The Change Server Password dialog asks for the Current Password and refuses to submit without one, even when the server connects via a pgpass file and the user therefore has no reason to know that password. Anything typed into the field is then discarded, because the backend deliberately skips the check in that case, so the field is pure friction rather than a real requirement.
The intended behaviour is already written down in ChangePasswordContent.jsx, where the Current Password field is declared as disabled: self.isPgpassFileUsed and noEmpty: !self.isPgpassFileUsed, and the backend agrees: change_password() in web/pgadmin/browser/server_groups/servers/__init__.py detects the pgpass case and skips both the presence check and the comparison against the old password.
The reason it does not work is that the flag never arrives. showChangeServerPassword() passes isPgpassFileUsed={isPgPassFileUsed} to ChangePasswordContent, but the component does not accept that prop, and constructs its schema with the value hardcoded to false:
schema.current = new ChangePasswordSchema(
userName, false, hasCsrfToken, showUser
);
So isPgpassFileUsed is always false, the field is always enabled, and it is always mandatory.
This has been the case since d6cddd8 (30th June 2023), which generalised the component for the rewritten authentication pages and dropped both userName and isPgpassFileUsed from its signature. The userName half of that regression, which left the User field blank, was fixed in 43d8b3f; this is the other half.
Suggested fix
Accept isPgpassFileUsed as a prop, defaulting to false, pass it through to the schema constructor in place of the literal, and add it back to propTypes. Worth noting that it changes form validation rather than only wording, so it wants a test covering both the pgpass and the ordinary password case, which is why it was left out of the rename in #10035 rather than folded in.
Whilst in there, hasCsrfToken deserves a look too: showChangeUserPassword() sets it, but the pgpass path does not, and the dialog's save button is labelled with a bare 'Change' that is never passed through gettext(), so it is not translated.
The Change Server Password dialog asks for the Current Password and refuses to submit without one, even when the server connects via a pgpass file and the user therefore has no reason to know that password. Anything typed into the field is then discarded, because the backend deliberately skips the check in that case, so the field is pure friction rather than a real requirement.
The intended behaviour is already written down in
ChangePasswordContent.jsx, where the Current Password field is declared asdisabled: self.isPgpassFileUsedandnoEmpty: !self.isPgpassFileUsed, and the backend agrees:change_password()inweb/pgadmin/browser/server_groups/servers/__init__.pydetects the pgpass case and skips both the presence check and the comparison against the old password.The reason it does not work is that the flag never arrives.
showChangeServerPassword()passesisPgpassFileUsed={isPgPassFileUsed}toChangePasswordContent, but the component does not accept that prop, and constructs its schema with the value hardcoded tofalse:So
isPgpassFileUsedis always false, the field is always enabled, and it is always mandatory.This has been the case since d6cddd8 (30th June 2023), which generalised the component for the rewritten authentication pages and dropped both
userNameandisPgpassFileUsedfrom its signature. TheuserNamehalf of that regression, which left the User field blank, was fixed in 43d8b3f; this is the other half.Suggested fix
Accept
isPgpassFileUsedas a prop, defaulting tofalse, pass it through to the schema constructor in place of the literal, and add it back topropTypes. Worth noting that it changes form validation rather than only wording, so it wants a test covering both the pgpass and the ordinary password case, which is why it was left out of the rename in #10035 rather than folded in.Whilst in there,
hasCsrfTokendeserves a look too:showChangeUserPassword()sets it, but the pgpass path does not, and the dialog's save button is labelled with a bare'Change'that is never passed throughgettext(), so it is not translated.