golem15/sm-user-plugin
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: password-change hook and the reset-2FA admin slot

Browse Source 
The D-07 password-change hook is the existing AccessRevokedEvent, fired
inside the write's transaction by a reset, the user's own change and an
administrator's password; (*AccessRevokedEvent).PasswordChanged reports
those three reasons, and the login rehash fires nothing.

The Users screen declares the record action reset_two_factor (danger)
behind the new permission golem15.users.reset_two_factor, which no role
has by default. It is offered only when a two-factor plugin publishes a
classes.TwoFactorAdmin and the user has a second factor; Run calls the
service's Reset in the action's transaction.
This commit is contained in:
Jakub Zych
2026-10-26 10:03:59 +01:00
parent 8501f3475a
commit 7900f47ba6
14 changed files with 419 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
lang/en/lang.yaml
View File

@@ -9,6 +9,7 @@ plugin:
impersonate_user: Impersonate Users
manage_privileged_groups: Manage privileged group membership
manage_backend_links: Link frontend accounts to administrators
reset_two_factor: Reset two-factor authentication of users
users:
menu_label: Users
new_user: New User
@@ -52,6 +53,9 @@ users:
unsuspend_user: Unsuspend user
unsuspend_confirm: Unsuspend this user?
unsuspend_success: User has been unsuspended.
reset_two_factor: Reset 2FA
reset_two_factor_confirm: Remove every second factor of this user? Their authenticator apps, security keys, recovery codes and trusted devices stop working, and they sign in with the password alone until they set up two-factor authentication again.
reset_two_factor_success: Two-factor authentication of the user has been reset.
privileged_member_forbidden: This user belongs to a privileged group. You do not have permission to change their email or password. Nothing was saved.
privileged_member_delete_forbidden: Users who belong to a privileged group cannot be deleted without the permission to manage privileged groups. Nothing was deleted.
privileged_group_forbidden: You do not have permission to change membership of privileged groups. Nothing was saved.