Set a Password

Introduction#

An account created through a provider has no password (has_password is false), so there is nothing to change. The Security password page becomes Set password for it, and the user can then also sign in with email and password.

The Page#

MagicStarterPasswordView reads has_password on every build:

Submitting the set form confirms the user's identity first (see Confirming Identity): a first password is a new way into the account, so a password-less account steps up with a TOTP code or a confirmation_token, and a guest passes without a dialog. The dialog stays open while the backend refuses, so the user retries with a fresh proof. On success the user is restored, which flips has_password and with it the page from set to change.

doSetPassword#

final success = await MagicStarterProfileController.instance.doSetPassword(
  password: form['password'],
  passwordConfirmation: form['password_confirmation'],
  proof: proof,
);

Sends POST /user/password/set with password, password_confirmation and the spread proof. The backend applies the same rules as a password change (at least 8 characters with letters, numbers and mixed case, confirmed). On success it calls Auth.restore(), shows the profile.password_set toast and sets success state; on a refusal it shows the profile.password_set_failed fallback or the refusal's own sentence.

Refusals#

The mirror case: PUT /user/password on a password-less account answers 422 password_not_set, and the page rebuilds with the set form. Both are read by code.