Release v2.17.0: add read-only user previews and access fallbacks

src/web/routes/admin/account.js

@@ -28,6 +28,18 @@ module.exports = function registerAccountRoutes(app, deps) {
     return buildPasswordRequirements(settings);
   }
 
+  function isPasswordChangeRequired(req) {
+    return Boolean(req && (req.authenticatedUser && req.authenticatedUser.mustChangePassword || req.currentUser && req.currentUser.mustChangePassword));
+  }
+
+  async function sendPasswordError(req, res, message) {
+    if (!isPasswordChangeRequired(req)) {
+      return res.status(400).send(message);
+    }
+    const requirements = await getPasswordRequirements();
+    return res.status(400).send(pages.renderRequiredPasswordPage(req.currentUser, requirements, message));
+  }
+
   function buildPasswordRequirements(settings) {
     return {
       minimumLength: settings['security.password_min_length'],
@@ -102,6 +114,18 @@ module.exports = function registerAccountRoutes(app, deps) {
     });
   });
 
+  app.get('/account/password', async function (req, res, next) {
+    if (!isPasswordChangeRequired(req)) {
+      return res.redirect('/account');
+    }
+    try {
+      const requirements = await getPasswordRequirements();
+      res.send(pages.renderRequiredPasswordPage(req.currentUser, requirements));
+    } catch (error) {
+      next(error);
+    }
+  });
+
   app.post('/account/profile', async function (req, res, next) {
     try {
       const name = String(req.body.name || '').trim();
@@ -268,14 +292,14 @@ module.exports = function registerAccountRoutes(app, deps) {
         return res.status(404).send('User not found.');
       }
       if (!verifyPassword(currentPassword, user)) {
-        return res.status(400).send('Current password is incorrect.');
+        return sendPasswordError(req, res, 'Current password is incorrect.');
       }
       const passwordStrengthMessage = validatePasswordStrength(newPassword, await getPasswordRequirements());
       if (passwordStrengthMessage) {
-        return res.status(400).send(passwordStrengthMessage);
+        return sendPasswordError(req, res, passwordStrengthMessage);
       }
       if (newPassword !== confirmPassword) {
-        return res.status(400).send('New passwords do not match.');
+        return sendPasswordError(req, res, 'New passwords do not match.');
       }
 
       const passwordRecord = hashPassword(newPassword);