From 0fec5596f527a1ab52e28e9c0ac32b591729ab13 Mon Sep 17 00:00:00 2001 From: Bartosz Date: Tue, 8 Sep 2026 12:17:32 +0200 Subject: [PATCH] Log completed password resets as $profile_reset --- README.md | 2 +- src/flows.php | 4 ++-- tests/FlowsTest.php | 2 +- views/demos/password_reset.php | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 29794ec..017ca5e 100644 --- a/README.md +++ b/README.md @@ -12,7 +12,7 @@ the backend, which calls Castle and acts on the verdict. - **sign up** – `$registration` to `filter` (anonymous, so the email goes in `params`): `$attempted` for a new email, `$failed` (resolved via `matching_user_id`) for an email that already exists - **login** – `$login` reusing one request token across two calls: `filter` `$attempted` first, then `risk` `$succeeded` on success or `filter` `$failed` (wrong password / unknown user) - **account** – post-login actions: profile update (`$profile_update` to `risk`), a custom event (`Castle.custom()`), and logout (`$logout` via the non-blocking `log` endpoint) -- **password reset** – `$password_reset` via the non-blocking `log` endpoint +- **password reset** – `$profile_reset` via the non-blocking `log` endpoint - **lists** – the Lists API (`Castle::createList`, `Castle::getAllLists`) - **privacy** – the Privacy API (`Castle::requestUserData`, `Castle::deleteUserData`) - **webhooks** – incoming Castle webhooks are signature-verified with `Castle_Webhook::verify` (against the `X-Castle-Signature` header) and the most recent payloads are listed diff --git a/src/flows.php b/src/flows.php index 483a1c4..3aa3b14 100644 --- a/src/flows.php +++ b/src/flows.php @@ -22,7 +22,7 @@ function demos(): array ], 'password_reset' => [ 'friendly_name' => 'password reset', - 'blurb' => 'Record a password-reset event with the non-blocking log endpoint.', + 'blurb' => 'Record a password-reset event ($profile_reset) with the non-blocking log endpoint.', ], 'lists' => [ 'friendly_name' => 'lists', @@ -198,7 +198,7 @@ function decide_password_reset(array $input, array $cfg): array // A new password that differs from the current one is a successful reset. $status = $password === $cfg['valid_password'] ? '$failed' : '$succeeded'; - $type = '$password_reset'; + $type = '$profile_reset'; $payload = [ 'type' => $type, diff --git a/tests/FlowsTest.php b/tests/FlowsTest.php index e250174..6f9dfb7 100644 --- a/tests/FlowsTest.php +++ b/tests/FlowsTest.php @@ -156,7 +156,7 @@ public function testNewPasswordLogsSucceeded(): void ], $this->cfg()); $this->assertSame('log', $decision['api_endpoint']); - $this->assertSame('$password_reset', $decision['castle_type']); + $this->assertSame('$profile_reset', $decision['castle_type']); $this->assertSame('$succeeded', $decision['castle_status']); $this->assertSame('clark.kent@dailyplanet.com', $decision['payload']['user']['email']); } diff --git a/views/demos/password_reset.php b/views/demos/password_reset.php index 22a4bf8..5ac0a14 100644 --- a/views/demos/password_reset.php +++ b/views/demos/password_reset.php @@ -17,7 +17,7 @@ $desc = <<This demo records the password-reset event with the non-blocking /log endpoint, which stores the event without returning a verdict.

-

Assume the user already passed your reset challenge (e.g. an emailed OTP). Enter a value different from the valid password to send \$password_reset / \$succeeded, or the valid password to send \$password_reset / \$failed. (The password is not actually changed.)

+

Assume the user already passed your reset challenge (e.g. an emailed OTP). Enter a value different from the valid password to send \$profile_reset / \$succeeded, or the valid password to send \$profile_reset / \$failed. (The password is not actually changed.)

HTML; $scripts = <<