Change password #1558

Andrew-Ryer · 2025-11-28T18:36:56Z

Description

This PR implements the full User Password Change feature in OED, enabling any authenticated user to securely change their own password via the Options → Change Password menu, without admin intervention. The work spans backend API, frontend RTK Query integration, a new modal UI component, and integration into the main application with translations.

On the backend, it adds a new POST /api/users/changePassword endpoint protected by authentication middleware that verifies the user’s JWT, validates input (including length constraints), confirms the current password with bcrypt.compare, securely hashes the new password with bcrypt.hash, and updates the database via User.updateUserPassword. On the frontend, it introduces a changePassword RTK Query mutation and a ChangePasswordModal React component that displays the current username, collects current/new/confirm password, performs real-time validation, and shows success/error notifications. The feature is fully integrated into HeaderButtonsComponent via a “Change Password” entry in the Options dropdown and wired into the translations system so all UI text is available in English, French, and Spanish.

Fixes #1526 - Allow each user to change password

Type of change

(Check the ones that apply by placing an "x" instead of the space in the [ ] so it becomes [x])

Note merging this changes the database configuration.
This change requires a documentation update

Checklist

(Note what you have done by placing an "x" instead of the space in the [ ] so it becomes [x]. It is hoped you do all of them.)

I have followed the OED pull request ideas
I have removed text in ( ) from the issue request
You acknowledge that every person contributing to this work has signed the OED Contributing License Agreement and each author is listed in the Description section.

Limitations

Password policy is limited to length-based validation (8–128 characters); there is no password strength meter or enforcement of complexity (e.g., symbols, digits, upper/lowercase mix).
Password history / reuse prevention is not implemented; users can technically reuse previous passwords as long as they meet length requirements.
No rate-limiting or lockout mechanism is added specifically for the password change endpoint; it relies on existing global protections.
Automated tests (unit/integration/e2e) for the new endpoint, RTK Query mutation, and modal component are not included as part of this PR; verification has been described and performed manually and could be formalized in follow-up test work.
Documentation and user-facing help text about the new “Change Password” option in the OED UI are not included and can be added in a separate documentation update if desired.

Contributors:
Andrew Ryer — @Andrew-Ryer — [email protected]
Nathan Towsley — @natetowsley — [email protected]
Tyler Herndon — @GoKartMan89 — [email protected]
Caleb Stark — @caleb-stark — [email protected]

…ranslations for "change.password" to data.ts

…o allow for the showing of more than one kind of modal. Adjusted handleClose() and handleShow() accordingly. Added a modalType to login modal and created a copy with modalType 'changePassword' as placeholder.

…alType to allow for the showing of more than one kind of modal. Adjusted handleClose() and handleShow() accordingly. Added a modalType to login modal and created a copy with modalType 'changePassword' as placeholder." This reverts commit c20bec1.

….ts, correct modal now shows when clicking change password.

…nate_tests

Co-authored-by: GoKartMan89 <[email protected]> Co-authored-by: caleb-stark <[email protected]> Co-authored-by: Andrew-Ryer <[email protected]>

…nate_tests

…into change password modal.

huss

Thanks to @Andrew-Ryer, @natetowsley, @GoKartMan89 & @caleb-stark for this contribution to OED. I'm sorry it took about a week to get back to you. Overall, it works well. I have made some comments to consider. Please let me know if anything is not clear or I can help.

src/client/app/translations/data.ts

huss · 2025-12-01T20:50:28Z

src/client/app/translations/data.ts

 		"calibration.save.database": "Save changes to database",
 		"calibration.submit.button": "Submit",
 		"cancel": "Cancel",
+		"change.password": "Change password",


I'm wondering if these should start with password as do a number of related ones such as password.new.enter.

Thank you for changing change.password. I'm thinking that current.password and current.password.enter might also be best if they start with password so in that section and consistent.

src/client/app/translations/data.ts

huss · 2025-12-01T21:28:54Z

src/server/routes/users.js

+		}
+	};
+if (!validate(req.body, validParams).valid) {
+	res.status(400).json({ message: 'Invalid params' });


I realize this is not done elsewhere in this file but the newer (and I think better) way is as in src/server/routes/conversions.js where it has:

const validatorResult = validate(req.body, validConversion); if (!validatorResult.valid) { log.warn(`Got request to edit conversions with invalid conversion data, errors: ${validatorResult.errors}`); failure(res, 400, `Got request to edit conversions with invalid conversion data, errors: ${validatorResult.errors}`); } else {

This uses the standard way of returning the message and logs it which is a good idea for failed login attempts. What do you think?

Everything worked with the newer method except no sub-message would show on client side underneath "Failed to change password" on the error notification when using failure(). I also tried to edit all routes to use this new method for consistency (still have the copy if that's worth looking into) but ultimately couldn't get it to work so replaced failure() line with res.status(400).

I was curious why it did not work so I tried to do it. I should soon push a commit to make the change. It also address some other items involving security that were outside the work you were asked to do. I welcome any thoughts you have about my changes.

huss · 2025-12-04T19:28:48Z

src/client/app/components/ChangePasswordModalComponent.tsx

+	return (
+		<>
+			{/* Unsaved Warning Component */}
+			{showUnsavedWarning && (


I'm not seeing the warning even if I made changes. I have not looked into this.

I'm still seeing this issue. For example, on the edit user page for admins if you type any characters in either password field and then click off the modal it asks what to do in a popup. On this page it does not give the popup. Let me know if you don't see this or need any help.

src/client/app/components/HeaderButtonsComponent.tsx

src/server/routes/users.js

…into change_password

messages in the data.ts translation file

…ssword. Formatting and indentation fixes.

…into change_password

natetowsley · 2025-12-10T04:08:27Z

@huss Changes addressed. Please let us know if there's anything else we should do.

- The messages are also displayed to the user. - Changes information returned to mask info for security reasons. Also logs more info for security. - Minor changes in message wording for translation. - Minor formatting changes.

huss

Thanks to @Andrew-Ryer, @natetowsley, @GoKartMan89 & @caleb-stark for the updated code to address my previous comments. There are a couple of old comments that I thought should still be addressed and I added to the comment chain. I also pushed a commit to use success/failure since you indicated issues in getting it to work. It also includes other changes to address ongoing security work that was not part of what you were doing. I would welcome you looking at the code to see if you think it is correct/appropriate and verifying it works as desired. Please let me know if anything is not clear or I can help.

huss · 2025-12-12T17:02:12Z

src/client/app/components/ChangePasswordModalComponent.tsx

+	return (
+		<>
+			{/* Unsaved Warning Component */}
+			{showUnsavedWarning && (


I'm still seeing this issue. For example, on the edit user page for admins if you type any characters in either password field and then click off the modal it asks what to do in a popup. On this page it does not give the popup. Let me know if you don't see this or need any help.

huss · 2025-12-12T17:06:58Z

src/client/app/translations/data.ts

 		"calibration.save.database": "Save changes to database",
 		"calibration.submit.button": "Submit",
 		"cancel": "Cancel",
+		"change.password": "Change password",


Thank you for changing change.password. I'm thinking that current.password and current.password.enter might also be best if they start with password so in that section and consistent.

huss · 2025-12-12T22:33:33Z

src/server/routes/users.js

+		}
+	};
+if (!validate(req.body, validParams).valid) {
+	res.status(400).json({ message: 'Invalid params' });


I was curious why it did not work so I tried to do it. I should soon push a commit to make the change. It also address some other items involving security that were outside the work you were asked to do. I welcome any thoughts you have about my changes.

huss · 2025-12-12T22:52:00Z

For unknown reasons my recent comments are showing up twice. I'm just going to leave them to avoid any more issues. Sorry.

natetowsley and others added 28 commits November 10, 2025 13:05

Added "Change Password" FormattedMessage to Options dropdown, added t…

3ffeecd

…ranslations for "change.password" to data.ts

Replaced previous modal state, for a new state, including ModalType t…

c20bec1

…o allow for the showing of more than one kind of modal. Adjusted handleClose() and handleShow() accordingly. Added a modalType to login modal and created a copy with modalType 'changePassword' as placeholder.

,

4cc127c

Change password modal component made, more translations added to data…

e3e2f1c

….ts, correct modal now shows when clicking change password.

update hint message

dd0e8ab

fix

38dc212

fixed placeholder text

2ec727f

starting work on the userApi process

11ce34e

added translate

c83c722

Merge branch 'nate_tests' of https://github.com/natetowsley/OED into …

ae72035

…nate_tests

Backend API Development

9ed1388

Merge branch 'nate_tests' of https://github.com/natetowsley/OED into …

1213c6b

…nate_tests

Implementation live share session.

144bdd5

Co-authored-by: GoKartMan89 <[email protected]> Co-authored-by: caleb-stark <[email protected]> Co-authored-by: Andrew-Ryer <[email protected]>

fixed terminal error for component props

517c157

Added all translations

d1ff5bf

Merge branch 'nate_tests' of https://github.com/natetowsley/OED into …

432b632

…nate_tests

fixed a merge error

f52bf39

Merge branch 'nate_tests' of https://github.com/natetowsley/OED into …

274f07a

…nate_tests

Merge branch 'nate_tests' of https://github.com/natetowsley/OED into …

eba31ac

…nate_tests

removed middleware function from users.js

fdc0760

fixed the username formgroup for change password

acd1d18

added translation for username

e4dc891

removed unused import

bc1bc4e

indentation/ format fix

b4eb802

User now remains signed in when current password incorrectly entered …

bcaf357

…into change password modal.

formatting/comments for change password files

5b7f8f0

resolved npm run check errors

8cc3b7c

huss requested changes Dec 4, 2025

View reviewed changes

Changed type ModalType into an enum for modal visibility.

07ffb52

GoKartMan89 and others added 10 commits December 6, 2025 00:41

changed HeaderButtonsComponent.tsx to update changed values in data.ts

84c61c3

Merge branch 'change_password' of https://github.com/natetowsley/OED …

ced25b3

…into change_password

changed and cleaned up the added password-related

4c7f10f

messages in the data.ts translation file

changed modal compoent error message inconsistancy

5ea9eaa

Removal of unused import. Updated validation method used in /changePa…

31fc63a

…ssword. Formatting and indentation fixes.

"parameter" -> "parameters"

408f901

Merge branch 'change_password' of https://github.com/natetowsley/OED …

b19fe13

…into change_password

Small indent fixes.

a2d7a7d

Comment format fix.

74edb87

Typo addressed, unused import removed.

eb0c16d

huss requested changes Dec 12, 2025

View reviewed changes

Change password #1558

Are you sure you want to change the base?

Change password #1558

Uh oh!

Conversation

Andrew-Ryer commented Nov 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Type of change

Checklist

Limitations

Uh oh!

huss left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

natetowsley commented Dec 10, 2025

Uh oh!

huss left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

huss commented Dec 12, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Andrew-Ryer commented Nov 28, 2025 •

edited

Loading