Add account unlock on password reset #7146
Conversation
* commit 'ccb045b68c5b4d983a90fa125513fc476e4e2387': fix: upgrade @graphql-tools/links from 6.2.4 to 6.2.5 (parse-community#7007) fix: upgrade pg-promise from 10.7.0 to 10.7.1 (parse-community#7009) fix: upgrade jwks-rsa from 1.10.1 to 1.11.0 (parse-community#7008) fix: upgrade graphql from 15.3.0 to 15.4.0 (parse-community#7011) update stale bot (parse-community#6998) fix(beforeSave/afterSave): Return value instead of Parse.Op for nested fields (parse-community#7005) fix(beforeSave): Skip Sanitizing Database results (parse-community#7003) Fix includeAll for querying a Pointer and Pointer array (parse-community#7002) Init (parse-community#6999)
Codecov Report
@@ Coverage Diff @@
## master #7146 +/- ##
=======================================
Coverage 93.92% 93.92%
=======================================
Files 169 169
Lines 12535 12547 +12
=======================================
+ Hits 11773 11785 +12
Misses 762 762
Continue to review full report at Codecov.
|
|
I'll take a look asap 🙂 |
src/Options/Definitions.js
Outdated
| env: 'PARSE_SERVER_WEBHOOK_KEY', | ||
| help: 'Key sent with outgoing webhook calls', | ||
| }, | ||
| "accountLockout": { |
There was a problem hiding this comment.
It is a minor item, but why do we have all these changes?
There was a problem hiding this comment.
Oh, these changes actually seem to occur for me on npm run definitions. The file is then built with double quotes. Could you try this out on your side, if that happens as well?
There was a problem hiding this comment.
It seems that the generator already adds the double quotes before writing to file, as I can see when inspecting the res output:
This babel issue describes that the quotes option has also been removed and babel outputs with double quotes. So much about babel's side at least.
There was a problem hiding this comment.
OK, when I run npm run prettier the double quotes are removed. That also affects some other files though, which are not related to this PR. What is the current workflow - should we have prettier run as a pre-commit hook? It seems that currently a PR is not guaranteed to be merged with prettier, if the author did not manually run it?
|
Not merging yet, looking into definitions quotes changes. Update: Solved -- ready for review. |
* added account unlock on password reset * added account policy option * added changelog entry * Added docs entry * moved changelog entry to correct position * improved tests to ensure requesting password reset email does not unlock account * run prettier
|
🎉 This change has been released in version 5.0.0-beta.1 |
|
🎉 This change has been released in version 5.0.0 |
New Pull Request Checklist
Issue Description
Resetting the password of an account does not lift the account lock, which is unusual behavior compared to major online services and therefore may cause confusion on the user side.
Related issue: closes #6773
Approach
Added new account policy that allows to automatically unlock an account after successfully resetting the password.
This is added as a policy option to account for different security policies, depending on use case.
TODOs before merging