[Dmitry-Kucher]

SUMMARY

ENABLE_FORCE_PASSWORD_CHANGE (#40669) redirects users flagged with password_must_change to their profile page until they choose a new password. Nothing in the tree ever raises that flag, though: set_password_must_change() has no caller, and #40669 left wiring it to administrator flows as a follow-up. Turning the setting on therefore enforces nothing.

This PR raises the flag in SupersetUserApi, which backs the Users list (and, since #44626, every administrator password reset):

• pre_add (POST /api/v1/security/users/): a user created by an administrator starts on a password the administrator chose.
• pre_update (PUT /api/v1/security/users/<pk>): an administrator setting another user's password hands out a temporary one. An administrator changing their own password has chosen it, so a pending change of theirs is cleared instead, as on /api/v1/me/.

Design notes:

• Only while ENABLE_FORCE_PASSWORD_CHANGE is on. Otherwise enabling the setting later would retroactively lock out every account an administrator ever set a password for.
• Only under AUTH_DB. With OAuth/LDAP/remote-user auth, the password set in the Users list is not the one users sign in with, so forcing a change would only lock pre-provisioned users out.
• No early commit. set_password_must_change() is @transaction()-wrapped, so calling it from pre_add/pre_update would commit the half-applied user edit before FAB's own commit. The write goes through a new non-committing write_password_must_change() helper instead, so it rides FAB's commit, the same way invalidate_sessions_for_user and the subject sync already do there.
• The self-service paths (PUT /api/v1/me/, password recovery) already clear the flag, so the lifecycle closes.

UPDATING.md and the ENABLE_FORCE_PASSWORD_CHANGE comment in config.py are updated.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

N/A (backend; the redirect UI already exists).

TESTING INSTRUCTIONS

pytest tests/unit_tests/security/test_admin_password_forces_change.py

Covers: admin create and admin password change raise the flag; self-edit doesn't (and clears a pending flag); non-password edit, setting off, and non-DB auth don't; and no commit is issued from pre_update. The tests call pre_add/pre_update directly with a stand-in acting user, as the neighbouring SupersetUserApi tests do; there is no unit-level HTTP harness for this API.

Manual: set ENABLE_FORCE_PASSWORD_CHANGE = True. As admin, set a new password for another user from Settings → List Users → Edit. Log in as that user: you're redirected to the profile page to choose a new password, and after changing it, normal access resumes.

ADDITIONAL INFORMATION

• Has associated issue:
• Required feature flags: ENABLE_FORCE_PASSWORD_CHANGE (config, off by default)
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
• Introduces new feature or API
• Removes existing feature or API

[codeant-ai-for-open-source]

  CodeAnt PR Risk

🟢  Low Risk

• The PR appears safe to merge; no actionable issues were identified in the review.

Assessed commit: b92eb7228288

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.85%. Comparing base (ffdf7a4) to head (b92eb72).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@             Coverage Diff             @@
##           master   #45702       +/-   ##
===========================================
+ Coverage   65.38%   84.85%   +19.46%     
===========================================
  Files        3080     3073        -7     
  Lines      209437   208108     -1329     
  Branches    49385    48752      -633     
===========================================
+ Hits       136950   176597    +39647     
+ Misses      69350    28131    -41219     
- Partials     3137     3380      +243     

Flag	Coverage Δ
hive	34.19% <20.00%> (-0.01%)	⬇️
mysql	52.02% <40.00%> (-0.01%)	⬇️
postgres	52.03% <40.00%> (?)
presto	35.85% <20.00%> (-0.01%)	⬇️
python	87.96% <100.00%> (+35.73%)	⬆️
sqlite	51.78% <40.00%> (-0.01%)	⬇️
unit	82.91% <100.00%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sadpandajoe]

LGTM but will approve once conflicts are resolved

[Dmitry-Kucher]

@sadpandajoe Conflicts are resolved and the branch is updated with master. All 753 security unit tests and pre-commit checks pass locally. Ready for another look — thanks!