docs: clarify finish_migrate_password fires on confirmed reset (AAI-884) - #298
Closed
amandazhuyilan wants to merge 1 commit into
Closed
amandazhuyilan wants to merge 1 commit into
amandazhuyilan wants to merge 1 commit into
Conversation
The old docstring described the endpoint as firing when a user starts a password change - which matched the buggy behaviour where Auth0's password-reset-post-challenge action called it as soon as the reset link was opened, before any password was actually changed. That trigger is being removed (see aai-infrastructure), in favour of calling this endpoint from the post-login action once last_password_reset confirms the reset really happened. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
user_needs_migration: false) before they had actually reset their password, because Auth0's password-reset-post-challenge trigger fires as soon as the reset email link is opened (e.g. by an institutional email security scanner), not once a new password is actually set.event.user.last_password_resetactually being set.finish_migrate_password(GET /me/migration/password-changed) itself needs no functional change - it's just now called from the correct trigger point. This PR only updates its docstring, which previously described (and normalized) the buggy "starts the actual password change" semantics.Test plan
finish_migrate_passwordpass unchanged (pytest tests/test_user.py -k finish_migrate_password- 5 passed)🤖 Generated with Claude Code