From 96ed09f0ccfa854763d7ce98d41de26bab2394cc Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Thu, 29 Oct 2026 18:16:00 +0100
Subject: [PATCH] fix(auth): clear forced password reset after a password reset

An invited user who set a password with Forgot password kept the forced
reset flag. A re-invite then replaced the password, and a revoked or
expired invitation deleted the account.
---
 app/Actions/Fortify/ResetUserPassword.php    |  1 +
 tests/Feature/Auth/ResetUserPasswordTest.php | 34 ++++++++++++++++++++
 2 files changed, 35 insertions(+)
 create mode 100644 tests/Feature/Auth/ResetUserPasswordTest.php

diff --git a/app/Actions/Fortify/ResetUserPassword.php b/app/Actions/Fortify/ResetUserPassword.php
index 5baa8b7ed2..d7a6e5a4a0 100644
--- a/app/Actions/Fortify/ResetUserPassword.php
+++ b/app/Actions/Fortify/ResetUserPassword.php
@@ -23,6 +23,7 @@ class ResetUserPassword implements ResetsUserPasswords
 
         $user->fill([
             'password' => Hash::make($input['password']),
+            'force_password_reset' => false,
         ])->save();
         $user->deleteAllSessions();
     }
diff --git a/tests/Feature/Auth/ResetUserPasswordTest.php b/tests/Feature/Auth/ResetUserPasswordTest.php
new file mode 100644
index 0000000000..52e1dd0fb9
--- /dev/null
+++ b/tests/Feature/Auth/ResetUserPasswordTest.php
@@ -0,0 +1,34 @@
+<?php
+
+use App\Models\InstanceSettings;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Password;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config()->set('app.maintenance.store', 'array');
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0]));
+});
+
+it('clears the forced password reset of an invited user who resets the password', function () {
+    $user = User::factory()->create([
+        'email' => 'invitee@example.com',
+        'email_verified_at' => null,
+        'force_password_reset' => true,
+    ]);
+
+    $this->post(route('password.update'), [
+        'token' => Password::createToken($user),
+        'email' => $user->email,
+        'password' => 'Own-Passw0rd!',
+        'password_confirmation' => 'Own-Passw0rd!',
+    ])->assertSessionHasNoErrors();
+
+    $user->refresh();
+    expect(Hash::check('Own-Passw0rd!', $user->password))->toBeTrue()
+        ->and($user->force_password_reset)->toBeFalse()
+        ->and($user->isUnusedInvitedAccount())->toBeFalse();
+});