psa-systems/vervain-apps
Watch
9
0
Fork
You've already forked vervain-apps
 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

VAPP-12: Logout and own-password change #18

Merged
David merged 2 commits from feat/logout-password-change-vapp-12 into main 2026-06-07 15:14:32 +02:00
Conversation 0 Commits 2 Files changed 3 +212 -18
David commented 2026-06-07 00:59:44 +02:00
Owner
Copy link

VAPP-12: Logout and own-password change

Adds the two missing self-service auth flows: signing out, and changing your own password.

Server functions (src/server_fns/mod.rs)

  • logout() - best-effort POST /logout to vervain-server with the session forwarded as mc_session (revokes the server-side session), then expires the apps-origin vervain_session cookie via Max-Age=0 on the same FullstackContext response-header path set_session_cookie uses. The cookie clear is the authoritative sign-out on this origin, so an unreachable or unconfigured server still signs the browser out; the next page load carries no token and the shell redirects to /login.
  • change_password(oldpass, newpass) - sends the control-channel changepassword action and ack-checks the reply via the existing request_ack path, so a wrong current password surfaces the server's result inline.

UI

  • Statusbar (src/components/statusbar.rs): a "sign out" button next to the theme/density toggles. On click it calls logout() then navigates to /login.
  • Settings (src/components/pages/settings.rs): the Account placeholder is replaced by a real section with a change-password form (current / new / confirm, validated the same way as the setup and user-reset forms: current required, new at least 8 chars, new matches confirm) plus a Sign out button.

Acceptance criteria

  • Logout clears the session: subsequent page loads redirect to /login and the old token no longer works against the control channel (server-side /logout revoke + cookie expiry).
  • Change password rejects a wrong old password with the server's message (ack-checked changepassword, non-"ok" result surfaced inline).
  • After change, old password fails login and new one succeeds (handled by vervain-server's changepassword handler; UI sends the action).
  • Settings Account placeholder replaced by the real section.

Verification

cargo check --features server, cargo check --target wasm32-unknown-unknown, cargo clippy --features server, cargo fmt --check, and cargo test --features server (8 passed) all clean.

#VAPP-12

🤖 Generated with Claude Code

## VAPP-12: Logout and own-password change Adds the two missing self-service auth flows: signing out, and changing your own password. ### Server functions (`src/server_fns/mod.rs`) - `logout()` - best-effort `POST /logout` to vervain-server with the session forwarded as `mc_session` (revokes the server-side session), then expires the apps-origin `vervain_session` cookie via `Max-Age=0` on the same `FullstackContext` response-header path `set_session_cookie` uses. The cookie clear is the authoritative sign-out on this origin, so an unreachable or unconfigured server still signs the browser out; the next page load carries no token and the shell redirects to /login. - `change_password(oldpass, newpass)` - sends the control-channel `changepassword` action and ack-checks the reply via the existing `request_ack` path, so a wrong current password surfaces the server's result inline. ### UI - Statusbar (`src/components/statusbar.rs`): a "sign out" button next to the theme/density toggles. On click it calls `logout()` then navigates to /login. - Settings (`src/components/pages/settings.rs`): the Account placeholder is replaced by a real section with a change-password form (current / new / confirm, validated the same way as the setup and user-reset forms: current required, new at least 8 chars, new matches confirm) plus a Sign out button. ### Acceptance criteria - [x] Logout clears the session: subsequent page loads redirect to /login and the old token no longer works against the control channel (server-side `/logout` revoke + cookie expiry). - [x] Change password rejects a wrong old password with the server's message (ack-checked `changepassword`, non-"ok" result surfaced inline). - [x] After change, old password fails login and new one succeeds (handled by vervain-server's `changepassword` handler; UI sends the action). - [x] Settings Account placeholder replaced by the real section. ### Verification `cargo check --features server`, `cargo check --target wasm32-unknown-unknown`, `cargo clippy --features server`, `cargo fmt --check`, and `cargo test --features server` (8 passed) all clean. #VAPP-12 🤖 Generated with [Claude Code](https://claude.com/claude-code)
feat(auth): logout and own-password change
All checks were successful
Check / fmt + clippy + build + tests (pull_request) Successful in 54s
Details
7309f0a46d 
Add a `logout` server fn that best-effort revokes the vervain-server session via `POST /logout` (forwarding the session as `mc_session`) and then expires the apps-origin `vervain_session` cookie with `Max-Age=0`, so subsequent page loads carry no token and the shell redirects to /login. The cookie clear is the authoritative sign-out: an unreachable server still signs the browser out.

Add a `change_password(oldpass, newpass)` server fn that sends the control-channel `changepassword` action and ack-checks the reply, so a wrong current password surfaces the server's result inline.

Wire a "sign out" button into the statusbar next to the theme/density toggles, and replace the Settings Account placeholder with a real section: a change-password form (current / new / confirm, validated like the setup and user-reset forms) plus a Sign out button.

#VAPP-12
Merge remote-tracking branch 'origin/main' into feat/logout-password-change-vapp-12
All checks were successful
Check / fmt + clippy + build + tests (pull_request) Successful in 1m0s
Details
Create release / Create release from merged PR (pull_request) Has been skipped
Details
820cf23793 
# Conflicts:
#	src/components/statusbar.rs
#	src/server_fns/mod.rs
David merged commit 93e61e49e6 into main 2026-06-07 15:14:32 +02:00
David deleted branch feat/logout-password-change-vapp-12 2026-06-07 15:14:32 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
psa-systems/vervain-apps!18
No description provided.