DEV: Disable reset password button for staged users (#34628)

By design, staged users can't receive reset password e-mails.

This PR just disables the button in the UI to avoid confusion.

It also adds a text explanation when it is disabled.

app/assets/javascripts/discourse/app/controllers/preferences/security.js

@@ -42,6 +42,11 @@ export default class SecurityController extends Controller {
     ).canCheckEmails;
   }
 
+  @computed("model.staged")
+  get canResetPassword() {
+    return !this.model.staged;
+  }
+
   get isCurrentUser() {
     return this.currentUser?.id === this.model.id;
   }

app/assets/javascripts/discourse/app/templates/preferences/security.gjs

@@ -2,6 +2,7 @@ import { fn } from "@ember/helper";
 import { on } from "@ember/modifier";
 import { htmlSafe } from "@ember/template";
 import RouteTemplate from "ember-route-template";
+import { not } from "truth-helpers";
 import AuthTokenDropdown from "discourse/components/auth-token-dropdown";
 import DButton from "discourse/components/d-button";
 import PluginOutlet from "discourse/components/plugin-outlet";
@@ -22,9 +23,9 @@ export default RouteTemplate(
       >
         <label class="control-label">{{i18n "user.password.title"}}</label>
         <div class="controls">
-          <a
-            href
+          <button
             {{on "click" @controller.changePassword}}
+            disabled={{not @controller.canResetPassword}}
             class="btn btn-default"
             id="change-password-button"
           >
@@ -34,7 +35,13 @@ export default RouteTemplate(
             {{else}}
               {{i18n "user.change_password.action"}}
             {{/if}}
-          </a>
+          </button>
+
+          {{#unless @controller.canResetPassword}}
+            <div class="instructions">
+              {{i18n "user.change_password.staged_user"}}
+            </div>
+          {{/unless}}
 
           {{@controller.passwordProgress}}
         </div>

config/locales/client.en.yml

@@ -1786,6 +1786,7 @@ en:
         in_progress: "(sending email)"
         error: "(error)"
         action: "Send Password Reset Email"
+        staged_user: "Staged users can not receive password reset emails."
         set_password: "Set Password"
         choose_new: "Choose a new password"
         choose: "Choose a password"

spec/system/user_page/user_preferences_security_spec.rb

@@ -3,7 +3,9 @@
 describe "User preferences | Security", type: :system do
   fab!(:password) { "kungfukenny" }
   fab!(:email) { "email@user.com" }
+  fab!(:admin)
   fab!(:user) { Fabricate(:user, email: email, password: password) }
+  fab!(:staged_user) { Fabricate(:user, staged: true) }
   let(:user_preferences_security_page) { PageObjects::Pages::UserPreferencesSecurity.new }
   let(:user_menu) { PageObjects::Components::UserMenu.new }
 
@@ -155,4 +157,30 @@ describe "User preferences | Security", type: :system do
     include_examples "passkeys"
     include_examples "enforced second factor"
   end
+
+  context "when viewing a user's page as an admin" do
+    before { sign_in(admin) }
+
+    describe "password reset" do
+      it "disables the password reset button for staged users" do
+        visit("/u/#{staged_user.username}/preferences/security")
+
+        expect(page.find("#change-password-button")).to be_disabled
+        expect(page).to have_css(
+          ".instructions",
+          text: I18n.t("js.user.change_password.staged_user"),
+        )
+      end
+
+      it "does not disable password reset for non-staged users" do
+        visit("/u/#{user.username}/preferences/security")
+
+        expect(page.find("#change-password-button")).not_to be_disabled
+        expect(page).to have_no_css(
+          ".instructions",
+          text: I18n.t("js.user.change_password.staged_user"),
+        )
+      end
+    end
+  end
 end