Kitto.Web.Handler.Auth

Self-contained attribute-based handler for the authentication family (Sprint E.1.d of the routing refactor): login, reset-password, change-password and logout. Replaces the delegating handler that used to live in Kitto.Html.Login and call TKWebApplication.HandleKX*Request.

The endpoints are [TKXAnonymous] (reachable without prior authentication) and the orchestration is split into virtual hooks so an application can override individual steps by deriving from TKXAuthHandlerBase — e.g. to accept an identity minted by a host web app instead of the built-in login.

The login PAGE (GET '/') is still served by TKWebApplication.Home; this unit only handles the POST/action endpoints under /kx.

TKXAuthHandlerBase class

Default auth handler. Register in the resource registry; applications override behaviour by subclassing and overriding a hook (or a whole endpoint method).

procedure HandleLogin;

POST form fields: UserName, Password, Language, DatabaseName.

procedure HandleResetPassword;

POST form fields: UserName, EmailAddress. Triggers a password reset for the matching user and shows a confirmation (or error) dialog.

procedure HandleChangePassword;

POST form fields: OldPassword, NewPassword, ConfirmNewPassword. Validates and applies the new password, then logs out and redirects to the login page.

procedure HandleLogout;

Ends the current session. Canonical endpoint the menu renderers post to (see GetMenuActionVerb). POST only: a cross-site GET (a link or an <img>) must not be able to log the user out (logout-CSRF).

procedure HandleReloadHome;

Announces a page reload issued by the application, so that the root does not end the session when it serves the reloaded page. Counterpart of /logout: that one drops the credential, this one keeps it across a reload the user did not ask for.

Reaching the root drops the credential on purpose, so that a fresh page load starts from the login. Server-side paths that send the user back to the home raise ReloadingHome themselves; a reload started from the browser cannot, because by the time it reaches the root there is no earlier request in which to raise it. This endpoint is that earlier request: the client POSTs here and only then calls location.reload(). It backs the [Reset] / [Retry] buttons of the standard error dialog (kxReloadApp in kxgrid.js), which reload to recover from a transient failure on a session that is still valid.

It grants nothing: the flag is raised only for an already authenticated session and merely stops a valid credential from being dropped. It is one-shot, cleared by ServeHomePage, so a second reload — the user pressing F5 — signs out as it should. [TKXAnonymous] so the call never fails on the login page, where the same dialog can appear.