feat: Add "change password" flow to user settings about langfuse HOT 10 CLOSED

Hi @khareyash05, back then there was no outbound email setup. Now it can be reused from the user invite email notifications.

Implementation thoughts

• need to create a token and store in db
• send deep link via email that includes the token
• password reset page that works unauthed and checks token
• use same implementation for change password (currently signed in) and password reset (forgot password) -> both use cases get email to reset the password on public page

Further thoughts

• some users are SSO users, some even on SSO only domains (see env var). Those users should not be able to set a password or reset it as they should stick to SSO for security (eg 2FA)

from langfuse.

Happy to help/contribute, find me on the langfuse Discord: https://langfuse.com/discord

from langfuse.

I am working on creating a new "User Settings" page.

from langfuse.

is this design is ok for 'user settings' page

You can add additional features in the future, such as billing, support, contact us, account deletion and more

from langfuse.

Hi @marcklingen I was thinking on working on this issue. May I I please know as to why the above PR was closed so that I can improve on the same? Thanks

Working on it!

from langfuse.

Oh Lots to be done on the server side! Can I segregrate the work in smaller PR's? Thanks for taking time to explain the full process

from langfuse.

Sure. However you like. I'd suggest to create one draft PR and a single "password-reset" branch for this whole issue and then create sub/stacked PRs for the individual pieces. Happy to give feedback on each if you like. Just @ me

from langfuse.

Sure! This is the UI for the user settings page #760. Also there would be lot of questions to ask and lots of reviews to be done. Where can I ask them?

from langfuse.

Hi @khareyash05, back then there was no outbound email setup. Now it can be reused from the user invite email notifications.

Implementation thoughts

• need to create a token and store in db
• send deep link via email that includes the token
• password reset page that works unauthed and checks token
• use same implementation for change password (currently signed in) and password reset (forgot password) -> both use cases get email to reset the password on public page

Further thoughts

• some users are SSO users, some even on SSO only domains (see env var). Those users should not be able to set a password or reset it as they should stick to SSO for security (eg 2FA)

@marcklingen any specific reason for the design choice on a db-persisted tokens here, instead of a JWT? (ofc, there are advantages & drawbacks)

from langfuse.

released recently, need to add smtp and from email address to env to enable this

from langfuse.