04/07 updated password reset, ticket templates, and satisfaction survey

2026-04-07 17:32:11 -04:00
parent 36945f5976
commit 60db5c3f9a
18 changed files with 1309 additions and 105 deletions
@@ -188,6 +188,126 @@ def profile():
    return render_template('auth/profile.html')


+
+
+@auth_bp.route('/forgot-password', methods=['GET', 'POST'])
+@limiter.limit('5 per hour')
+def forgot_password():
+    """Show the forgot-password form and send a reset email on POST."""
+    if current_user.is_authenticated:
+        return redirect(url_for('tickets.dashboard'))
+
+    if request.method == 'POST':
+        email = request.form.get('email', '').strip().lower()
+        user  = User.query.filter_by(email=email, is_active=True).first()
+
+        # Always show the same message — prevents user enumeration
+        flash('If that email is registered, a password reset link has been sent.', 'info')
+
+        if user:
+            from app.models import PasswordResetToken
+            # Invalidate any existing unused tokens for this user
+            PasswordResetToken.query.filter_by(user_id=user.id).delete()
+            raw, _token = PasswordResetToken.generate(user.id)
+            db.session.commit()
+            logger.info(f'[AUTH RESET REQUEST] user_id={user.id} email={email}')
+
+            reset_url = url_for('auth.reset_password', token=raw, _external=True)
+            _send_reset_email(user, reset_url)
+
+        return redirect(url_for('auth.login'))
+
+    return render_template('auth/forgot_password.html')
+
+
+@auth_bp.route('/reset-password/<token>', methods=['GET', 'POST'])
+@limiter.limit('10 per hour')
+def reset_password(token):
+    """Validate the reset token and allow the user to set a new password."""
+    if current_user.is_authenticated:
+        return redirect(url_for('tickets.dashboard'))
+
+    from app.models import PasswordResetToken
+    token_row = PasswordResetToken.verify(token)
+    if not token_row:
+        flash('This password reset link is invalid or has expired. Please request a new one.', 'danger')
+        return redirect(url_for('auth.forgot_password'))
+
+    if request.method == 'POST':
+        password = request.form.get('password', '')
+        confirm  = request.form.get('confirm_password', '')
+        pw_error = validate_password(password, confirm)
+        if pw_error:
+            flash(pw_error, 'danger')
+            return render_template('auth/reset_password.html', token=token)
+
+        user = token_row.user
+        user.set_password(password)
+        db.session.delete(token_row)   # single-use — delete immediately
+        log_action(user.id, 'password_reset', 'user', user.id)
+        db.session.commit()
+        logger.info(f'[AUTH RESET COMPLETE] user_id={user.id}')
+        flash('Password updated successfully. You may now log in.', 'success')
+        return redirect(url_for('auth.login'))
+
+    return render_template('auth/reset_password.html', token=token)
+
+
+def _send_reset_email(user, reset_url):
+    """Send the password reset email in a background thread."""
+    from threading import Thread
+    from flask_mail import Message
+    from app import mail
+
+    html = f"""
+<html><body style="font-family:Arial,sans-serif;background:#f4f4f4;padding:20px;">
+<div style="max-width:520px;margin:0 auto;background:#fff;border-radius:10px;
+            overflow:hidden;box-shadow:0 2px 12px rgba(0,0,0,.08);">
+  <div style="background:#1e293b;padding:24px 32px;">
+    <h1 style="color:#fff;margin:0;font-size:20px;">🔐 Password Reset Request</h1>
+  </div>
+  <div style="padding:32px;">
+    <p style="color:#334155;margin-top:0;">Hi {user.full_name},</p>
+    <p style="color:#334155;">We received a request to reset your TechDesk password.
+       Click the button below to choose a new one.</p>
+    <p style="text-align:center;margin:28px 0;">
+      <a href="{reset_url}"
+         style="display:inline-block;background:#2563eb;color:#fff;padding:13px 32px;
+                border-radius:8px;text-decoration:none;font-weight:600;font-size:15px;">
+        Reset My Password
+      </a>
+    </p>
+    <p style="color:#64748b;font-size:13px;">This link expires in <strong>1 hour</strong>.
+       If you did not request a password reset, you can safely ignore this email.</p>
+    <p style="color:#64748b;font-size:12px;word-break:break-all;">
+      Or paste this link into your browser:<br/>{reset_url}
+    </p>
+  </div>
+  <div style="background:#f8fafc;padding:16px 32px;text-align:center;
+              color:#94a3b8;font-size:11px;border-top:1px solid #e2e8f0;">
+    TechDesk IT Helpdesk &bull; This is an automated message.
+  </div>
+</div>
+</body></html>"""
+
+    msg = Message(
+        subject    = 'TechDesk — Password Reset Request',
+        recipients = [user.email],
+        html       = html,
+    )
+
+    def _send():
+        from flask import current_app
+        with current_app.app_context():
+            try:
+                mail.send(msg)
+                logger.info(f'[AUTH RESET EMAIL SENT] user_id={user.id}')
+            except Exception as exc:
+                logger.error(f'[AUTH RESET EMAIL FAILED] user_id={user.id} {exc}')
+
+    Thread(target=_send, daemon=True).start()
+
+
@auth_bp.route('/avatar/<string:filename>')
@login_required
 def serve_avatar(filename):