feat(frontend): people can change their own password - #298
Merged
Conversation
The header's monogram and name now link to a new /account page, whose one action hands the user to Keycloak's update-password screen and brings them back afterwards. Before this there was no way to change a password from Hackagon at all: the credential lives in Keycloak and nothing in the app pointed at it. No backend change, and none is possible — the Go service has no password surface (no credential RPC anywhere in api/proto, no Keycloak admin client), so this is an OIDC round trip rather than an RPC: kc_action=UPDATE_PASSWORD on the authorize URL, carried there by Auth.js's third signIn argument, which leaves state, nonce and PKCE to Auth.js. Success and Cancel both come back through the callback with a valid code, so there is no error path to handle — and no confirmation banner either, since Auth.js consumes kc_action_status before the page reloads and a banner shown regardless would congratulate someone who had cancelled. Self-service reset stays impossible: the realm sets resetPasswordAllowed false because smtpServer is empty. The page says so plainly rather than leaving a locked-out user to guess.
Two comments, no code. The first says that UPDATE_PASSWORD being enabled on the realm already is precisely why this page needed no realm change. The fact was in the comment; the consequence was not, and it is the thing a reviewer asks about first. The second records who may set a new password for somebody locked out, and why it is deliberately nobody else: a Keycloak credential is platform-wide while a casbin role is per-hackathon, so a hackathon owner's reset could not be contained to their own event.
sabinem
force-pushed
the
feat/add-user-account-page
branch
from
September 11, 2026 05:36
821ee77 to
80ee814
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What a person can do now
Before
Maria joins a hackathon. Someone set up her account and gave her a password — maybe over Slack, maybe on a sticky note. She'd like it to be a password she actually chose.
She looks in Hackagon. There's nothing. No settings, no profile, no account page. Her password isn't really Hackagon's to change — it's held by a separate login service sitting behind the scenes — but nothing in the app tells her that, and nothing links her to it. She asks an organiser. They don't know either. She keeps the sticky-note password.
Now
Maria clicks her own name in the top-right corner — the little circle with her initial in it, next to "Log out".
A page opens called Account. It shows who she's signed in as, and one section: Password, with a button that says Change password.
She clicks it. The login screen appears and asks her to type her current password one more time. That's on purpose — it's what proves the person at the keyboard is really Maria and not someone who wandered past her open laptop. Then she picks a new password, types it twice, and she's dropped straight back on the Account page. Done.
If she gets halfway and changes her mind, there's a Cancel button. She lands back exactly where she was, still logged in, password untouched. Nothing breaks either way.
On a phone it works the same — the menu button opens a panel with an Account row in it.
What still isn't possible
This helps someone who knows their password and wants a different one. It does not help someone who has forgotten it — they can't log in, so they can't reach the page.
The Account page says this out loud rather than leaving someone guessing: "Forgotten your password? There is no self-service reset yet — ask a platform administrator to set a new one for you."