Password update from reset link

Platform & Access · Password update from reset link

Token-gated screen where a staff member sets a new password and confirmation.

Area	Platform & Access
Routes	update_password/:token
Centre modules	always available
Staff levels	unauthenticated (token-bearing)
Models	staff-member
UI label	change-password.success-message
Coverage	2 use cases · 1 happy · 4 failure

How it works

The route pre-flights the token (isValidToken: 200 === checkToken.status) before rendering, so an expired link is detected on entry rather than on submit. The controller runs its own validate() that requires a password and checks the confirmation match before calling the API.

Use cases

Why someone opens this (2)

• Completing a self-service password reset.
• A newly created staff member setting their first password after the ‘send password email’ action.

Path map

flowchart LR
    F(["Password update from reset link"]):::feat
    F --> H1["Password changed"]:::ok
    F -.-> X1["Expired or tampered token"]:::bad
    F -.-> X2["Empty password"]:::bad
    F -.-> X3["Confirmation mismatch"]:::bad
    F -.-> X4["Weak password"]:::bad
    classDef feat fill:#4a5c8a,stroke:#4a5c8a,color:#ffffff,font-weight:bold
    classDef ok fill:#e3f1ea,stroke:#0d6b42,color:#0d4a2e
    classDef bad fill:#f7e6e2,stroke:#9a2d1c,color:#6e1f13

Happy paths

Password changed

1. User opens the tokenised URL; the route validates the token against the API (HTTP 200).
2. User types the new password twice.
3. Local validation passes (non-empty, both fields match, format rules from the staff-member model).
4. API accepts the change and change-password.success-message is shown.

Failure paths

Expired or tampered token

Cause — Token check returns a non-200 status.

What happens — isValidToken is false and the form is not usable; the user must request a new reset email.

Empty password

Cause — Field left blank.

What happens — Local validation sets errors.password to pass-required; no request is sent.

Confirmation mismatch

Cause — The two fields differ.

What happens — match-pass is shown inline (also enforced by the staff-member model’s passConfirmation.match rule).

Weak password

Cause — Fails /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{10,}$/ — needs lower + upper + digit and 10+ characters.

What happens — pass-format message from the staff-member validations.

QA checklist

Tick these off while regression-testing this feature. The boxes are plain Markdown, so progress is visible in git diffs.

• ✅ Password changed
• ⛔ Expired or tampered token
• ⛔ Empty password
• ⛔ Confirmation mismatch
• ⛔ Weak password

Implementation

• app/routes/update-password.js
• app/controllers/update-password.js

Translation keys (4)

Key	English
change-password.success-message	The password has been successfully reset, please log in to the application.
pass-required	Use 10 or more letters, with at least 1 number, 1 capital letter and 1 lower letter
match-pass	The password fields do not match
pass-format	Use 10 or more letters, with at least 1 number, 1 capital letter and 1 lower letter

Related

• Same area — Staff login · Password reset request · Change own password · Idle auto-logout · Centre switching & multi-centre scoping · Server-incident banner · Desktop (home dashboard) · Runtime environment & white-label boot · Back-office interface language · In-app help & support chat (Froged)
• Shares data with — Intranet communications (threads, confirmations, authorisations) · Staff member list, deletion & restore · Staff member editor (levels, scope, API token) · Role & module permission layer · Customer action log (dormant)

---

Generated from doc/feature-inventory.json · id platform-update-password · commit 276788ca6