wellkilo opened a new pull request, #615:
URL: https://github.com/apache/fineract-backoffice-ui/pull/615
## What and why
Adds the self-service password change called out as the security-critical
first step in #492. The signed-in user can now open **Change Password** on
`/profile`, enter a new password twice, see the tenant's active password-policy
description when available, and submit without involving an administrator.
The form uses Fineract's `POST /users/{userId}/pwd` endpoint with the user
id from the authenticated session. The endpoint accepts only `password` and
`repeatPassword`; it does not accept the current password, so the UI does not
pretend to verify one. Fineract remains authoritative for the configured
password regex, reuse rules, and authorization.
The policy endpoint is loaded only when the form opens. If it is unavailable
or forbidden, the password form still works and backend validation reports the
actual policy failure.
This PR covers the password-rotation gap from #492. The optional
email/profile-edit action remains separate.
## Verification
- `npm run lint` — passed
- `npm run format:check` — passed
- `npm run i18n:check` — passed
- `npm run check:icons` — passed
- `npm run check:a11y-names` — passed
- `npm run api:surface` — passed after recording `postUsersUserIdPwd`
- `npm run build` — passed; the pre-existing `header.component.ts`
stylesheet budget warning remains
- `npm test -- --watch=false` — 248 test files, 1530 tests passed
- `npx playwright test e2e/list-pagination.spec.ts --project=mocked --grep
Profile` — 3 tests passed
- New component tests cover the action, policy display, mismatch handling,
request payload, and success state
- Commit `467fd88` is signed and GitHub reports it as **Verified**
Browser coverage uses mocked API responses. This exercises the request body
and UI state, but not a live Fineract password-policy configuration.
## Screenshots
The new mocked browser test exercises the visible action and form flow. No
binary artifact is committed.
## AI assistance (optional)
- Tool / model: OpenAI Codex
- Harness / workflow: ECC `source-command-feature-dev`, repository guidance
in `AGENTS.md`, local lint/build/unit/Playwright verification
## Checklist
- [x] I did not hand-edit generated files under `src/app/api/`.
- [x] New component or service code uses the adapter boundary in
`src/app/core/adapters/` instead of direct browser globals or imperative
third-party APIs.
- [x] User-facing strings use translation keys.
- [x] I added or updated tests appropriate to this change.
- [x] UI workflow changes include suitable e2e coverage. Mocked coverage is
sufficient for the request and form state; live password-policy validation
remains backend-owned.
- [x] Commits are signed — `467fd88` is Verified on GitHub.
- [x] I followed the AI-assisted contributions guidance.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
