Skip to content

Force password change for STAFF users logging in with initial password #2

Description

@coderabbitai

Overview

When a STAFF account is created by an OWNER, the initial password is automatically set to the last 4 digits of the user's phone number (the derived userId). Since this value is predictable, STAFF users who have not yet changed their password are at risk of unauthorized access by anyone who knows their phone number.

Goal

Detect at login time whether the STAFF user's password still matches the initial password (last 4 digits of phone), and signal the frontend to enforce a mandatory password change before allowing further access.

Suggested Approach

  • Add a boolean field isPasswordChanged (default false) to the User entity.
  • Update UserService.createUser to set isPasswordChanged = false on account creation.
  • Update UserService.changePassword to set isPasswordChanged = true on successful password change.
  • Include isPasswordChanged in LoginResponseDto (or as a claim in the JWT).
  • On the frontend/API side, redirect STAFF users with isPasswordChanged = false to a mandatory password change screen, blocking all other actions until the password is updated.

References

/cc @zlonce

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

No labels
No labels

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions