From e06248ef69b33d102a57aaa31fffcde3240dad9c Mon Sep 17 00:00:00 2001 From: Anders Betts Date: Wed, 23 Sep 2026 10:08:44 +0200 Subject: user.set_password: change your own password; TUI "Byt lösenord" MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Needs the current password (wrong ones rate limited like logins) and a password session, requires at least 10 characters, closes the user's other sessions and is audited without secrets. The TUI main menu gets "Byt lösenord" with masked prompts; ^R keeps working with the new password. Masked prompt buffers are wiped before they are freed. Co-Authored-By: Claude Opus 5.5 --- docs/STATE.md | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'docs/STATE.md') diff --git a/docs/STATE.md b/docs/STATE.md index 31d6b14..128e824 100644 --- a/docs/STATE.md +++ b/docs/STATE.md @@ -14,6 +14,13 @@ unit tests and the docs consistency check. ## Resume here (2026-09-22) +- **Byt lösenord (2026-09-23, branch `eff/set-password`, needs a server + deploy)**: new command `user.set_password` (own password, password + session only, current password required and rate limited like logins, + ≥ 10 characters, other sessions closed, audited without secrets) and a + main-menu item in the TUI. Until the server is deployed the TUI item + answers `UNKNOWN_COMMAND`. Follow-up to consider: an admin reset of + another user's password (today only `user.create` sets one). - **Byt bolag (2026-09-23, branch `eff/switch-org`)**: a main-menu item reopens the org picker and switches org in the running session (context reloaded, list selections cleared). `app_refresh_context` now clears the -- cgit v1.3