Show clear feedback after forgot password submissions #21

New issue

Closed

opened 2024-01-14 14:25:45 -06:00 by jimmyb · 1 comment

jimmyb commented

2024-01-14 14:25:45 -06:00

Owner

Copy link

The forgot password page needs clear visual feedback so users know whether their reset-link request was accepted, rejected by validation, or throttled.

The current Laravel checkout uses Fortify’s reset password feature, a custom PasswordResetController that accepts username, and a shared auth session status component. The forgot password page already renders session('status'), but this issue tracks making the success/error states explicit, accessible, and covered by tests.

Scope

Forgot password page at GET /forgot-password.
Forgot password POST flow at POST /forgot-password.
Success/status feedback after reset-link requests.
Validation and broker error feedback for missing username, throttled requests, and other reset-link failures.
Account-enumeration-safe feedback for unknown usernames.
Existing Laravel/Fortify/Tailwind auth layout patterns.

Acceptance Criteria

Submitting a valid username shows a clear success message after redirect.
Submitting an unknown username shows the same generic success message and does not reveal whether the account exists.
Submitting the form without a username shows a clear validation error near the username field.
Throttled reset-link requests show a clear error/status message without crashing.
Feedback is visually distinct from ordinary page copy and works in light/dark mode.
Feedback is accessible to assistive technology using appropriate alert/status semantics.
Existing reset-link email sending and password reset behavior continue to work.
The forgot password page still uses username copy, not email copy, because the app’s reset flow is username-based.

Test Coverage Required

Feature test confirming the forgot password page renders the status/error regions.
Feature test confirming a valid username redirects back with visible success feedback and sends ResetPassword.
Feature test confirming an unknown username redirects back with the generic success feedback and sends no notification.
Feature test confirming missing username validation renders an error.
Feature test confirming throttled reset requests render a clear feedback message.
Regression test confirming valid reset tokens still render and can reset the password.
Tests should use Pest and focused auth feature coverage.
Run the focused password reset tests, then run vendor/bin/pint --dirty before closing the issue.

Progress Checklist

Fortify reset password feature is enabled
Forgot password page exists
Forgot password form submits to POST /forgot-password
Custom username-based password reset controller exists
Shared auth session status component exists
Baseline password reset feature tests exist
Make forgot-password success feedback visually clear and accessible
Make validation/error feedback visually clear and accessible
Preserve account-enumeration-safe unknown username behavior
Add tests for success, unknown username, validation, throttling, and reset-token regression
Confirm forgot-password UI matches existing auth layout and dark-mode patterns

The forgot password page needs clear visual feedback so users know whether their reset-link request was accepted, rejected by validation, or throttled. The current Laravel checkout uses Fortify’s reset password feature, a custom `PasswordResetController` that accepts `username`, and a shared auth session status component. The forgot password page already renders `session('status')`, but this issue tracks making the success/error states explicit, accessible, and covered by tests. ## Scope - Forgot password page at `GET /forgot-password`. - Forgot password POST flow at `POST /forgot-password`. - Success/status feedback after reset-link requests. - Validation and broker error feedback for missing username, throttled requests, and other reset-link failures. - Account-enumeration-safe feedback for unknown usernames. - Existing Laravel/Fortify/Tailwind auth layout patterns. ## Acceptance Criteria - Submitting a valid username shows a clear success message after redirect. - Submitting an unknown username shows the same generic success message and does not reveal whether the account exists. - Submitting the form without a username shows a clear validation error near the username field. - Throttled reset-link requests show a clear error/status message without crashing. - Feedback is visually distinct from ordinary page copy and works in light/dark mode. - Feedback is accessible to assistive technology using appropriate alert/status semantics. - Existing reset-link email sending and password reset behavior continue to work. - The forgot password page still uses username copy, not email copy, because the app’s reset flow is username-based. ## Test Coverage Required - Feature test confirming the forgot password page renders the status/error regions. - Feature test confirming a valid username redirects back with visible success feedback and sends `ResetPassword`. - Feature test confirming an unknown username redirects back with the generic success feedback and sends no notification. - Feature test confirming missing username validation renders an error. - Feature test confirming throttled reset requests render a clear feedback message. - Regression test confirming valid reset tokens still render and can reset the password. - Tests should use Pest and focused auth feature coverage. - Run the focused password reset tests, then run `vendor/bin/pint --dirty` before closing the issue. ## Progress Checklist - [x] Fortify reset password feature is enabled - [x] Forgot password page exists - [x] Forgot password form submits to `POST /forgot-password` - [x] Custom username-based password reset controller exists - [x] Shared auth session status component exists - [x] Baseline password reset feature tests exist - [x] Make forgot-password success feedback visually clear and accessible - [x] Make validation/error feedback visually clear and accessible - [x] Preserve account-enumeration-safe unknown username behavior - [x] Add tests for success, unknown username, validation, throttling, and reset-token regression - [x] Confirm forgot-password UI matches existing auth layout and dark-mode patterns

jimmyb added the

component: user site notifications

type: feature

labels

2024-01-14 14:25:45 -06:00

~~jimmyb referenced this issue 2024-01-14 14:49:14 -06:00~~

Rebuild user blogs in Laravel #53

jimmyb added this to the Laravel 13 + TailwindCSS project

2024-08-14 11:18:32 -05:00

Codex changed title from ~~Show a Visual Notification When Using Forgot Password Page~~ to Show clear feedback after forgot password submissions

2026-05-25 22:39:15 -05:00

jimmyb added the

Rows
Columns