pages: Add rate-limit reset ticket button to the wizard (3/3 split of #1371) - #1375
Merged
jm1021 merged 4 commits intoSep 21, 2026
Conversation
Adds a "Request a Ticket Instead" button to the OAuth password-reset wizard, shown when the reset rate limit is hit (429); it posts to Spring's /mvc/person/reset/ticket endpoint so an admin can grant more attempts from the person/read portal. Doesn't require the OAuth step to have succeeded, since the whole point is to cover the case where the user can't get through it right now. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Companion to a spring-side fix that force-expires a uid's MVC sessions after /reset/oauth/complete succeeds: that invalidates the account's sessions server-side, but doesn't clear any cookies the browser completing the reset happens to be holding. Call Spring's /logout (best-effort) right before redirecting to /login so this browser's cookies get cleared too. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- showResetOAuthStatus(): build the status message via createElement/ textContent instead of innerHTML string interpolation. - startOAuthReset(): show an inline error if the Google GSI script hasn't loaded, and clear the sign-in container before rendering so re-entering the step doesn't stack a second button. - submitOAuthResetPassword(): route password/mismatch errors through the existing inline validation message instead of alert(). - .support-topic-item <li>: add role="button" tabindex="0" plus a delegated keydown listener, so it's keyboard-activatable. - resetUid/resetNewPassword/resetConfirmPassword: add matching aria-labels (previously placeholder-only accessible names). - Move the inline <style> block and inline style="..." attributes into the same SCSS partial used on pwd-reset-support/p2-support-page (elements/forms/support.scss). - login.md's signup Google client id now reads from one shared _config.yml value via Liquid instead of being hardcoded. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Resolves the one real conflict: main has no "Request a Ticket Instead" button block at all (p1/p2 never added it), so keeping this branch's version is a pure addition, not a competing change. Everything else auto-merged cleanly, including the Flask-first reset flow from p2 (now on main) coexisting with this PR's ticket-request button. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Contributor
|
This is waiting for a Java PR to be resolved |
Contributor
|
It has been a while but we should start to review reset process |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Splitting #1371 into smaller, independently-reviewable PRs across spring/flask/pages. This one covers ticketing for password reset attempts.
Depends on #1374 (merge that first) — this branch includes #1374's support-page commit since GitHub can't base a PR on a branch that only exists in this fork. Once #1374 merges, this diff will shrink to just this PR's own changes.
Adds a "Request a Ticket Instead" button to the OAuth reset wizard, shown when the reset rate limit is hit (429); it posts to Spring's
/mvc/person/reset/ticketendpoint so an admin can grant more attempts.Original PR: #1371