fix: force password change before app access

chat_interface.py

@@ -4868,8 +4868,34 @@ def create_chat_interface():
         population_code_state = gr.State("")
         live_progress_state = gr.State("")
         demo_pack_state = gr.State("")
+
+        with gr.Group(visible=False) as password_gate:
+            gr.Markdown("""
+            ## Change Password Required
+
+            You are signed in with a temporary password. Set a new password before using DemoPrep.
+            """)
+            with gr.Row():
+                with gr.Column(scale=1):
+                    gate_current_password = gr.Textbox(
+                        label="Temporary Password",
+                        type="password",
+                        placeholder="Enter the password you just used to sign in",
+                    )
+                    gate_new_password = gr.Textbox(
+                        label="New Password",
+                        type="password",
+                        placeholder="At least 8 characters",
+                    )
+                    gate_confirm_password = gr.Textbox(
+                        label="Confirm New Password",
+                        type="password",
+                        placeholder="Repeat new password",
+                    )
+                    gate_change_password_btn = gr.Button("Change Password", variant="primary")
+                    gate_password_status = gr.Markdown("")
         
-        with gr.Tabs():
+        with gr.Tabs(visible=False) as main_tabs:
             with gr.Tab("📱 App"):
                 chat_components = create_chat_tab(
                     chat_controller_state, default_settings, current_stage, current_model, 
@@ -5442,6 +5468,56 @@ def create_chat_interface():
             inputs=[],
             outputs=admin_outputs
         )
+
+        def check_password_gate(request: gr.Request = None):
+            """Show only the forced password-change panel for temp-password users."""
+            try:
+                user_email = require_authenticated_email(request)
+                from supabase_client import UserManager
+                um = UserManager()
+                must_change = um.enabled and um.must_change_password(user_email)
+                return gr.update(visible=must_change), gr.update(visible=not must_change)
+            except Exception as e:
+                print(f"[LOAD] password gate check skipped: {e}")
+                return gr.update(visible=False), gr.update(visible=True)
+
+        def complete_required_password_change(current, new_pw, confirm, request: gr.Request = None):
+            if not current or not new_pw or not confirm:
+                return "❌ All fields are required.", gr.update(), gr.update()
+            if new_pw != confirm:
+                return "❌ New passwords don't match.", gr.update(), gr.update()
+            if len(new_pw) < 8:
+                return "❌ New password must be at least 8 characters.", gr.update(), gr.update()
+            try:
+                user_email = require_authenticated_email(request)
+                from supabase_client import UserManager
+                um = UserManager()
+                if not um.enabled:
+                    return "⚠️ Supabase not configured — password change unavailable.", gr.update(), gr.update()
+                if not um.authenticate(user_email, current):
+                    return "❌ Temporary password is incorrect.", gr.update(), gr.update()
+                if not um.reset_password(user_email, new_pw, must_change_password=False):
+                    return "❌ Password change failed. Please try again or ask an admin to reset it.", gr.update(), gr.update()
+                um.clear_must_change_password(user_email)
+                return (
+                    "✅ Password changed. DemoPrep is ready.",
+                    gr.update(visible=False),
+                    gr.update(visible=True),
+                )
+            except Exception as e:
+                return f"❌ Error: {e}", gr.update(), gr.update()
+
+        interface.load(
+            fn=check_password_gate,
+            inputs=[],
+            outputs=[password_gate, main_tabs],
+        )
+
+        gate_change_password_btn.click(
+            fn=complete_required_password_change,
+            inputs=[gate_current_password, gate_new_password, gate_confirm_password],
+            outputs=[gate_password_status, password_gate, main_tabs],
+        )
         
         # Create update function for tabs
         _spotter_waiting = "Story will be generated after liveboard creation."
@@ -5885,6 +5961,8 @@ def create_chat_tab(chat_controller_state, settings, current_stage, current_mode
                         controller.settings['thoughtspot_url'] = _url
                     if _key_value:
                         controller.settings['thoughtspot_trusted_auth_key'] = _key_value
+            elif username:
+                controller.user_email = username
             # Always use the current UI values — take priority over DB-loaded defaults
             if liveboard_name_ui is not None:
                 controller.settings['liveboard_name'] = liveboard_name_ui
@@ -5957,6 +6035,8 @@ def create_chat_tab(chat_controller_state, settings, current_stage, current_mode
                         controller.settings['thoughtspot_url'] = _url
                     if _key_value:
                         controller.settings['thoughtspot_trusted_auth_key'] = _key_value
+            elif username:
+                controller.user_email = username
             if lb_name is not None:
                 controller.settings['liveboard_name'] = lb_name
             if model:
@@ -5988,6 +6068,23 @@ def create_chat_tab(chat_controller_state, settings, current_stage, current_mode
 
             is_custom = (vertical == "* CUSTOM *")
             hide_welcome = gr.update(visible=False)
+            password_block = controller._temporary_password_block_message()
+            if password_block:
+                history = history or []
+                history.append(("GO", password_block))
+                controller.phase_log = ["Password change required before starting pipeline."]
+                yield (
+                    controller,
+                    gr.update(value=history, visible=True),
+                    stage,
+                    model,
+                    company,
+                    usecase,
+                    get_progress_html(stage),
+                    hide_welcome,
+                    gr.update(open=False),
+                )
+                return
 
             if is_custom:
                 # Custom: context field drives the use case