@genesislcap/foundation-auth 15.14.1 → 15.14.2-FUI-2603.2

package/dist/esm/machine/guards.test.js

@@ -0,0 +1,53 @@
+import { assert, createLogicSuite } from '@genesislcap/foundation-testing';
+import { is200Nack } from './guards';
+import { isResetPasswordParams } from './types';
+const Suite = createLogicSuite('auth machine password reset guards');
+const nackDto = {
+    MESSAGE_TYPE: 'EVENT_NACK',
+    SOURCE_REF: 'ref',
+    ERROR: [
+        {
+            '@type': 'StandardError',
+            CODE: 'INTERNAL_ERROR',
+            TEXT: 'Password validation failed',
+            STATUS_CODE: '500 Internal Server Error',
+        },
+    ],
+    WARNING: [],
+};
+Suite('is200Nack is true for FetchMachineOutput wrapping EVENT_NACK', () => {
+    assert.ok(is200Nack({
+        type: 'done.invoke.resetPasswordFetcher',
+        output: { data: nackDto, response: { ok: true } },
+    }));
+});
+Suite('is200Nack is true for EVENT_NACK even when HTTP is not ok', () => {
+    assert.ok(is200Nack({
+        type: 'done.invoke.resetPasswordFetcher',
+        output: { data: nackDto, response: { ok: false } },
+    }));
+});
+Suite('is200Nack is false for EVENT_ACK without errors', () => {
+    assert.not.ok(is200Nack({
+        type: 'done.invoke.resetPasswordFetcher',
+        output: { data: { MESSAGE_TYPE: 'EVENT_ACK', SOURCE_REF: 'ref' }, response: { ok: true } },
+    }));
+});
+Suite('isResetPasswordParams requires username, token and new password', () => {
+    assert.ok(isResetPasswordParams({
+        username: 'JaneDee',
+        resetToken: 'token',
+        newPassword: 'Password11*',
+    }));
+    assert.not.ok(isResetPasswordParams({
+        username: '',
+        resetToken: 'token',
+        newPassword: 'Password11*',
+    }));
+    assert.not.ok(isResetPasswordParams({
+        username: 'JaneDee',
+        resetToken: '',
+        newPassword: 'Password11*',
+    }));
+});
+Suite.run();

package/dist/esm/machine/machine.js

@@ -7,10 +7,12 @@ import { and, assign, createMachine, fromPromise, not, or, raise, sendTo } from
 import { AuthConfig } from '../config/config';
 import { CredentialManager, CredentialType, } from '../credential';
 import { MESSAGE_TYPE } from '../dto';
-import { AuthMessageMapper, createHTTPHeadersFromDTO, isLoginAckEntity, isLoginDetailsAckEntity, isLoginNackEntity, isLogoutAckEntity, isLogoutNackEntity, isNackDTO, } from '../mapper';
+import { AuthMessageMapper, createHTTPHeadersFromDTO, isLoginAckEntity, isLoginDetailsAckEntity, isLoginNackEntity, isLogoutAckEntity, isLogoutNackEntity, isFailedAuthDTO, } from '../mapper';
+import { clearResetIdentity } from '../routes/reset-password/reset-identity';
 import { AuthRouting } from '../routes/routing';
 import { logger } from '../utils';
-import { setError } from './actions';
+import { clearAuthErrorState, setError } from './actions';
+import { authDtoFromMachineEvent, isAuthNackEvent as eventHasAuthNack, isFetchFailureOutput, persistCredentials, } from './dto';
 import { defaultAuthMachineContext, isLoginParams, isQueryParams } from './types';
 /**
  * Default AuthMachine.
@@ -49,6 +51,10 @@ let DefaultAuthMachine = class DefaultAuthMachine extends AbstractMachine {
                     actions,
                     target: '#authMachine.resetPassword',
                 },
+                dismiss: {
+                    actions: ['resetContext'],
+                    target: '#authMachine.idle',
+                },
             };
         };
         this.dtoTransition = () => ({
@@ -122,7 +128,17 @@ let DefaultAuthMachine = class DefaultAuthMachine extends AbstractMachine {
                     invoke: {
                         id: 'loginDetailsFetcher',
                         src: fetchMachine.machine,
-                        onDone: this.dtoTransition(),
+                        onDone: [
+                            {
+                                guard: 'isUnauthorizedError',
+                                target: 'loggedOut',
+                            },
+                            {
+                                guard: 'isFetchFailureOutput',
+                                target: 'error.silentLogin',
+                            },
+                            this.dtoTransition(),
+                        ],
                         onError: [
                             {
                                 guard: 'isUnauthorizedError',
@@ -146,8 +162,23 @@ let DefaultAuthMachine = class DefaultAuthMachine extends AbstractMachine {
                     invoke: {
                         id: 'loginFetcher',
                         src: fetchMachine.machine,
-                        onDone: this.dtoTransition(),
-                        onError: 'error.login',
+                        onDone: [
+                            {
+                                guard: 'isFetchFailureOutput',
+                                target: 'error.login',
+                            },
+                            this.dtoTransition(),
+                        ],
+                        onError: [
+                            {
+                                guard: 'isAuthNackEvent',
+                                actions: ['setDTO'],
+                                target: 'mapEntity',
+                            },
+                            {
+                                target: 'error.login',
+                            },
+                        ],
                     },
                     entry: [
                         sendTo('loginFetcher', ({ context }) => {
@@ -205,7 +236,13 @@ let DefaultAuthMachine = class DefaultAuthMachine extends AbstractMachine {
                     invoke: {
                         id: 'logoutFetcher',
                         src: fetchMachine.machine,
-                        onDone: this.dtoTransition(),
+                        onDone: [
+                            {
+                                guard: 'isFetchFailureOutput',
+                                target: 'error.logout',
+                            },
+                            this.dtoTransition(),
+                        ],
                         onError: 'error.logout',
                     },
                     entry: [
@@ -236,7 +273,19 @@ let DefaultAuthMachine = class DefaultAuthMachine extends AbstractMachine {
                     invoke: {
                         id: 'forgotPasswordFetcher',
                         src: fetchMachine.machine,
-                        onDone: 'feedback.forgotPassword',
+                        onDone: [
+                            {
+                                guard: 'is200NackDTO',
+                                target: 'error.forgotPassword',
+                            },
+                            {
+                                guard: 'isFetchFailureOutput',
+                                target: 'error.forgotPassword',
+                            },
+                            {
+                                target: 'feedback.forgotPassword',
+                            },
+                        ],
                         onError: 'error.forgotPassword',
                     },
                     entry: [
@@ -261,11 +310,15 @@ let DefaultAuthMachine = class DefaultAuthMachine extends AbstractMachine {
                                 guard: 'is200NackDTO',
                                 target: 'error.changePassword',
                             },
+                            {
+                                guard: 'isFetchFailureOutput',
+                                target: 'error.changePassword',
+                            },
                             {
                                 actions: [
                                     ({ context }) => {
                                         const params = context.params;
-                                        this.cm.storeCredentials({
+                                        persistCredentials(this.cm.storeCredentials.bind(this.cm), {
                                             id: params.username,
                                             name: params.username,
                                             password: params.newPassword,
@@ -294,19 +347,30 @@ let DefaultAuthMachine = class DefaultAuthMachine extends AbstractMachine {
                     invoke: {
                         id: 'resetPasswordFetcher',
                         src: fetchMachine.machine,
-                        onDone: {
-                            actions: [
-                                ({ context }) => {
-                                    const params = context.params;
-                                    this.cm.storeCredentials({
-                                        id: params.username,
-                                        name: params.username,
-                                        password: params.newPassword,
-                                    });
-                                },
-                            ],
-                            target: 'feedback.resetPassword',
-                        },
+                        onDone: [
+                            {
+                                guard: 'is200NackDTO',
+                                target: 'error.resetPassword',
+                            },
+                            {
+                                guard: 'isFetchFailureOutput',
+                                target: 'error.resetPassword',
+                            },
+                            {
+                                actions: [
+                                    ({ context }) => {
+                                        const params = context.params;
+                                        persistCredentials(this.cm.storeCredentials.bind(this.cm), {
+                                            id: params.username,
+                                            name: params.username,
+                                            password: params.newPassword,
+                                        });
+                                    },
+                                    () => clearResetIdentity(),
+                                ],
+                                target: 'feedback.resetPassword',
+                            },
+                        ],
                         onError: 'error.resetPassword',
                     },
                     entry: [
@@ -449,11 +513,12 @@ let DefaultAuthMachine = class DefaultAuthMachine extends AbstractMachine {
                     ],
                 },
                 /**
-                 * Feedback states. These are transient and revert back to idle after a short delay.
-                 * These can help improve UX in when the backend nack text is lacking clarity, as with incorrect credentials.
+                 * Feedback states. Success paths auto-return after feedbackDelay.
+                 * Error paths stay put so the user can retry immediately (login is handled here).
                  */
                 feedback: {
                     initial: 'none',
+                    on: this.onIdleEvents(),
                     states: {
                         none: {
                             tags: ['feedback', 'none'],
@@ -496,17 +561,6 @@ let DefaultAuthMachine = class DefaultAuthMachine extends AbstractMachine {
                             meta: {
                                 content: 'MESSAGE_INCORRECT_CREDENTIALS',
                             },
-                            after: {
-                                feedbackDelay: [
-                                    {
-                                        guard: 'isMfaLoginParams',
-                                        target: '#authMachine.awaitingMfa',
-                                    },
-                                    {
-                                        target: '#authMachine.idle',
-                                    },
-                                ],
-                            },
                         },
                         mfaRequired: {
                             tags: ['feedback', 'mfaRequired'],
@@ -581,9 +635,10 @@ let DefaultAuthMachine = class DefaultAuthMachine extends AbstractMachine {
                     params: ({ context }) => this.convertQueryParamsToLoginParams(context.params),
                 }),
                 setDTO: assign(({ event }) => {
-                    if (isDoneInvokeEvent(event)) {
+                    const dto = authDtoFromMachineEvent(event);
+                    if (dto) {
                         return {
-                            dto: event.output.data,
+                            dto,
                         };
                     }
                 }),
@@ -616,7 +671,7 @@ let DefaultAuthMachine = class DefaultAuthMachine extends AbstractMachine {
                     }
                 },
                 setError,
-                resetContext: assign(() => this.startingContext),
+                resetContext: assign(({ context }) => clearAuthErrorState(context, this.startingContext)),
                 preventSilentAccess: () => __awaiter(this, void 0, void 0, function* () {
                     yield this.cm.preventSilentAccess();
                 }),
@@ -631,7 +686,7 @@ let DefaultAuthMachine = class DefaultAuthMachine extends AbstractMachine {
                         password: loginParams.password,
                     };
                     if (this.cm.validateUserCredentialData(data, true)) {
-                        this.cm.storeCredentials(data);
+                        persistCredentials(this.cm.storeCredentials.bind(this.cm), data);
                     }
                 },
                 postLoginRedirect: this.config.postLoginRedirect,
@@ -652,7 +707,16 @@ let DefaultAuthMachine = class DefaultAuthMachine extends AbstractMachine {
                 hasSSOToken: ({ context }) => isQueryParams(context.params) && context.params.SSO_TOKEN !== undefined,
                 hasMFACode: ({ context }) => isQueryParams(context.params) && context.params.MFA_CODE !== undefined,
                 hasWindowOpener: () => window.opener,
-                isUnauthorizedError: ({ event }) => isErrorEvent(event) ? isUnauthorizedError(event.data) : false,
+                isUnauthorizedError: ({ event }) => {
+                    if (isErrorEvent(event)) {
+                        return isUnauthorizedError(event.data);
+                    }
+                    if (isDoneInvokeEvent(event)) {
+                        const output = event.output;
+                        return (output === null || output === void 0 ? void 0 : output.error) ? isUnauthorizedError(output.error) : false;
+                    }
+                    return false;
+                },
                 isAuthenticated: ({ context }) => { var _a; return (_a = context.user) === null || _a === void 0 ? void 0 : _a.isAuthenticated; },
                 isBanned: ({ context }) => { var _a; return (_a = context.user) === null || _a === void 0 ? void 0 : _a.isBanned(); },
                 isLoginAckEntity: ({ event }) => isDoneInvokeEvent(event) ? isLoginAckEntity(event.output) : false,
@@ -675,13 +739,11 @@ let DefaultAuthMachine = class DefaultAuthMachine extends AbstractMachine {
                 isLogoutNackEntity: ({ event }) => isDoneInvokeEvent(event) ? isLogoutNackEntity(event.output) : false,
                 /**
                  * Required until strict http status codes are enabled on the backend by default.
+                 * Treats EVENT_NACK / ERROR payloads as failure regardless of HTTP status.
                  */
-                is200NackDTO: ({ event }) => {
-                    var _a, _b;
-                    return isDoneInvokeEvent(event)
-                        ? ((_b = (_a = event.output) === null || _a === void 0 ? void 0 : _a.response) === null || _b === void 0 ? void 0 : _b.ok) && isNackDTO(event.output.data)
-                        : false;
-                },
+                is200NackDTO: ({ event }) => isFailedAuthDTO(authDtoFromMachineEvent(event)),
+                isAuthNackEvent: ({ event }) => eventHasAuthNack(event),
+                isFetchFailureOutput: ({ event }) => isFetchFailureOutput(event),
             },
             delays: {
                 feedbackDelay: this.config.feedbackDelay,

package/dist/esm/mapper/utils.js

@@ -107,6 +107,22 @@ export function isNackDTO(dto) {
     var _a;
     return (_a = dto === null || dto === void 0 ? void 0 : dto.MESSAGE_TYPE) === null || _a === void 0 ? void 0 : _a.endsWith('_NACK');
 }
+/**
+ * True when a Genesis payload contains at least one ERROR item.
+ * @public
+ */
+export function hasDTOErrors(dto) {
+    const errors = dto === null || dto === void 0 ? void 0 : dto.ERROR;
+    return Array.isArray(errors) && errors.length > 0;
+}
+/**
+ * True when a Genesis payload must be treated as failure.
+ * HTTP status is intentionally ignored; MESSAGE_TYPE and ERROR are the contract.
+ * @public
+ */
+export function isFailedAuthDTO(dto) {
+    return isNackDTO(dto) || hasDTOErrors(dto);
+}
 /**
  * isNackEntity.
  * @param entity - Potential Nack.

package/dist/esm/mapper/utils.test.js

@@ -0,0 +1,56 @@
+import { APIError } from '@genesislcap/foundation-state-machine';
+import { assert, createLogicSuite } from '@genesislcap/foundation-testing';
+import { StatusCodes } from 'http-status-codes';
+import { nackErrorFromUnknown } from '../machine/errors';
+import { hasDTOErrors, isFailedAuthDTO, isNackDTO } from './utils';
+const Suite = createLogicSuite('password-reset response handling');
+const passwordValidationNack = {
+    WARNING: [],
+    ERROR: [
+        {
+            '@type': 'StandardError',
+            CODE: 'INTERNAL_ERROR',
+            TEXT: 'Password validation failed Password must be 8 or more characters in length.\nPassword must contain 1 or more special characters.',
+            STATUS_CODE: '500 Internal Server Error',
+        },
+    ],
+    MESSAGE_TYPE: 'EVENT_NACK',
+    SOURCE_REF: '17605761-55cb-4b5a-a1ec-7235d3cae393',
+};
+const eventAck = {
+    MESSAGE_TYPE: 'EVENT_ACK',
+    SOURCE_REF: 'ack-ref',
+};
+Suite('detects EVENT_NACK as failure', () => {
+    assert.ok(isNackDTO(passwordValidationNack));
+    assert.ok(isFailedAuthDTO(passwordValidationNack));
+    assert.ok(hasDTOErrors(passwordValidationNack));
+});
+Suite('detects ERROR payload as failure even without NACK suffix', () => {
+    const ackWithErrors = Object.assign(Object.assign({}, eventAck), { ERROR: passwordValidationNack.ERROR });
+    assert.not.ok(isNackDTO(ackWithErrors));
+    assert.ok(hasDTOErrors(ackWithErrors));
+    assert.ok(isFailedAuthDTO(ackWithErrors));
+});
+Suite('treats EVENT_ACK without ERROR as success', () => {
+    assert.not.ok(isNackDTO(eventAck));
+    assert.not.ok(hasDTOErrors(eventAck));
+    assert.not.ok(isFailedAuthDTO(eventAck));
+});
+Suite('extracts strong-password error text from EVENT_NACK', () => {
+    const error = nackErrorFromUnknown(passwordValidationNack);
+    assert.ok(error);
+    assert.ok(error.message.includes('Password validation failed'));
+    assert.is(error.status, StatusCodes.INTERNAL_SERVER_ERROR);
+});
+Suite('extracts NACK from FetchMachineOutput and APIError wrappers', () => {
+    const fromFetch = nackErrorFromUnknown({ data: passwordValidationNack, response: { ok: true } });
+    assert.ok(fromFetch === null || fromFetch === void 0 ? void 0 : fromFetch.message.includes('Password validation failed'));
+    const fromApiError = nackErrorFromUnknown(new APIError(StatusCodes.INTERNAL_SERVER_ERROR, passwordValidationNack));
+    assert.ok(fromApiError === null || fromApiError === void 0 ? void 0 : fromApiError.message.includes('Password validation failed'));
+});
+Suite('does not treat EVENT_ACK as an error', () => {
+    assert.is(nackErrorFromUnknown(eventAck), null);
+    assert.is(nackErrorFromUnknown({ data: eventAck }), null);
+});
+Suite.run();

package/dist/esm/routes/base.js

@@ -53,6 +53,26 @@ export class BaseRoute extends ConfigHostElement {
         super(...arguments);
         this.onBack = () => this.routing.navigateTo('/');
     }
+    connectedCallback() {
+        var _a, _b, _c, _d, _e;
+        super.connectedCallback();
+        (_c = (_b = (_a = this.store) === null || _a === void 0 ? void 0 : _a.formEntry) === null || _b === void 0 ? void 0 : _b.errors) === null || _c === void 0 ? void 0 : _c.clear();
+        if (this.shouldDismissOnConnect) {
+            (_e = (_d = this.store) === null || _d === void 0 ? void 0 : _d.authMachine) === null || _e === void 0 ? void 0 : _e.send({ type: 'dismiss' });
+        }
+    }
+    /**
+     * Skip dismiss while a request or MFA challenge is in flight so route
+     * (re)connect does not cancel the current auth step.
+     */
+    get shouldDismissOnConnect() {
+        var _a;
+        const machine = (_a = this.store) === null || _a === void 0 ? void 0 : _a.authMachine;
+        if (!machine) {
+            return false;
+        }
+        return !machine.hasTag('pending') && !machine.hasTag('awaitingMfa');
+    }
     toLocalisedText(text) {
         return this.i18next.t(`${defaultAuthConfig.name}:${text}`, { lng: this.i18next.language });
     }
@@ -372,7 +392,7 @@ let MessageElement = class MessageElement extends FASTElement {
         const translateHelper = (metaMessage) => this.i18next.t(`${defaultAuthConfig.name}:${metaMessage}`, { lng: this.i18next.language });
         const meta = this.store.metaMessages.map(translateHelper).join('\n');
         const error = this.store.errorMessages.map(translateHelper).join('\n');
-        return !error ? meta : `${meta} ${error}.`;
+        return error || meta;
     }
     get hasError() {
         return this.store.errorMessages.length > 0;

package/dist/esm/routes/forgot-password/forgot-password.js

@@ -3,6 +3,7 @@ import { customElement } from '@microsoft/fast-element';
 import { commonStyles } from '../../styles';
 import { logger } from '../../utils';
 import { BaseRoute } from '../base';
+import { persistResetIdentity } from '../reset-password/reset-identity';
 import { ForgotPasswordTemplate as template } from './forgot-password.template';
 /**
  * ForgotPassword
@@ -20,6 +21,10 @@ let ForgotPassword = class ForgotPassword extends BaseRoute {
             /**
              * Example url from email: https://public-foundation.genesislab.global/reset-password?password=nc_cbGrlgCkZeJHAF043oqEidnk
              */
+            persistResetIdentity({
+                username: this.store.formEntry.username,
+                organisation: this.store.formEntry.organisation,
+            });
             this.$emit('auth-forgot-password', {
                 username: this.store.formEntry.orgUsername,
                 returnUrl: this.routing.getForgotPasswordReturnUrl(),

package/dist/esm/routes/reset-password/reset-identity.js

@@ -0,0 +1,99 @@
+/**
+ * Identity captured during forgot-password so the token reset screen can
+ * submit USER_NAME without asking the user to type it again.
+ */
+export const RESET_IDENTITY_STORAGE_KEY = 'foundation-auth:password-reset-identity';
+const getStorage = (storage) => {
+    if (storage) {
+        return storage;
+    }
+    try {
+        return globalThis.localStorage;
+    }
+    catch (_a) {
+        return undefined;
+    }
+};
+/**
+ * @public
+ */
+export function persistResetIdentity(identity, storage) {
+    var _a, _b;
+    if (!((_a = identity === null || identity === void 0 ? void 0 : identity.username) === null || _a === void 0 ? void 0 : _a.trim())) {
+        return;
+    }
+    const target = getStorage(storage);
+    if (!target) {
+        return;
+    }
+    try {
+        target.setItem(RESET_IDENTITY_STORAGE_KEY, JSON.stringify({
+            username: identity.username.trim(),
+            organisation: ((_b = identity.organisation) === null || _b === void 0 ? void 0 : _b.trim()) || undefined,
+        }));
+    }
+    catch (_c) {
+        // Storage may be unavailable (private mode, SSR).
+    }
+}
+/**
+ * @public
+ */
+export function readResetIdentity(storage) {
+    var _a, _b;
+    const target = getStorage(storage);
+    if (!target) {
+        return undefined;
+    }
+    try {
+        const raw = target.getItem(RESET_IDENTITY_STORAGE_KEY);
+        if (!raw) {
+            return undefined;
+        }
+        const parsed = JSON.parse(raw);
+        if ((_a = parsed === null || parsed === void 0 ? void 0 : parsed.username) === null || _a === void 0 ? void 0 : _a.trim()) {
+            return {
+                username: parsed.username.trim(),
+                organisation: ((_b = parsed.organisation) === null || _b === void 0 ? void 0 : _b.trim()) || undefined,
+            };
+        }
+    }
+    catch (_c) {
+        // Ignore malformed payloads.
+    }
+    return undefined;
+}
+/**
+ * @public
+ */
+export function clearResetIdentity(storage) {
+    const target = getStorage(storage);
+    if (!target) {
+        return;
+    }
+    try {
+        target.removeItem(RESET_IDENTITY_STORAGE_KEY);
+    }
+    catch (_a) {
+        // Storage may be unavailable.
+    }
+}
+/**
+ * @public
+ */
+export function resolveResetUsername(queryParams = {}, stored) {
+    return (queryParams.username ||
+        queryParams.user ||
+        queryParams.USER_NAME ||
+        (stored === null || stored === void 0 ? void 0 : stored.username) ||
+        '').trim();
+}
+/**
+ * Username is required by EVENT_PASSWORD_RESET_ACTION. Hide it only when a
+ * reset token is present and the username is already known.
+ *
+ * @public
+ */
+export function shouldShowIdentityFields(passwordResetToken, username) {
+    return !passwordResetToken || !username.trim();
+}

package/dist/esm/routes/reset-password/reset-identity.test.js

@@ -0,0 +1,55 @@
+import { assert, createLogicSuite } from '@genesislcap/foundation-testing';
+import { clearResetIdentity, persistResetIdentity, readResetIdentity, resolveResetUsername, RESET_IDENTITY_STORAGE_KEY, shouldShowIdentityFields, } from './reset-identity';
+const Suite = createLogicSuite('reset-identity');
+const createMemoryStorage = () => {
+    const map = new Map();
+    return {
+        get length() {
+            return map.size;
+        },
+        clear: () => map.clear(),
+        getItem: (key) => { var _a; return (_a = map.get(key)) !== null && _a !== void 0 ? _a : null; },
+        key: (index) => { var _a; return (_a = [...map.keys()][index]) !== null && _a !== void 0 ? _a : null; },
+        removeItem: (key) => {
+            map.delete(key);
+        },
+        setItem: (key, value) => {
+            map.set(key, value);
+        },
+    };
+};
+Suite('hides username when token is present and username is known', () => {
+    assert.not.ok(shouldShowIdentityFields('reset-token', 'JaneDee'));
+});
+Suite('shows username when token is present but username is missing', () => {
+    assert.ok(shouldShowIdentityFields('reset-token', ''));
+    assert.ok(shouldShowIdentityFields('reset-token', '   '));
+});
+Suite('shows username when token is absent', () => {
+    assert.ok(shouldShowIdentityFields('', 'JaneDee'));
+    assert.ok(shouldShowIdentityFields(undefined, ''));
+});
+Suite('resolves username from query params before stored identity', () => {
+    const stored = { username: 'stored-user' };
+    assert.is(resolveResetUsername({ username: 'query-user' }, stored), 'query-user');
+    assert.is(resolveResetUsername({ user: 'alias-user' }, stored), 'alias-user');
+    assert.is(resolveResetUsername({ USER_NAME: 'legacy-user' }, stored), 'legacy-user');
+});
+Suite('resolves username from stored identity when query has no username', () => {
+    assert.is(resolveResetUsername({ password: 'token' }, { username: 'stored-user' }), 'stored-user');
+    assert.is(resolveResetUsername({ password: 'token' }), '');
+});
+Suite('persists, reads and clears reset identity', () => {
+    const storage = createMemoryStorage();
+    persistResetIdentity({ username: ' JaneDee ', organisation: ' FBN ' }, storage);
+    assert.equal(readResetIdentity(storage), { username: 'JaneDee', organisation: 'FBN' });
+    assert.ok(storage.getItem(RESET_IDENTITY_STORAGE_KEY));
+    clearResetIdentity(storage);
+    assert.is(readResetIdentity(storage), undefined);
+});
+Suite('does not persist empty username', () => {
+    const storage = createMemoryStorage();
+    persistResetIdentity({ username: '  ' }, storage);
+    assert.is(readResetIdentity(storage), undefined);
+});
+Suite.run();

package/dist/esm/routes/reset-password/reset-password.js

@@ -2,6 +2,7 @@ import { __awaiter, __decorate } from "tslib";
 import { customElement, observable, volatile } from '@microsoft/fast-element';
 import { commonStyles } from '../../styles';
 import { BaseRoute } from '../base';
+import { readResetIdentity, resolveResetUsername, shouldShowIdentityFields, } from './reset-identity';
 import { ResetPasswordTemplate as template } from './reset-password.template';
 /**
  * ResetPassword
@@ -26,6 +27,21 @@ let ResetPassword = class ResetPassword extends BaseRoute {
     enter(phase) {
         this.hasPasswordExpired = !!phase.route.queryParams.expired;
         this.passwordResetToken = phase.route.queryParams.password;
+        this.applyResetIdentity(phase.route.queryParams);
+    }
+    applyResetIdentity(queryParams) {
+        if (!this.passwordResetToken) {
+            return;
+        }
+        const stored = readResetIdentity();
+        const username = resolveResetUsername(queryParams, stored);
+        if (username) {
+            this.store.formEntry.onUsernameChanged(new CustomEvent('auth-username-changed', { detail: username }));
+        }
+        const organisation = queryParams.organisation || (stored === null || stored === void 0 ? void 0 : stored.organisation);
+        if (organisation) {
+            this.store.formEntry.onOrganisationChanged(new CustomEvent('auth-organisation-changed', { detail: organisation }));
+        }
     }
     onSubmit() {
         return __awaiter(this, void 0, void 0, function* () {
@@ -53,6 +69,9 @@ let ResetPassword = class ResetPassword extends BaseRoute {
     get headingText() {
         return this.hasPasswordExpired ? 'You are required to change your password' : 'Change Password';
     }
+    get showIdentityFields() {
+        return shouldShowIdentityFields(this.passwordResetToken, this.store.formEntry.username);
+    }
 };
 __decorate([
     observable
@@ -63,6 +82,9 @@ __decorate([
 __decorate([
     volatile
 ], ResetPassword.prototype, "headingText", null);
+__decorate([
+    volatile
+], ResetPassword.prototype, "showIdentityFields", null);
 ResetPassword = __decorate([
     customElement({
         name: 'foundation-auth-reset-password',