Passwords, profiles & sessions
Reset, expiry, change, self-service profile, and force-logout.
Password reset, expiry & change #
| Flow | How it works |
|---|---|
| Forgot password | requestPasswordReset(email) emails a 6-digit code → confirmPasswordReset(email, code, newPass). Always reports success. |
| Expired password | login returns goToExpirePass:1 with no token → resolveExpiredPassword(username, current, new), then sign in again. |
| Change password | Signed in: changePassword(current, new). If "force logout on password change" is on (default), every session ends and the user re-signs-in. |
The my-account profile #
tada.me.get() returns the signed-in user's own Users-table record; tada.me.update(fields) saves a partial change. Identity comes from the session token, so a user can only ever read or write their own record.
Active sessions #
You can build a "my sessions" surface from the active_session log and let a user (or an admin) end sessions with tada.sessions.terminate. Handy for "sign out everywhere" after a lost device.