Files
dify/web/app
GareArc 2f73bb8c0e fix(auth): use validity-returned token in ChangePasswordForm reset submit [cherry-pick → hotfix/1.14.1-fix.3]
Cherry-pick of #36415.

The two-phase token flow (T1 → /validity → T2 with phase="reset" → /resets)
was broken because ForgotPasswordValidity type was missing the `token` field,
so T2 was discarded and T1 (from URL) was re-sent to /resets. Backend rejects
T1 at /resets because it requires phase="reset". Fix: add `token` to the type
and use verifyTokenRes.token in handleChangePassword.

Adds a test that asserts T2 (validity response token) is submitted, not T1
(URL token).

Fixes ENG-423.
2026-05-21 13:11:35 +08:00
..