feat(web): change password (#7676)

Add the ability for users to change their password from their user settings, without requiring them to use the reset password workflow. User's are required to create a elevated session in order to change their password. Users may not change their password to their current password. The user's current password is required for the password change. Users must follow any established password policies. Administrators are able to turn this feature off.

Closes #3548

1 files changed, 25 insertions, 3 deletions

diff --git a/internal/handlers/util.go b/internal/handlers/util.go
index 9a137f6a1..92c7e2d28 100644
--- a/internal/handlers/util.go
+++ b/internal/handlers/util.go
@@ -2,6 +2,7 @@ package handlers
 
 import (
 	"fmt"
+	"strings"
 
 	"github.com/authelia/authelia/v4/internal/authentication"
 	"github.com/authelia/authelia/v4/internal/middlewares"
@@ -21,9 +22,10 @@ const (
 	eventEmailAction2FAAddedSuffix   = "was added to your account."
 	eventEmailAction2FARemovedSuffix = "was removed from your account."
 
-	eventEmailActionPasswordResetPrefix = "your"
-	eventEmailActionPasswordReset       = "Password Reset"
-	eventEmailActionPasswordResetSuffix = "was successful."
+	eventEmailActionPasswordModifyPrefix = "your"
+	eventEmailActionPasswordReset        = "Password Reset"
+	eventEmailActionPasswordChange       = "Password Change"
+	eventEmailActionPasswordModifySuffix = "was successful."
 
 	eventLogCategoryOneTimePassword    = "One-Time Password"
 	eventLogCategoryWebAuthnCredential = "WebAuthn Credential" //nolint:gosec
@@ -75,3 +77,23 @@ func ctxLogEvent(ctx *middlewares.AutheliaCtx, username, description string, bod
 		return
 	}
 }
+
+func redactEmail(email string) string {
+	parts := strings.Split(email, "@")
+	if len(parts) != 2 {
+		return ""
+	}
+
+	localPart := parts[0]
+	domain := parts[1]
+
+	if len(localPart) <= 2 {
+		return strings.Repeat("*", len(localPart)) + "@" + domain
+	}
+
+	first := string(localPart[0])
+	last := string(localPart[len(localPart)-1])
+	middle := strings.Repeat("*", len(localPart)-2)
+
+	return first + middle + last + "@" + domain
+}