Add must-change-password cli parameter

[KN4CK3R]

This PR adds a new must-change-password parameter to the change-password cli command.
We already have the must-change-password command but it feels natural to have this integrated into the change-password cli command.

[6543]

we use it on the other user option that way ... reverting this in that way will just make it more difficult as we have now two similar options but they work the other way

[6543]

@KN4CK3R I did make it the same as the other option ... if you disagree please force push that change away :)

[KN4CK3R]

@6543 So, what's the command line for changing a users password without requesting a change from them?

[6543]

gitea admin user change-password -u a_user -p a_pwd --must-change-password false

[KN4CK3R]

Yep, and that's wrong:

Command	Result
gitea admin user change-password --username x --password y	MustChangePassword = true
gitea admin user change-password --username x --password y --must-change-password	MustChangePassword = true
gitea admin user change-password --username x --password y --must-change-password false	MustChangePassword = true this is unexpected
gitea admin user change-password --username x --password y --must-change-password=false	MustChangePassword = false ok, but nobody knows that they need to use =

inverted command:

Command	Result
gitea admin user change-password --username x --password y	MustChangePassword = true
gitea admin user change-password --username x --password y --must-not-change-password	MustChangePassword = false

[6543]

ah now I get your concerns ... let me fix that issue ...

[6543]

diff --git a/cmd/admin_user_change_password.go b/cmd/admin_user_change_password.go
index f1b08c197e..1a7d96a920 100644
--- a/cmd/admin_user_change_password.go
+++ b/cmd/admin_user_change_password.go
@@ -32,11 +32,7 @@ var microcmdUserChangePassword = &cli.Command{
                        Value:   "",
                        Usage:   "New password to set for user",
                },
-               &cli.BoolFlag{
-                       Name:  "must-change-password",
-                       Value: true,
-                       Usage: "User must change password",
-               },
+               mustChangePasswordFlag,
        },
 }
 
@@ -74,7 +70,7 @@ func runChangePassword(c *cli.Context) error {
                return err
        }
 
-       user.MustChangePassword = c.Bool("must-change-password")
+       user.MustChangePassword = mustChangePassword(c)
 
        if err = user_model.UpdateUserCols(ctx, user, "must_change_password", "passwd", "passwd_hash_algo", "salt"); err != nil {
                return err
diff --git a/cmd/admin_user_create.go b/cmd/admin_user_create.go
index fefe18d39c..2f4a1d0843 100644
--- a/cmd/admin_user_create.go
+++ b/cmd/admin_user_create.go
@@ -45,10 +45,7 @@ var microcmdUserCreate = &cli.Command{
                        Name:  "random-password",
                        Usage: "Generate a random password for the user",
                },
-               &cli.BoolFlag{
-                       Name:  "must-change-password",
-                       Usage: "Set this option to false to prevent forcing the user to change their password after initial login, (Default: true)",
-               },
+               mustChangePasswordFlag,
                &cli.IntFlag{
                        Name:  "random-password-length",
                        Usage: "Length of the random password to be generated",
@@ -110,19 +107,14 @@ func runCreateUser(c *cli.Context) error {
                return errors.New("must set either password or random-password flag")
        }
 
-       // always default to true
-       changePassword := true
+       changePassword := mustChangePassword(c)
 
        // If this is the first user being created.
        // Take it as the admin and don't force a password update.
-       if n := user_model.CountUsers(ctx, nil); n == 0 {
+       if !c.IsSet("must-change-password") && user_model.CountUsers(ctx, nil) == 0 {
                changePassword = false
        }
 
-       if c.IsSet("must-change-password") {
-               changePassword = c.Bool("must-change-password")
-       }
-
        restricted := util.OptionalBoolNone
 
        if c.IsSet("restricted") {

@KN4CK3R

[6543]

cat cmd/admin_user_flags.go

// Copyright 2023 The Gitea Authors. All rights reserved.
// SPDX-License-Identifier: MIT

package cmd

import (
	"strconv"

	"github.com/urfave/cli/v2"
)

var mustChangePasswordFlag = &cli.StringFlag{
	Name:  "must-change-password",
	Value: "true",
	Usage: "Set this option to false to prevent forcing the user to change their password after initial login, (Default: true)",
}

// return bool of must-change-password flag
func mustChangePassword(c *cli.Context) bool {
	v, _ := strconv.ParseBool(c.String("must-change-password"))
	return v
}

[6543]

what do you think?

[KN4CK3R]

Personally I would not want this workaround because it's different to every other command.

[wxiaoguang]

Suggested change

	- `--must-change-password`: If provided, the user is required to choose a new password after the login. Optional. (default: true).
	- `--must-change-password`, `--must-change-password=true/false`: If provided, the user is required to choose a new password after the login. Optional.

The (default: true) and optional might cause misunderstanding IMO.

I think everyone could understand that --must-change-password means --must-change-password=true

---

Or just follow the wording above, like - `--admin`: If provided, this makes the user an admin. Optional.

[wxiaoguang]

Is there any other suggestion? If no, could I commit this suggestion and approve?

[delvh]

The suggestion sounds good

[KN4CK3R]

Changed the wording. Now the default is false if the flag is not set. I still think this should default to true.

[wxiaoguang]

Sure, but I think if it defaults to true, then it might needs some new wording. (the old one makes me think for quite a long time to understand what is "optional" and what is "default: true" ....)

Maybe like this?

- `--must-change-password`: Default to true, the user is required to choose a new password after login. Use `--must-change-password=false` to disable this option.

Anyway, no better idea from my side. Either is fine to me.

[KN4CK3R]

I think I just used the wording from here:

gitea/docs/content/administration/command-line.en-us.md

Lines 86 to 87 in 360b3fd

	- `--must-change-password`: If provided, the created user will be required to choose a newer password after the
	initial login. Optional. (default: true).

Maybe we should have a common format for optional and required parameters.

[wxiaoguang]

-> Improve "must-change-password" logic and document #30472