Graham McIntire
00aad3cb98
Add a "Forgot your password?" flow off the login page. A 24-hour reset_password token is emailed on request, the landing page lets the user pick a new password, and all other tokens for the user are revoked on success. The request endpoint returns the same flash regardless of whether the email matches a user so that attackers can't enumerate accounts.
56 lines
1.7 KiB
Text
56 lines
1.7 KiB
Text
<Layouts.app flash={@flash} current_scope={@current_scope}>
|
|
<div class="mx-auto max-w-sm space-y-4">
|
|
<div class="text-center">
|
|
<.header>
|
|
<p>Log in</p>
|
|
<:subtitle>
|
|
<%= if @current_scope do %>
|
|
You need to reauthenticate to perform sensitive actions on your account.
|
|
<% else %>
|
|
Don't have an account? <.link
|
|
navigate={~p"/users/register"}
|
|
class="font-semibold text-primary hover:underline"
|
|
phx-no-format
|
|
>Sign up</.link> for an account now.
|
|
<% end %>
|
|
</:subtitle>
|
|
</.header>
|
|
</div>
|
|
|
|
<.form :let={f} for={@form} as={:user} id="login_form_password" action={~p"/users/log-in"}>
|
|
<.input
|
|
readonly={!!@current_scope}
|
|
field={f[:email]}
|
|
type="email"
|
|
label="Email"
|
|
autocomplete="username"
|
|
spellcheck="false"
|
|
required
|
|
phx-mounted={JS.focus()}
|
|
/>
|
|
<.input
|
|
field={f[:password]}
|
|
type="password"
|
|
label="Password"
|
|
autocomplete="current-password"
|
|
spellcheck="false"
|
|
required
|
|
/>
|
|
<.button class="btn btn-primary w-full" name={@form[:remember_me].name} value="true">
|
|
Log in and stay logged in <span aria-hidden="true">→</span>
|
|
</.button>
|
|
<.button class="btn btn-primary btn-soft w-full mt-2">
|
|
Log in only this time
|
|
</.button>
|
|
</.form>
|
|
|
|
<p class="text-center text-sm text-base-content/70">
|
|
<.link
|
|
navigate={~p"/users/reset-password"}
|
|
class="font-semibold text-primary hover:underline"
|
|
>
|
|
Forgot your password?
|
|
</.link>
|
|
</p>
|
|
</div>
|
|
</Layouts.app>
|