more effectively and adjusted the default user details view for better UX. **Key Features & Changes:** * **Configurable Password Reset Token Expiration:** * A new "Security" tab has been added to organization settings, accessible alongside the "General" tab. * Organizations can now set password reset token expiration from 1 to 24 hours (default: 1 hour). * This setting is applied globally for all password resets within that organization. * **New API Endpoint for Security Settings:** * Implemented `updateOrgSecurity` (PUT `/org/{orgId}/security`) for securely updating organization security parameters. This endpoint is protected with proper admin authorization. * **Enhanced Password Reset Functionality:** * The password reset process now dynamically uses the organization-specific expiry setting retrieved from the database. * **User Details and Account Creation Enhancements:** * Added a "Name" field to user details, visible in user management and prompted during user account creation. * The default tab when viewing user details has been changed from "Access Controls" to "Details" for improved navigation. **Technical Details:** **Backend Changes:** - `server/routers/org/updateOrgSecurity.ts`: Defines the new API endpoint responsible for handling updates to organization security settings, including the `passwordResetTokenExpiryHours`. - `server/routers/external.ts`: Adds the `PUT /org/{orgId}/security` route, making the new endpoint accessible. - `server/routers/user/adminResetUserPassword.ts`: Modified to fetch and use the `passwordResetTokenExpiryHours` from the organization's settings when generating a password reset token. **Frontend Changes:** - `src/app/[orgId]/settings/general/layout.tsx`: Updated to include navigation to the new "Security" tab within the organization settings layout. - `src/app/[orgId]/settings/general/security/page.tsx`: Contains the React component for the security settings form, allowing administrators to configure the token expiration. - `src/app/[orgId]/settings/access/users/[userId]/page.tsx`: Modified the default page to "Details" tab when viewing individual user profiles. **Database Integration:** - A new column, `passwordResetTokenExpiryHours`, has been added to the `orgs` table. - This column is designed with backward compatibility in mind, ensuring existing organizations default to a 1-hour expiration. ## How to test? **Scenario 1: Configure Password Reset Token Expiration** 1. Log in as an organization administrator. 2. Navigate to **Organization Settings**. 3. Click on the newly added **Security** tab. 4. Observe the "Password Reset Token Expiration" field, defaulting to 1 hour. 5. Change the value to **12 hours** and click **Save**. 6. Verify that a success message is displayed. 7. (Optional, for backend verification): If you have access to the database, check the `orgs` table for the corresponding organization and confirm `passwordResetTokenExpiryHours` is set to 12. 8. As the same administrator, go to **Access Controls** -> **Users**. 9. Select a user and initiate a **Password Reset**. 10. **Use the password reset link that was sent to the user (e.g., via email or a temporary display) and successfully create a new password.** 11. Repeat steps 5-10 with a different value (e.g., 1 hour, 24 hours) to ensure the range works. Also, test entering an invalid value (e.g., 0, 25, text) and confirm appropriate validation errors. **Scenario 2: User Name and Default Tab** 1. Log in as an organization administrator. 2. Navigate to **Access Controls** -> **Users**. 3. Click **Add User**. 4. Fill in the user details, ensuring the **Name** field is present and you can input a value. Complete the user creation. 5. After the user is created, click on the newly created user's entry in the list. 6. Confirm that when the user's details page loads, the **Details** tab is selected by default (not "Access Controls"). 7. Verify that the "Name" you entered during creation is correctly displayed. ### Screenshots * If you have SMTP set up, an email with the password reset link will be sent to the user. * If no SMTP is set up, you can generate the link directly within the UI. # User Account Password Reset Screen. <img width="1785" alt="Screenshot 2025-06-27 at 7 48 39 am" src="https://github.com/user-attachments/assets/935c06c7-1c1c-4740-9bff-8e07673cbdee" /> # Password Reset Option No SMTP <img width="1508" alt="Screenshot 2025-06-27 at 7 57 52 am" src="https://github.com/user-attachments/assets/aaa1c0dd-bac0-468a-a7dd-3ec4f5f7ecac" /> # Password Reset Option With SMTP & Email UI <img width="1521" alt="Screenshot 2025-06-27 at 8 16 20 am" src="https://github.com/user-attachments/assets/c06888b2-6640-47b3-ae7c-560b4eb10293" /> <img width="542" alt="Screenshot 2025-06-27 at 8 18 22 am" src="https://github.com/user-attachments/assets/c1bf1388-662d-4178-b9c5-f36850d3bcfe" /> # User Password Reset UI Dialog (After getting the URL) <img width="538" alt="Screenshot 2025-06-27 at 7 58 21 am" src="https://github.com/user-attachments/assets/d1161e39-4533-4e06-97ed-569f327f4382" /> # Two-factor authentication prompt when resetting password via generated link <img width="495" alt="Screenshot 2025-06-27 at 9 04 41 am" src="https://github.com/user-attachments/assets/ff4825fe-faba-405a-bd2a-11d59f4e08cc" />

MrUnknownDE closed this issue

2026-04-05 18:50:45 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1307