clay-server 2.36.2-beta.4 → 2.36.2-beta.6

package/lib/pages.js

@@ -964,7 +964,9 @@ function multiUserLoginPageHtml() {
     'body:JSON.stringify({username:usernameEl.value,pin:pinEl.value})})' +
     '.then(function(r){return r.json()})' +
     '.then(function(d){' +
-    'if(d.ok&&d.mustChangePin){showChangePinOverlay();return}' +
+    // mustChangePin is handled by the main app overlay
+    // (showForceChangePinOverlay in app-misc.js): it has a logout escape
+    // hatch and proper error display. Reload either way to enter it.
     'if(d.ok){location.reload();return}' +
     'if(d.locked){var boxes=document.querySelectorAll(".pin-digit");' +
     'for(var i=0;i<boxes.length;i++)boxes[i].disabled=true;' +
@@ -976,34 +978,6 @@ function multiUserLoginPageHtml() {
     '.catch(function(){errs[1].textContent="Connection error";btns[1].disabled=false})}' +
     'btns[1].onclick=doLogin;' +
 
-    // Force PIN change: reuse the same login screen, switch step1 to "Set new PIN" mode
-    'function showChangePinOverlay(){' +
-    // Hide step dots (no longer a 2-step flow)
-    'var bar=document.querySelector(".steps-bar");if(bar)bar.style.display="none";' +
-    // Hide step 0 (username), show step 1 (PIN) with new labels
-    'steps[0].classList.remove("active");' +
-    'steps[1].classList.add("active");' +
-    'var h1=steps[1].querySelector("h1");if(h1)h1.textContent="Set your new PIN";' +
-    'var sub=steps[1].querySelector(".sub");if(sub)sub.textContent="Your temporary PIN has expired. Please set a new 6-digit PIN to continue.";' +
-    'btns[1].textContent="Save PIN";' +
-    // Re-init PIN boxes for fresh input
-    'resetPin();' +
-    'initPinBoxes("pin-boxes","pin",function(){if(!btns[1].disabled)doSaveNewPin()});' +
-    'var boxes=document.querySelectorAll(".pin-digit");' +
-    'for(var i=0;i<boxes.length;i++)boxes[i].addEventListener("input",function(){btns[1].disabled=pinEl.value.length!==6});' +
-    // Override button handler to save new PIN instead of login
-    'btns[1].onclick=doSaveNewPin;' +
-    'function doSaveNewPin(){' +
-    'btns[1].disabled=true;errs[1].textContent="";' +
-    'fetch("/api/user/pin",{method:"PUT",headers:{"Content-Type":"application/json"},' +
-    'body:JSON.stringify({newPin:pinEl.value})})' +
-    '.then(function(r){return r.json()})' +
-    '.then(function(d){' +
-    'if(d.ok){location.reload();return}' +
-    'errs[1].textContent=d.error||"Failed to save PIN";btns[1].disabled=false})' +
-    '.catch(function(){errs[1].textContent="Connection error";btns[1].disabled=false})}' +
-    '}' +
-
     '</script></div></body></html>';
 }
 

package/lib/public/modules/app-misc.js

@@ -320,6 +320,7 @@ export function showForceChangePinOverlay() {
     '</div>' +
     '<button id="fcp-save" disabled style="width:100%;padding:12px;border:none;border-radius:10px;background:var(--accent);color:#fff;font-size:15px;font-weight:600;cursor:pointer;opacity:0.5;transition:opacity 0.15s">Save PIN</button>' +
     '<div id="fcp-err" style="margin-top:12px;color:var(--error,#ef4444);font-size:13px;min-height:1.3em"></div>' +
+    '<button id="fcp-logout" type="button" style="margin-top:8px;background:none;border:none;color:var(--text-dimmer,#888);font-size:13px;cursor:pointer;text-decoration:underline">Log out and start over</button>' +
     '</div>';
   document.body.appendChild(ov);
 
@@ -417,6 +418,17 @@ export function showForceChangePinOverlay() {
     });
   }
   saveBtn.addEventListener("click", doSave);
+
+  var logoutBtn = ov.querySelector("#fcp-logout");
+  if (logoutBtn) {
+    logoutBtn.addEventListener("click", function () {
+      fetch("/auth/logout", { method: "POST" }).then(function () {
+        location.href = "/";
+      }).catch(function () {
+        location.href = "/";
+      });
+    });
+  }
 }
 
 export function sendExtensionCommand(command, args, requestId) {

package/lib/server-settings.js

@@ -332,7 +332,12 @@ function attachSettings(ctx) {
             res.end('{"error":"PIN must be exactly 6 digits"}');
             return;
           }
-          if (mu.pinHash) {
+          // Forced PIN change after temporary PIN login: skip currentPin
+          // verification. The user authenticated with the temp PIN to
+          // establish this session, so requiring them to re-enter it adds
+          // friction without security benefit. The session cookie is the
+          // proof of possession.
+          if (mu.pinHash && !mu.mustChangePin) {
             if (!data.currentPin || typeof data.currentPin !== "string" || !/^\d{6}$/.test(data.currentPin)) {
               res.writeHead(400, { "Content-Type": "application/json" });
               res.end('{"error":"Current PIN is required"}');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "2.36.2-beta.4",
+  "version": "2.36.2-beta.6",
   "description": "Self-hosted team workspace for Claude Code and Codex. Multi-user, browser-based, with persistent AI mates.",
   "bin": {
     "clay-server": "./bin/cli.js",