From ff8b3421f4b999ff0aa0ae6bb82a0367ccd24075 Mon Sep 17 00:00:00 2001
From: edalzell <erin@silentz.co>
Date: Tue, 10 May 2022 20:42:49 -0700
Subject: [PATCH 01/23] user update route

---
 routes/web.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/routes/web.php b/routes/web.php
index 0839506aa7c..b92cb349fd8 100755
--- a/routes/web.php
+++ b/routes/web.php
@@ -34,6 +34,7 @@
             Route::post('login', 'UserController@login')->name('login');
             Route::get('logout', 'UserController@logout')->name('logout');
             Route::post('register', 'UserController@register')->name('register');
+            Route::post('update', 'UserController@update')->name('user.update');
 
             Route::post('password/email', 'ForgotPasswordController@sendResetLinkEmail')->name('password.email');
             Route::get('password/reset/{token}', 'ResetPasswordController@showResetForm')->name('password.reset');

From 111ea20e68ea9e7594a147e4023d0d19f974494f Mon Sep 17 00:00:00 2001
From: edalzell <erin@silentz.co>
Date: Tue, 10 May 2022 20:43:25 -0700
Subject: [PATCH 02/23] form (wip)

---
 src/Auth/UserTags.php | 38 +++++++++++++++++++++++++++++++++++++-
 1 file changed, 37 insertions(+), 1 deletion(-)

diff --git a/src/Auth/UserTags.php b/src/Auth/UserTags.php
index d1c1c30fdea..051a1ca7dd7 100644
--- a/src/Auth/UserTags.php
+++ b/src/Auth/UserTags.php
@@ -276,6 +276,42 @@ public function resetPasswordForm()
         return $html;
     }
 
+    /**
+     * Output a update form.
+     *
+     * Maps to {{ user:update_form }}
+     *
+     * @return string
+     */
+    public function updateForm()
+    {
+        if (session()->has('status')) {
+            return $this->parse(['success' => true]);
+        }
+
+        $data = $this->getFormSession();
+
+        if (! $this->params->has('redirect')) {
+            $this->params->put('redirect', request()->getPathInfo());
+        }
+
+        $knownParams = ['redirect'];
+
+        $html = $this->formOpen(route('statamic.user.update'), 'POST', $knownParams);
+
+        $html .= '<input type="hidden" name="token" value="'.request('token').'" />';
+
+        if ($redirect = $this->params->get('redirect')) {
+            $html .= '<input type="hidden" name="redirect" value="'.$redirect.'" />';
+        }
+
+        $html .= $this->parse($data);
+
+        $html .= $this->formClose();
+
+        return $html;
+    }
+
     /**
      * Displays content if a user has permission.
      *
@@ -424,7 +460,7 @@ public function notIn()
     }
 
     /**
-     * {@inheritdoc}
+     * @inheritdoc
      */
     public function eventUrl($url, $relative = false)
     {

From 7744387e7160e56354977dd8599f3fd0ce533126 Mon Sep 17 00:00:00 2001
From: Jack Sleight <jacksleight@gmail.com>
Date: Fri, 29 Jul 2022 17:10:48 +0100
Subject: [PATCH 03/23] WIP

---
 routes/web.php                          |  3 +-
 src/Auth/UserTags.php                   | 44 +++++++++--
 src/Http/Controllers/UserController.php | 97 +++++++++++++++++++++++++
 3 files changed, 137 insertions(+), 7 deletions(-)

diff --git a/routes/web.php b/routes/web.php
index b92cb349fd8..7a43e350551 100755
--- a/routes/web.php
+++ b/routes/web.php
@@ -34,7 +34,8 @@
             Route::post('login', 'UserController@login')->name('login');
             Route::get('logout', 'UserController@logout')->name('logout');
             Route::post('register', 'UserController@register')->name('register');
-            Route::post('update', 'UserController@update')->name('user.update');
+            Route::post('profile', 'UserController@profile')->name('profile');
+            Route::post('password', 'UserController@password')->name('password');
 
             Route::post('password/email', 'ForgotPasswordController@sendResetLinkEmail')->name('password.email');
             Route::get('password/reset/{token}', 'ResetPasswordController@showResetForm')->name('password.reset');
diff --git a/src/Auth/UserTags.php b/src/Auth/UserTags.php
index 051a1ca7dd7..5185a8a28a2 100644
--- a/src/Auth/UserTags.php
+++ b/src/Auth/UserTags.php
@@ -277,19 +277,19 @@ public function resetPasswordForm()
     }
 
     /**
-     * Output a update form.
+     * Output a profile form.
      *
-     * Maps to {{ user:update_form }}
+     * Maps to {{ user:profile_form }}
      *
      * @return string
      */
-    public function updateForm()
+    public function profileForm()
     {
         if (session()->has('status')) {
             return $this->parse(['success' => true]);
         }
 
-        $data = $this->getFormSession();
+        $data = $this->getFormSession('user.profile');
 
         if (! $this->params->has('redirect')) {
             $this->params->put('redirect', request()->getPathInfo());
@@ -297,9 +297,41 @@ public function updateForm()
 
         $knownParams = ['redirect'];
 
-        $html = $this->formOpen(route('statamic.user.update'), 'POST', $knownParams);
+        $html = $this->formOpen(route('statamic.profile'), 'POST', $knownParams);
 
-        $html .= '<input type="hidden" name="token" value="'.request('token').'" />';
+        if ($redirect = $this->params->get('redirect')) {
+            $html .= '<input type="hidden" name="redirect" value="'.$redirect.'" />';
+        }
+
+        $html .= $this->parse($data);
+
+        $html .= $this->formClose();
+
+        return $html;
+    }
+
+    /**
+     * Output a password change form.
+     *
+     * Maps to {{ user:password_form }}
+     *
+     * @return string
+     */
+    public function passwordForm()
+    {
+        if (session()->has('status')) {
+            return $this->parse(['success' => true]);
+        }
+
+        $data = $this->getFormSession('user.password');
+
+        if (! $this->params->has('redirect')) {
+            $this->params->put('redirect', request()->getPathInfo());
+        }
+
+        $knownParams = ['redirect'];
+
+        $html = $this->formOpen(route('statamic.password'), 'POST', $knownParams);
 
         if ($redirect = $this->params->get('redirect')) {
             $html .= '<input type="hidden" name="redirect" value="'.$redirect.'" />';
diff --git a/src/Http/Controllers/UserController.php b/src/Http/Controllers/UserController.php
index d98013953fe..27eea07132c 100644
--- a/src/Http/Controllers/UserController.php
+++ b/src/Http/Controllers/UserController.php
@@ -11,6 +11,7 @@
 use Statamic\Events\UserRegistered;
 use Statamic\Events\UserRegistering;
 use Statamic\Exceptions\SilentFormFailureException;
+use Statamic\Exceptions\UnauthorizedHttpException;
 use Statamic\Facades\User;
 
 class UserController extends Controller
@@ -69,6 +70,7 @@ public function register(Request $request)
             return $this->userRegistrationFailure($validator->errors());
         }
 
+        // $values = array_merge($request->all(), $this->uploadAssetFiles($fields));
         $values = $fields->process()->values()->except(['email', 'groups', 'roles']);
 
         $user = User::make()
@@ -101,6 +103,65 @@ public function register(Request $request)
         return $this->userRegistrationSuccess();
     }
 
+    public function profile(Request $request)
+    {
+        throw_unless($user = User::current(), new UnauthorizedHttpException(403));
+
+        $blueprint = User::blueprint();
+
+        $fields = $blueprint->fields()->addValues($request->all());
+
+        $fieldRules = $fields->validator()->withRules([
+            'email' => ['required', 'email', 'unique_user_value:'.$user->id()],
+        ])->rules();
+
+        $validator = Validator::make($request->all(), $fieldRules);
+
+        if ($validator->fails()) {
+            $errors = $validator->errors();
+
+            return back()->withInput()->withErrors($errors, 'user.profile');
+        }
+
+        // $values = array_merge($request->all(), $this->uploadAssetFiles($fields));
+        $values = $fields->process()->values()->except(['email', 'password', 'groups', 'roles']);
+
+        $user->email($request->email);
+        foreach ($values as $key => $value) {
+            $user->set($key, $value);
+        }
+
+        $user->save();
+
+        session()->flash('user.profile.success', __('Update successful.'));
+
+        return request()->has('_redirect') ? redirect(request()->get('_redirect')) : back();
+    }
+
+    public function changePassword(Request $request)
+    {
+        throw_unless($user = User::current(), new UnauthorizedHttpException(403));
+
+        $validator = Validator::make($request->all(), [
+            'current_password' => ['required', 'current_password'],
+            'password'         => ['required', 'confirmed', PasswordDefaults::rules()],
+        ]);
+
+        if ($validator->fails()) {
+            $errors = $validator->errors();
+
+            return back()->withInput()->withErrors($errors, 'user.password');
+        }
+
+        $user->password($request->password);
+
+        $user->save();
+
+        session()->flash('user.password.success', __('Change successful.'));
+
+        return request()->has('_redirect') ? redirect(request()->get('_redirect')) : back();
+    }
+
     public function username()
     {
         return 'email';
@@ -122,4 +183,40 @@ private function userRegistrationSuccess(bool $silentFailure = false)
 
         return $response;
     }
+
+    protected function assetRules($fields)
+    {
+        return $fields->all()
+            ->filter(function ($field) {
+                return $field->fieldtype()->handle() === 'assets';
+            })
+            ->mapWithKeys(function ($field) {
+                return [$field->handle().'.*' => 'file'];
+            })
+            ->all();
+    }
+
+    protected function normalizeAssetValues($fields, $request)
+    {
+        return $fields->all()
+            ->filter(function ($field) {
+                return $field->fieldtype()->handle() === 'assets' && $field->get('max_files') === 1;
+            })
+            ->map(function ($field) use ($request) {
+                return Arr::wrap($request->file($field->handle()));
+            })
+            ->all();
+    }
+
+    protected function uploadAssetFiles($fields)
+    {
+        return $fields->all()
+            ->filter(function ($field) {
+                return $field->fieldtype()->handle() === 'assets' && request()->hasFile($field->handle());
+            })
+            ->map(function ($field) {
+                return AssetsUploader::field($field)->upload(request()->file($field->handle()));
+            })
+            ->all();
+    }
 }

From 85c06a3f96e99d71d8db9150325b2ccbf8eb8854 Mon Sep 17 00:00:00 2001
From: Jack Sleight <jacksleight@gmail.com>
Date: Mon, 1 Aug 2022 10:18:26 +0100
Subject: [PATCH 04/23] WIP

---
 src/Auth/UserTags.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Auth/UserTags.php b/src/Auth/UserTags.php
index 5185a8a28a2..a15f1ccd89b 100644
--- a/src/Auth/UserTags.php
+++ b/src/Auth/UserTags.php
@@ -492,7 +492,7 @@ public function notIn()
     }
 
     /**
-     * @inheritdoc
+     * {@inheritdoc}
      */
     public function eventUrl($url, $relative = false)
     {

From 4f60539cbdf46b8da12d842793b22e0296899ae5 Mon Sep 17 00:00:00 2001
From: Jack Sleight <jacksleight@gmail.com>
Date: Mon, 1 Aug 2022 15:15:51 +0100
Subject: [PATCH 05/23] WIP

---
 src/Http/Controllers/UserController.php | 43 ++++++++++++++++++-------
 1 file changed, 31 insertions(+), 12 deletions(-)

diff --git a/src/Http/Controllers/UserController.php b/src/Http/Controllers/UserController.php
index 27eea07132c..d8d1898516e 100644
--- a/src/Http/Controllers/UserController.php
+++ b/src/Http/Controllers/UserController.php
@@ -12,7 +12,9 @@
 use Statamic\Events\UserRegistering;
 use Statamic\Exceptions\SilentFormFailureException;
 use Statamic\Exceptions\UnauthorizedHttpException;
+use Statamic\Forms\Uploaders\AssetsUploader;
 use Statamic\Facades\User;
+use Statamic\Support\Arr;
 
 class UserController extends Controller
 {
@@ -57,12 +59,14 @@ public function register(Request $request)
     {
         $blueprint = User::blueprint();
 
-        $fields = $blueprint->fields()->addValues($request->all());
+        $fields = $blueprint->fields();
+        $values = array_merge($request->all(), $this->normalizeAssetValues($fields, $request));
+        $fields = $fields->addValues($values);
 
-        $fieldRules = $fields->validator()->withRules([
+        $fieldRules = $fields->validator()->withRules(array_merge([
             'email' => ['required', 'email', 'unique_user_value'],
             'password' => ['required', 'confirmed', PasswordDefaults::rules()],
-        ])->rules();
+        ], $this->assetRules($fields)))->rules();
 
         $validator = Validator::make($request->all(), $fieldRules);
 
@@ -70,8 +74,9 @@ public function register(Request $request)
             return $this->userRegistrationFailure($validator->errors());
         }
 
-        // $values = array_merge($request->all(), $this->uploadAssetFiles($fields));
-        $values = $fields->process()->values()->except(['email', 'groups', 'roles']);
+        $values = array_merge($request->all(), $this->uploadAssetFiles($fields));
+        $fields = $fields->addValues($values);
+        $values = $fields->process()->values()->only(array_keys($values))->except(['email', 'groups', 'roles']);
 
         $user = User::make()
             ->email($request->email)
@@ -109,13 +114,15 @@ public function profile(Request $request)
 
         $blueprint = User::blueprint();
 
-        $fields = $blueprint->fields()->addValues($request->all());
+        $fields = $blueprint->fields();
+        $values = array_merge($request->all(), $this->normalizeAssetValues($fields, $request));
+        $fields = $fields->addValues($values);
 
-        $fieldRules = $fields->validator()->withRules([
+        $fieldRules = $fields->validator()->withRules(array_merge([
             'email' => ['required', 'email', 'unique_user_value:'.$user->id()],
-        ])->rules();
+        ], $this->assetRules($fields)))->rules();
 
-        $validator = Validator::make($request->all(), $fieldRules);
+        $validator = Validator::make($values, $fieldRules);
 
         if ($validator->fails()) {
             $errors = $validator->errors();
@@ -123,10 +130,13 @@ public function profile(Request $request)
             return back()->withInput()->withErrors($errors, 'user.profile');
         }
 
-        // $values = array_merge($request->all(), $this->uploadAssetFiles($fields));
-        $values = $fields->process()->values()->except(['email', 'password', 'groups', 'roles']);
+        $values = array_merge($request->all(), $this->uploadAssetFiles($fields));
+        $fields = $fields->addValues($values);
+        $values = $fields->process()->values()->only(array_keys($values))->except(['email', 'password', 'groups', 'roles']);
 
-        $user->email($request->email);
+        if ($request->email) {
+            $user->email($request->email);
+        }
         foreach ($values as $key => $value) {
             $user->set($key, $value);
         }
@@ -219,4 +229,13 @@ protected function uploadAssetFiles($fields)
             })
             ->all();
     }
+
+    protected function filterEmptyAssetFields($fields)
+    {
+        return $fields->all()
+            ->filter(function ($field) {
+                return $field->fieldtype()->handle() !== 'assets' || request()->hasFile($field->handle());
+            })
+            ->all();
+    }
 }

From df4424c3abfbf9de32a0b9d0c2e3904ecc3e3b11 Mon Sep 17 00:00:00 2001
From: Jack Sleight <jacksleight@gmail.com>
Date: Mon, 1 Aug 2022 15:16:20 +0100
Subject: [PATCH 06/23] WIP

---
 src/Http/Controllers/UserController.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Http/Controllers/UserController.php b/src/Http/Controllers/UserController.php
index d8d1898516e..97b13a6238f 100644
--- a/src/Http/Controllers/UserController.php
+++ b/src/Http/Controllers/UserController.php
@@ -12,8 +12,8 @@
 use Statamic\Events\UserRegistering;
 use Statamic\Exceptions\SilentFormFailureException;
 use Statamic\Exceptions\UnauthorizedHttpException;
-use Statamic\Forms\Uploaders\AssetsUploader;
 use Statamic\Facades\User;
+use Statamic\Forms\Uploaders\AssetsUploader;
 use Statamic\Support\Arr;
 
 class UserController extends Controller

From 126c88f42717cbbc87339dcb518d1b4285ef6672 Mon Sep 17 00:00:00 2001
From: Jack Sleight <jacksleight@gmail.com>
Date: Mon, 1 Aug 2022 15:30:50 +0100
Subject: [PATCH 07/23] WIP

---
 src/Http/Controllers/UserController.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/Http/Controllers/UserController.php b/src/Http/Controllers/UserController.php
index 97b13a6238f..cd560d6a413 100644
--- a/src/Http/Controllers/UserController.php
+++ b/src/Http/Controllers/UserController.php
@@ -68,7 +68,7 @@ public function register(Request $request)
             'password' => ['required', 'confirmed', PasswordDefaults::rules()],
         ], $this->assetRules($fields)))->rules();
 
-        $validator = Validator::make($request->all(), $fieldRules);
+        $validator = Validator::make($values, $fieldRules);
 
         if ($validator->fails()) {
             return $this->userRegistrationFailure($validator->errors());
@@ -148,7 +148,7 @@ public function profile(Request $request)
         return request()->has('_redirect') ? redirect(request()->get('_redirect')) : back();
     }
 
-    public function changePassword(Request $request)
+    public function password(Request $request)
     {
         throw_unless($user = User::current(), new UnauthorizedHttpException(403));
 

From cb918573ad70bac3452e1139bf9012c17111c738 Mon Sep 17 00:00:00 2001
From: Jack Sleight <jacksleight@gmail.com>
Date: Mon, 1 Aug 2022 15:35:23 +0100
Subject: [PATCH 08/23] WIP

---
 src/Http/Controllers/UserController.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Http/Controllers/UserController.php b/src/Http/Controllers/UserController.php
index cd560d6a413..b9bebf53a71 100644
--- a/src/Http/Controllers/UserController.php
+++ b/src/Http/Controllers/UserController.php
@@ -76,7 +76,7 @@ public function register(Request $request)
 
         $values = array_merge($request->all(), $this->uploadAssetFiles($fields));
         $fields = $fields->addValues($values);
-        $values = $fields->process()->values()->only(array_keys($values))->except(['email', 'groups', 'roles']);
+        $values = $fields->process()->values()->except(['email', 'groups', 'roles']);
 
         $user = User::make()
             ->email($request->email)

From 82020bd4a7ce0df3d6e2746015a9a4c743681419 Mon Sep 17 00:00:00 2001
From: Jack Sleight <jacksleight@gmail.com>
Date: Wed, 3 Aug 2022 13:53:58 +0100
Subject: [PATCH 09/23] WIP

---
 src/Http/Controllers/UserController.php |  10 +-
 tests/Tags/User/ProfileFormTest.php     | 380 ++++++++++++++++++++++++
 2 files changed, 381 insertions(+), 9 deletions(-)
 create mode 100644 tests/Tags/User/ProfileFormTest.php

diff --git a/src/Http/Controllers/UserController.php b/src/Http/Controllers/UserController.php
index b9bebf53a71..6edddbc5d4a 100644
--- a/src/Http/Controllers/UserController.php
+++ b/src/Http/Controllers/UserController.php
@@ -132,6 +132,7 @@ public function profile(Request $request)
 
         $values = array_merge($request->all(), $this->uploadAssetFiles($fields));
         $fields = $fields->addValues($values);
+        // only() added here to filter out fields that weren't actualy submitted
         $values = $fields->process()->values()->only(array_keys($values))->except(['email', 'password', 'groups', 'roles']);
 
         if ($request->email) {
@@ -229,13 +230,4 @@ protected function uploadAssetFiles($fields)
             })
             ->all();
     }
-
-    protected function filterEmptyAssetFields($fields)
-    {
-        return $fields->all()
-            ->filter(function ($field) {
-                return $field->fieldtype()->handle() !== 'assets' || request()->hasFile($field->handle());
-            })
-            ->all();
-    }
 }
diff --git a/tests/Tags/User/ProfileFormTest.php b/tests/Tags/User/ProfileFormTest.php
new file mode 100644
index 00000000000..0580ac6553f
--- /dev/null
+++ b/tests/Tags/User/ProfileFormTest.php
@@ -0,0 +1,380 @@
+<?php
+
+namespace Tests\Tags\User;
+
+use Statamic\Facades\Blueprint;
+use Statamic\Facades\Parse;
+use Statamic\Facades\User;
+use Tests\NormalizesHtml;
+use Tests\PreventSavingStacheItemsToDisk;
+use Tests\TestCase;
+
+class ProfileFormTest extends TestCase
+{
+    use PreventSavingStacheItemsToDisk, NormalizesHtml;
+
+    private function tag($tag)
+    {
+        return Parse::template($tag, []);
+    }
+
+    /** @test */
+    public function it_renders_form()
+    {
+        $output = $this->tag('{{ user:profile_form }}{{ /user:profile_form }}');
+
+        $this->assertStringStartsWith('<form method="POST" action="http://localhost/!/auth/profile">', $output);
+        $this->assertStringContainsString('<input type="hidden" name="_token" value="">', $output);
+        $this->assertStringEndsWith('</form>', $output);
+    }
+
+    /** @test */
+    public function it_renders_form_with_params()
+    {
+        $output = $this->tag('{{ user:profile_form redirect="/submitted" error_redirect="/errors" class="form" id="form" }}{{ /user:profile_form }}');
+
+        $this->assertStringStartsWith('<form method="POST" action="http://localhost/!/auth/profile" class="form" id="form">', $output);
+        $this->assertStringContainsString('<input type="hidden" name="_redirect" value="/submitted" />', $output);
+        $this->assertStringContainsString('<input type="hidden" name="_error_redirect" value="/errors" />', $output);
+    }
+
+    /** @test */
+    public function it_renders_form_with_redirects_to_anchor()
+    {
+        $output = $this->tag('{{ user:register_form redirect="#form" error_redirect="#form" }}{{ /user:register_form }}');
+
+        $this->assertStringContainsString('<input type="hidden" name="_redirect" value="http://localhost#form" />', $output);
+        $this->assertStringContainsString('<input type="hidden" name="_error_redirect" value="http://localhost#form" />', $output);
+    }
+
+    /** @test */
+    public function it_renders_form_with_fields_array()
+    {
+        $output = $this->normalizeHtml($this->tag(<<<'EOT'
+{{ user:register_form }}
+    {{ fields }}
+        <label>{{ display }}</label>{{ field }}
+    {{ /fields }}
+{{ /user:register_form }}
+EOT
+));
+
+        preg_match_all('/<label>.+<\/label><input.+>/U', $output, $actual);
+
+        $expected = [
+            '<label>Email Address</label><input type="email" name="email" value="">',
+            '<label>Password</label><input type="password" name="password" value="">',
+            '<label>Password Confirmation</label><input type="password" name="password_confirmation" value="">',
+            '<label>Name</label><input type="text" name="name" value="">',
+        ];
+
+        $this->assertEquals($expected, $actual[0]);
+    }
+
+    /** @test */
+    public function it_renders_form_with_fields_array_and_custom_blueprint()
+    {
+        $this->useCustomBlueprint();
+
+        $output = $this->normalizeHtml($this->tag(<<<'EOT'
+{{ user:register_form }}
+    {{ fields }}
+        <label>{{ display }}</label>{{ field }}
+    {{ /fields }}
+{{ /user:register_form }}
+EOT
+));
+
+        preg_match_all('/<label>.+<\/label><input.+>/U', $output, $actual);
+
+        $expected = [
+            '<label>Email Address</label><input type="email" name="email" value="">',
+            '<label>Password</label><input type="password" name="password" value="">',
+            '<label>Password Confirmation</label><input type="password" name="password_confirmation" value="">',
+            '<label>Full Name</label><input type="text" name="name" value="">',
+            '<label>Phone Number</label><input type="text" name="phone" value="">',
+            '<label>Over 18 years of age?</label><input type="text" name="age" value="" required>',
+        ];
+
+        $this->assertEquals($expected, $actual[0]);
+    }
+
+    /** @test */
+    public function it_wont_register_user_and_renders_errors()
+    {
+        $this->assertNull(User::findByEmail('san@holo.com'));
+        $this->assertFalse(auth()->check());
+
+        $this
+            ->post('/!/auth/register', [])
+            ->assertSessionHasErrors([
+                'email',
+                'password',
+            ], null, 'user.register')
+            ->assertLocation('/');
+
+        $this->assertNull(User::findByEmail('san@holo.com'));
+        $this->assertFalse(auth()->check());
+
+        $output = $this->tag(<<<'EOT'
+{{ user:register_form }}
+    <p class="success">{{ success }}</p>
+    {{ errors }}
+        <p class="error">{{ value }}</p>
+    {{ /errors }}
+    {{ fields }}
+        <p class="inline-error">{{ error }}</p>
+    {{ /fields }}
+{{ /user:register_form }}
+EOT
+        );
+
+        preg_match_all('/<p class="success">(.+)<\/p>/U', $output, $success);
+        preg_match_all('/<p class="error">(.+)<\/p>/U', $output, $errors);
+        preg_match_all('/<p class="inline-error">(.+)<\/p>/U', $output, $inlineErrors);
+
+        $expected = [
+            'The email field is required.',
+            'The password field is required.',
+        ];
+
+        $this->assertEmpty($success[1]);
+        $this->assertEquals($expected, $errors[1]);
+        $this->assertEquals($expected, $inlineErrors[1]);
+    }
+
+    /** @test */
+    public function it_wont_register_user_and_renders_custom_validation_errors()
+    {
+        $this->useCustomBlueprint();
+
+        $this->assertNull(User::findByEmail('san@holo.com'));
+        $this->assertFalse(auth()->check());
+
+        $this
+            ->post('/!/auth/register', [
+                'email' => 'san@holo.com',
+                'password' => 'chewy',
+                'password_confirmation' => 'chewy',
+            ])
+            ->assertSessionHasErrors([
+                'password', // Should fail now because we've defined `min:8` as a rule.
+                'age', // An extra `required` field that we added.
+            ], null, 'user.register')
+            ->assertLocation('/');
+
+        $this->assertNull(User::findByEmail('san@holo.com'));
+        $this->assertFalse(auth()->check());
+
+        $output = $this->tag(<<<'EOT'
+{{ user:register_form }}
+    <p class="success">{{ success }}</p>
+    <p class="age-error">{{ error:age }}</p>
+    {{ errors }}
+        <p class="error">{{ value }}</p>
+    {{ /errors }}
+    {{ fields }}
+        <p class="inline-error">{{ error }}</p>
+    {{ /fields }}
+{{ /user:register_form }}
+EOT
+        );
+
+        preg_match_all('/<p class="success">(.+)<\/p>/U', $output, $success);
+        preg_match_all('/<p class="age-error">(.+)<\/p>/U', $output, $ageError);
+        preg_match_all('/<p class="error">(.+)<\/p>/U', $output, $errors);
+        preg_match_all('/<p class="inline-error">(.+)<\/p>/U', $output, $inlineErrors);
+
+        // TODO: It seems
+        $expected = [
+            'The password must be at least 8 characters.',
+            'The age field is required.',
+        ];
+
+        $this->assertEmpty($success[1]);
+        $this->assertEquals($expected, $errors[1]);
+        $this->assertEquals($expected[1], $errors[1][1]);
+        $this->assertEquals($expected, $inlineErrors[1]);
+    }
+
+    /** @test */
+    public function it_will_register_user_and_render_success()
+    {
+        $this->assertNull(User::findByEmail('san@holo.com'));
+        $this->assertFalse(auth()->check());
+
+        $this
+            ->post('/!/auth/register', [
+                'email' => 'san@holo.com',
+                'password' => 'chewbacca',
+                'password_confirmation' => 'chewbacca',
+            ])
+            ->assertSessionHasNoErrors()
+            ->assertLocation('/');
+
+        $this->assertNotNull(User::findByEmail('san@holo.com'));
+        $this->assertTrue(auth()->check());
+        $this->assertEquals('san@holo.com', auth()->user()->email());
+
+        $output = $this->tag(<<<'EOT'
+{{ user:register_form }}
+    <p class="success">{{ success }}</p>
+    {{ errors }}
+        <p class="error">{{ value }}</p>
+    {{ /errors }}
+    {{ fields }}
+        <p class="inline-error">{{ error }}</p>
+    {{ /fields }}
+{{ /user:register_form }}
+EOT
+        );
+
+        preg_match_all('/<p class="success">(.+)<\/p>/U', $output, $success);
+        preg_match_all('/<p class="error">(.+)<\/p>/U', $output, $errors);
+        preg_match_all('/<p class="inline-error">(.+)<\/p>/U', $output, $inlineErrors);
+
+        $this->assertEquals(['Registration successful.'], $success[1]);
+        $this->assertEmpty($errors[1]);
+        $this->assertEmpty($inlineErrors[1]);
+    }
+
+    /** @test */
+    public function it_will_register_user_and_follow_custom_redirect_with_success()
+    {
+        $this->assertNull(User::findByEmail('san@holo.com'));
+        $this->assertFalse(auth()->check());
+
+        $this
+            ->post('/!/auth/register', [
+                'email' => 'san@holo.com',
+                'password' => 'chewbacca',
+                'password_confirmation' => 'chewbacca',
+                '_redirect' => '/registration-successful',
+            ])
+            ->assertSessionHasNoErrors()
+            ->assertLocation('/registration-successful');
+
+        $this->assertNotNull(User::findByEmail('san@holo.com'));
+        $this->assertTrue(auth()->check());
+        $this->assertEquals('san@holo.com', auth()->user()->email());
+
+        $output = $this->tag(<<<'EOT'
+{{ user:register_form }}
+    <p class="success">{{ success }}</p>
+{{ /user:register_form }}
+EOT
+        );
+
+        preg_match_all('/<p class="success">(.+)<\/p>/U', $output, $success);
+
+        $this->assertEquals(['Registration successful.'], $success[1]);
+    }
+
+    /** @test */
+    public function it_wont_register_user_and_follow_custom_redirect_with_errors()
+    {
+        $this->assertNull(User::findByEmail('san@holo.com'));
+        $this->assertFalse(auth()->check());
+
+        $this
+            ->post('/!/auth/register', [
+                '_error_redirect' => '/registration-error',
+            ])
+            ->assertSessionHasErrors([
+                'email',
+                'password',
+            ], null, 'user.register')
+            ->assertLocation('/registration-error');
+
+        $this->assertNull(User::findByEmail('san@holo.com'));
+        $this->assertFalse(auth()->check());
+
+        $output = $this->tag(<<<'EOT'
+{{ user:register_form }}
+    <p class="success">{{ success }}</p>
+    {{ errors }}
+        <p class="error">{{ value }}</p>
+    {{ /errors }}
+    {{ fields }}
+        <p class="inline-error">{{ error }}</p>
+    {{ /fields }}
+{{ /user:register_form }}
+EOT
+        );
+
+        preg_match_all('/<p class="success">(.+)<\/p>/U', $output, $success);
+        preg_match_all('/<p class="error">(.+)<\/p>/U', $output, $errors);
+        preg_match_all('/<p class="inline-error">(.+)<\/p>/U', $output, $inlineErrors);
+
+        $expected = [
+            'The email field is required.',
+            'The password field is required.',
+        ];
+
+        $this->assertEmpty($success[1]);
+        $this->assertEquals($expected, $errors[1]);
+        $this->assertEquals($expected, $inlineErrors[1]);
+    }
+
+    /** @test */
+    public function it_will_use_redirect_query_param_off_url()
+    {
+        $this->get('/?redirect=registration-successful&error_redirect=registration-failure');
+
+        $expectedRedirect = '<input type="hidden" name="_redirect" value="registration-successful" />';
+        $expectedErrorRedirect = '<input type="hidden" name="_error_redirect" value="registration-failure" />';
+
+        $output = $this->tag('{{ user:register_form }}{{ /user:register_form }}');
+
+        $this->assertStringNotContainsString($expectedRedirect, $output);
+        $this->assertStringNotContainsString($expectedErrorRedirect, $output);
+
+        $output = $this->tag('{{ user:register_form allow_request_redirect="true" }}{{ /user:register_form }}');
+
+        $this->assertStringContainsString($expectedRedirect, $output);
+        $this->assertStringContainsString($expectedErrorRedirect, $output);
+    }
+
+    private function useCustomBlueprint()
+    {
+        $blueprint = Blueprint::make()->setContents([
+            'fields' => [
+                [
+                    'handle' => 'name', // Field already exists, but we're defining custom display string.
+                    'field' => [
+                        'type' => 'text',
+                        'display' => 'Full Name',
+                    ],
+                ],
+                [
+                    'handle' => 'password', // Field already exists, but we're defining custom validation rules.
+                    'field' => [
+                        'type' => 'text',
+                        'input_type' => 'password',
+                        'display' => 'Password',
+                        'validate' => 'min:8',
+                    ],
+                ],
+                [
+                    'handle' => 'phone', // Adding custom phone field.
+                    'field' => [
+                        'type' => 'text',
+                        'display' => 'Phone Number',
+                    ],
+                ],
+                [
+                    'handle' => 'age', // Adding custom age field.
+                    'field' => [
+                        'type' => 'text',
+                        'display' => 'Over 18 years of age?',
+                        'validate' => 'required',
+                    ],
+                ],
+            ],
+        ]);
+
+        Blueprint::shouldReceive('find')
+            ->with('user')
+            ->andReturn($blueprint);
+    }
+}

From 381c45ad9e039c53ad69823bf2176943ec8d371e Mon Sep 17 00:00:00 2001
From: Jack Sleight <jacksleight@gmail.com>
Date: Wed, 10 Aug 2022 17:44:58 +0100
Subject: [PATCH 10/23] WIP

---
 src/Auth/UserTags.php                   | 201 ++++++++++------
 src/Http/Controllers/UserController.php |  44 +++-
 src/Tags/Concerns/RendersForms.php      |   1 +
 tests/Tags/User/PasswordFormTest.php    | 290 ++++++++++++++++++++++++
 tests/Tags/User/ProfileFormTest.php     | 189 +++++----------
 5 files changed, 520 insertions(+), 205 deletions(-)
 create mode 100644 tests/Tags/User/PasswordFormTest.php

diff --git a/src/Auth/UserTags.php b/src/Auth/UserTags.php
index a15f1ccd89b..780b6261208 100644
--- a/src/Auth/UserTags.php
+++ b/src/Auth/UserTags.php
@@ -157,6 +157,86 @@ public function registerForm()
         return $html;
     }
 
+    /**
+     * Output a profile form.
+     *
+     * Maps to {{ user:profile_form }}
+     *
+     * @return string
+     */
+    public function profileForm()
+    {
+        if (session()->has('status')) {
+            return $this->parse(['success' => true]);
+        }
+
+        $data = $this->getFormSession('user.profile');
+
+        $data['fields'] = $this->getProfileFields();
+
+        $knownParams = ['redirect', 'error_redirect', 'allow_request_redirect'];
+
+        $html = $this->formOpen(route('statamic.profile'), 'POST', $knownParams);
+
+        $params = [];
+
+        if ($redirect = $this->getRedirectUrl()) {
+            $params['redirect'] = $this->parseRedirect($redirect);
+        }
+
+        if ($errorRedirect = $this->getErrorRedirectUrl()) {
+            $params['error_redirect'] = $this->parseRedirect($errorRedirect);
+        }
+
+        $html .= $this->formMetaFields($params);
+
+        $html .= $this->parse($data);
+
+        $html .= $this->formClose();
+
+        return $html;
+    }
+
+    /**
+     * Output a password change form.
+     *
+     * Maps to {{ user:password_form }}
+     *
+     * @return string
+     */
+    public function passwordForm()
+    {
+        if (session()->has('status')) {
+            return $this->parse(['success' => true]);
+        }
+
+        $data = $this->getFormSession('user.password');
+
+        $data['fields'] = $this->getPasswordFields();
+
+        $knownParams = ['redirect', 'error_redirect', 'allow_request_redirect'];
+
+        $html = $this->formOpen(route('statamic.password'), 'POST', $knownParams);
+
+        $params = [];
+
+        if ($redirect = $this->getRedirectUrl()) {
+            $params['redirect'] = $this->parseRedirect($redirect);
+        }
+
+        if ($errorRedirect = $this->getErrorRedirectUrl()) {
+            $params['error_redirect'] = $this->parseRedirect($errorRedirect);
+        }
+
+        $html .= $this->formMetaFields($params);
+
+        $html .= $this->parse($data);
+
+        $html .= $this->formClose();
+
+        return $html;
+    }
+
     /**
      * Alias of {{ user:register_form }}.
      *
@@ -276,74 +356,6 @@ public function resetPasswordForm()
         return $html;
     }
 
-    /**
-     * Output a profile form.
-     *
-     * Maps to {{ user:profile_form }}
-     *
-     * @return string
-     */
-    public function profileForm()
-    {
-        if (session()->has('status')) {
-            return $this->parse(['success' => true]);
-        }
-
-        $data = $this->getFormSession('user.profile');
-
-        if (! $this->params->has('redirect')) {
-            $this->params->put('redirect', request()->getPathInfo());
-        }
-
-        $knownParams = ['redirect'];
-
-        $html = $this->formOpen(route('statamic.profile'), 'POST', $knownParams);
-
-        if ($redirect = $this->params->get('redirect')) {
-            $html .= '<input type="hidden" name="redirect" value="'.$redirect.'" />';
-        }
-
-        $html .= $this->parse($data);
-
-        $html .= $this->formClose();
-
-        return $html;
-    }
-
-    /**
-     * Output a password change form.
-     *
-     * Maps to {{ user:password_form }}
-     *
-     * @return string
-     */
-    public function passwordForm()
-    {
-        if (session()->has('status')) {
-            return $this->parse(['success' => true]);
-        }
-
-        $data = $this->getFormSession('user.password');
-
-        if (! $this->params->has('redirect')) {
-            $this->params->put('redirect', request()->getPathInfo());
-        }
-
-        $knownParams = ['redirect'];
-
-        $html = $this->formOpen(route('statamic.password'), 'POST', $knownParams);
-
-        if ($redirect = $this->params->get('redirect')) {
-            $html .= '<input type="hidden" name="redirect" value="'.$redirect.'" />';
-        }
-
-        $html .= $this->parse($data);
-
-        $html .= $this->formClose();
-
-        return $html;
-    }
-
     /**
      * Displays content if a user has permission.
      *
@@ -584,4 +596,57 @@ protected function getAdditionalRegistrationFields()
             ->values()
             ->all();
     }
+
+    /**
+     * Get fields with extra data for looping over and rendering.
+     *
+     * @return array
+     */
+    protected function getProfileFields()
+    {
+        $user = User::current();
+        $values = $user
+            ? $user->data()->merge(['email' => $user->email()])->all()
+            : [];
+
+        return User::blueprint()->fields()->addValues($values)->preProcess()->all()
+            ->reject(function ($field) {
+                return in_array($field->handle(), ['password', 'password_confirmation', 'roles', 'groups']);
+            })
+            ->map(function ($field) {
+                return $this->getRenderableField($field, 'user.profile');
+            })
+            ->values()
+            ->all();
+    }
+
+    /**
+     * Get fields with extra data for looping over and rendering.
+     *
+     * @return array
+     */
+    protected function getPasswordFields()
+    {
+        return collect()
+            ->put('current_password', new Field('current_password', [
+                'type' => 'text',
+                'input_type' => 'password',
+                'display' => __('Current Password'),
+            ]))
+            ->put('password', new Field('password', [
+                'type' => 'text',
+                'input_type' => 'password',
+                'display' => __('Password'),
+            ]))
+            ->put('password_confirmation', new Field('password_confirmation', [
+                'type' => 'text',
+                'input_type' => 'password',
+                'display' => __('Password Confirmation'),
+            ]))
+            ->map(function ($field) {
+                return $this->getRenderableField($field, 'user.password');
+            })
+            ->values()
+            ->all();
+    }
 }
diff --git a/src/Http/Controllers/UserController.php b/src/Http/Controllers/UserController.php
index 6edddbc5d4a..eff731109de 100644
--- a/src/Http/Controllers/UserController.php
+++ b/src/Http/Controllers/UserController.php
@@ -125,9 +125,7 @@ public function profile(Request $request)
         $validator = Validator::make($values, $fieldRules);
 
         if ($validator->fails()) {
-            $errors = $validator->errors();
-
-            return back()->withInput()->withErrors($errors, 'user.profile');
+            return $this->userProfileFailure($validator->errors());
         }
 
         $values = array_merge($request->all(), $this->uploadAssetFiles($fields));
@@ -146,7 +144,7 @@ public function profile(Request $request)
 
         session()->flash('user.profile.success', __('Update successful.'));
 
-        return request()->has('_redirect') ? redirect(request()->get('_redirect')) : back();
+        return $this->userProfileSuccess();
     }
 
     public function password(Request $request)
@@ -159,9 +157,7 @@ public function password(Request $request)
         ]);
 
         if ($validator->fails()) {
-            $errors = $validator->errors();
-
-            return back()->withInput()->withErrors($errors, 'user.password');
+            return $this->userPasswordFailure($validator->errors());
         }
 
         $user->password($request->password);
@@ -170,7 +166,7 @@ public function password(Request $request)
 
         session()->flash('user.password.success', __('Change successful.'));
 
-        return request()->has('_redirect') ? redirect(request()->get('_redirect')) : back();
+        return $this->userPasswordSuccess();
     }
 
     public function username()
@@ -195,6 +191,38 @@ private function userRegistrationSuccess(bool $silentFailure = false)
         return $response;
     }
 
+    private function userProfileFailure($errors = null)
+    {
+        $errorResponse = request()->has('_error_redirect') ? redirect(request()->input('_error_redirect')) : back();
+
+        return $errorResponse->withInput()->withErrors($errors, 'user.profile');
+    }
+
+    private function userProfileSuccess(bool $silentFailure = false)
+    {
+        $response = request()->has('_redirect') ? redirect(request()->get('_redirect')) : back();
+
+        session()->flash('user.profile.success', __('Update successful.'));
+
+        return $response;
+    }
+
+    private function userPasswordFailure($errors = null)
+    {
+        $errorResponse = request()->has('_error_redirect') ? redirect(request()->input('_error_redirect')) : back();
+
+        return $errorResponse->withInput()->withErrors($errors, 'user.password');
+    }
+
+    private function userPasswordSuccess(bool $silentFailure = false)
+    {
+        $response = request()->has('_redirect') ? redirect(request()->get('_redirect')) : back();
+
+        session()->flash('user.password.success', __('Change successful.'));
+
+        return $response;
+    }
+
     protected function assetRules($fields)
     {
         return $fields->all()
diff --git a/src/Tags/Concerns/RendersForms.php b/src/Tags/Concerns/RendersForms.php
index 8c745a26dc3..15ba0c248cd 100644
--- a/src/Tags/Concerns/RendersForms.php
+++ b/src/Tags/Concerns/RendersForms.php
@@ -82,6 +82,7 @@ protected function getRenderableField($field, $errorBag = 'default', $manipulate
 
         $data = array_merge($field->toArray(), [
             'error' => $errors->first($field->handle()) ?: null,
+            'default' => $field->value(),
             'old' => old($field->handle()),
         ]);
 
diff --git a/tests/Tags/User/PasswordFormTest.php b/tests/Tags/User/PasswordFormTest.php
new file mode 100644
index 00000000000..5a2741e2e19
--- /dev/null
+++ b/tests/Tags/User/PasswordFormTest.php
@@ -0,0 +1,290 @@
+<?php
+
+namespace Tests\Tags\User;
+
+use Statamic\Facades\Parse;
+use Statamic\Facades\User;
+use Tests\NormalizesHtml;
+use Tests\PreventSavingStacheItemsToDisk;
+use Tests\TestCase;
+
+class PasswordFormTest extends TestCase
+{
+    use PreventSavingStacheItemsToDisk, NormalizesHtml;
+
+    private function tag($tag)
+    {
+        return Parse::template($tag, []);
+    }
+
+    /** @test */
+    public function it_renders_form()
+    {
+        $this->actingAs(User::make()->password('mypassword')->save());
+
+        $output = $this->tag('{{ user:password_form }}{{ /user:password_form }}');
+
+        $this->assertStringStartsWith('<form method="POST" action="http://localhost/!/auth/password">', $output);
+        $this->assertStringContainsString('<input type="hidden" name="_token" value="">', $output);
+        $this->assertStringEndsWith('</form>', $output);
+    }
+
+    /** @test */
+    public function it_renders_form_with_params()
+    {
+        $this->actingAs(User::make()->password('mypassword')->save());
+        
+        $output = $this->tag('{{ user:password_form redirect="/submitted" error_redirect="/errors" class="form" id="form" }}{{ /user:password_form }}');
+
+        $this->assertStringStartsWith('<form method="POST" action="http://localhost/!/auth/password" class="form" id="form">', $output);
+        $this->assertStringContainsString('<input type="hidden" name="_redirect" value="/submitted" />', $output);
+        $this->assertStringContainsString('<input type="hidden" name="_error_redirect" value="/errors" />', $output);
+    }
+
+    /** @test */
+    public function it_renders_form_with_redirects_to_anchor()
+    {
+        $this->actingAs(User::make()->password('mypassword')->save());
+
+        $output = $this->tag('{{ user:password_form redirect="#form" error_redirect="#form" }}{{ /user:password_form }}');
+
+        $this->assertStringContainsString('<input type="hidden" name="_redirect" value="http://localhost#form" />', $output);
+        $this->assertStringContainsString('<input type="hidden" name="_error_redirect" value="http://localhost#form" />', $output);
+    }
+
+    /** @test */
+    public function it_renders_form_with_fields_array()
+    {
+        $this->actingAs(User::make()
+            ->email('test@example.com')
+            ->data(['name' => 'Test User'])
+            ->save());
+
+        $output = $this->normalizeHtml($this->tag(<<<'EOT'
+{{ user:password_form }}
+    {{ fields }}
+        <label>{{ display }}</label>{{ field }}
+    {{ /fields }}
+{{ /user:password_form }}
+EOT
+));
+
+        preg_match_all('/<label>.+<\/label><input.+>/U', $output, $actual);
+
+        $expected = [
+            '<label>Current Password</label><input type="password" name="current_password" value="">',
+            '<label>Password</label><input type="password" name="password" value="">',
+            '<label>Password Confirmation</label><input type="password" name="password_confirmation" value="">',
+        ];
+
+        $this->assertEquals($expected, $actual[0]);
+    }
+
+    /** @test */
+    public function it_wont_update_password_and_renders_errors()
+    {
+        $this->actingAs(User::make()->password('mypassword')->save());
+
+        $this
+            ->post('/!/auth/password', [
+                'current_password' => '',
+                'password' => '',
+                'password_confirmation' => '',
+            ])
+            ->assertSessionHasErrors([
+                'current_password',
+                'password',
+            ], null, 'user.password');
+
+        $output = $this->tag(<<<'EOT'
+{{ user:password_form }}
+    <p class="success">{{ success }}</p>
+    {{ errors }}
+        <p class="error">{{ value }}</p>
+    {{ /errors }}
+    {{ fields }}
+        <p class="inline-error">{{ error }}</p>
+    {{ /fields }}
+{{ /user:password_form }}
+EOT
+        );
+
+        preg_match_all('/<p class="success">(.+)<\/p>/U', $output, $success);
+        preg_match_all('/<p class="error">(.+)<\/p>/U', $output, $errors);
+        preg_match_all('/<p class="inline-error">(.+)<\/p>/U', $output, $inlineErrors);
+
+        $expected = [
+            'The current password field is required.',
+            'The password field is required.',
+        ];
+
+        $this->assertEmpty($success[1]);
+        $this->assertEquals($expected, $errors[1]);
+        $this->assertEquals($expected, $inlineErrors[1]);
+    }
+
+    /** @test */
+    public function it_wont_update_password_and_renders_errors_with_incorrect_password()
+    {
+        $this->actingAs(User::make()->password('mypassword')->save());
+
+        $this
+            ->post('/!/auth/password', [
+                'current_password' => 'wrongpassword',
+                'password' => 'newpassword',
+                'password_confirmation' => 'newpassword',
+            ])
+            ->assertSessionHasErrors([
+                'current_password',
+            ], null, 'user.password');
+
+        $output = $this->tag(<<<'EOT'
+{{ user:password_form }}
+    <p class="success">{{ success }}</p>
+    {{ errors }}
+        <p class="error">{{ value }}</p>
+    {{ /errors }}
+    {{ fields }}
+        <p class="inline-error">{{ error }}</p>
+    {{ /fields }}
+{{ /user:password_form }}
+EOT
+        );
+
+        preg_match_all('/<p class="success">(.+)<\/p>/U', $output, $success);
+        preg_match_all('/<p class="error">(.+)<\/p>/U', $output, $errors);
+        preg_match_all('/<p class="inline-error">(.+)<\/p>/U', $output, $inlineErrors);
+
+        $expected = [
+            'The password is incorrect.',
+        ];
+
+        $this->assertEmpty($success[1]);
+        $this->assertEquals($expected, $errors[1]);
+        $this->assertEquals($expected, $inlineErrors[1]);
+    }
+
+    /** @test */
+    public function it_will_update_password_and_render_success()
+    {
+        $this->actingAs(User::make()->password('mypassword')->save());
+
+        $this
+            ->post('/!/auth/password', [
+                'current_password' => 'mypassword',
+                'password' => 'newpassword',
+                'password_confirmation' => 'newpassword',
+            ])
+            ->assertSessionHasNoErrors();
+
+        $output = $this->tag(<<<'EOT'
+{{ user:password_form }}
+    <p class="success">{{ success }}</p>
+    {{ errors }}
+        <p class="error">{{ value }}</p>
+    {{ /errors }}
+    {{ fields }}
+        <p class="inline-error">{{ error }}</p>
+    {{ /fields }}
+{{ /user:password_form }}
+EOT
+        );
+
+        preg_match_all('/<p class="success">(.+)<\/p>/U', $output, $success);
+        preg_match_all('/<p class="error">(.+)<\/p>/U', $output, $errors);
+        preg_match_all('/<p class="inline-error">(.+)<\/p>/U', $output, $inlineErrors);
+
+        $this->assertEquals(['Change successful.'], $success[1]);
+        $this->assertEmpty($errors[1]);
+        $this->assertEmpty($inlineErrors[1]);
+    }
+
+    /** @test */
+    public function it_will_update_password_and_follow_custom_redirect_with_success()
+    {
+        $this->actingAs(User::make()->password('mypassword')->save());
+
+        $this
+            ->post('/!/auth/password', [
+                'current_password' => 'mypassword',
+                'password' => 'newpassword',
+                'password_confirmation' => 'newpassword',
+                '_redirect' => '/password-successful',
+            ])
+            ->assertSessionHasNoErrors()
+            ->assertLocation('/password-successful');
+
+        $output = $this->tag(<<<'EOT'
+{{ user:password_form }}
+    <p class="success">{{ success }}</p>
+{{ /user:password_form }}
+EOT
+        );
+
+        preg_match_all('/<p class="success">(.+)<\/p>/U', $output, $success);
+
+        $this->assertEquals(['Change successful.'], $success[1]);
+    }
+
+    /** @test */
+    public function it_wont_update_password_and_follow_custom_redirect_with_errors()
+    {
+        $this->actingAs(User::make()->password('mypassword')->save());
+
+        $this
+            ->post('/!/auth/password', [
+                'current_password' => 'wrongpassword',
+                'password' => 'newpassword',
+                'password_confirmation' => 'newpassword',
+                '_error_redirect' => '/password-error',
+            ])
+            ->assertSessionHasErrors([
+                'current_password',
+            ], null, 'user.password')
+            ->assertLocation('/password-error');
+
+        $output = $this->tag(<<<'EOT'
+{{ user:password_form }}
+    <p class="success">{{ success }}</p>
+    {{ errors }}
+        <p class="error">{{ value }}</p>
+    {{ /errors }}
+    {{ fields }}
+        <p class="inline-error">{{ error }}</p>
+    {{ /fields }}
+{{ /user:password_form }}
+EOT
+        );
+
+        preg_match_all('/<p class="success">(.+)<\/p>/U', $output, $success);
+        preg_match_all('/<p class="error">(.+)<\/p>/U', $output, $errors);
+        preg_match_all('/<p class="inline-error">(.+)<\/p>/U', $output, $inlineErrors);
+
+        $expected = [
+            'The password is incorrect.',
+        ];
+
+        $this->assertEmpty($success[1]);
+        $this->assertEquals($expected, $errors[1]);
+        $this->assertEquals($expected, $inlineErrors[1]);
+    }
+
+    /** @test */
+    public function it_will_use_redirect_query_param_off_url()
+    {
+        $this->get('/?redirect=password-successful&error_redirect=registration-failure');
+
+        $expectedRedirect = '<input type="hidden" name="_redirect" value="password-successful" />';
+        $expectedErrorRedirect = '<input type="hidden" name="_error_redirect" value="registration-failure" />';
+
+        $output = $this->tag('{{ user:password_form }}{{ /user:password_form }}');
+
+        $this->assertStringNotContainsString($expectedRedirect, $output);
+        $this->assertStringNotContainsString($expectedErrorRedirect, $output);
+
+        $output = $this->tag('{{ user:password_form allow_request_redirect="true" }}{{ /user:password_form }}');
+
+        $this->assertStringContainsString($expectedRedirect, $output);
+        $this->assertStringContainsString($expectedErrorRedirect, $output);
+    }
+}
diff --git a/tests/Tags/User/ProfileFormTest.php b/tests/Tags/User/ProfileFormTest.php
index 0580ac6553f..582cdb28fca 100644
--- a/tests/Tags/User/ProfileFormTest.php
+++ b/tests/Tags/User/ProfileFormTest.php
@@ -21,6 +21,8 @@ private function tag($tag)
     /** @test */
     public function it_renders_form()
     {
+        $this->actingAs(User::make()->save());
+
         $output = $this->tag('{{ user:profile_form }}{{ /user:profile_form }}');
 
         $this->assertStringStartsWith('<form method="POST" action="http://localhost/!/auth/profile">', $output);
@@ -31,6 +33,8 @@ public function it_renders_form()
     /** @test */
     public function it_renders_form_with_params()
     {
+        $this->actingAs(User::make()->save());
+        
         $output = $this->tag('{{ user:profile_form redirect="/submitted" error_redirect="/errors" class="form" id="form" }}{{ /user:profile_form }}');
 
         $this->assertStringStartsWith('<form method="POST" action="http://localhost/!/auth/profile" class="form" id="form">', $output);
@@ -41,7 +45,9 @@ public function it_renders_form_with_params()
     /** @test */
     public function it_renders_form_with_redirects_to_anchor()
     {
-        $output = $this->tag('{{ user:register_form redirect="#form" error_redirect="#form" }}{{ /user:register_form }}');
+        $this->actingAs(User::make()->save());
+
+        $output = $this->tag('{{ user:profile_form redirect="#form" error_redirect="#form" }}{{ /user:profile_form }}');
 
         $this->assertStringContainsString('<input type="hidden" name="_redirect" value="http://localhost#form" />', $output);
         $this->assertStringContainsString('<input type="hidden" name="_error_redirect" value="http://localhost#form" />', $output);
@@ -50,22 +56,25 @@ public function it_renders_form_with_redirects_to_anchor()
     /** @test */
     public function it_renders_form_with_fields_array()
     {
+        $this->actingAs(User::make()
+            ->email('test@example.com')
+            ->data(['name' => 'Test User'])
+            ->save());
+
         $output = $this->normalizeHtml($this->tag(<<<'EOT'
-{{ user:register_form }}
+{{ user:profile_form }}
     {{ fields }}
         <label>{{ display }}</label>{{ field }}
     {{ /fields }}
-{{ /user:register_form }}
+{{ /user:profile_form }}
 EOT
 ));
 
         preg_match_all('/<label>.+<\/label><input.+>/U', $output, $actual);
 
         $expected = [
-            '<label>Email Address</label><input type="email" name="email" value="">',
-            '<label>Password</label><input type="password" name="password" value="">',
-            '<label>Password Confirmation</label><input type="password" name="password_confirmation" value="">',
-            '<label>Name</label><input type="text" name="name" value="">',
+            '<label>Name</label><input type="text" name="name" value="Test User">',
+            '<label>Email Address</label><input type="email" name="email" value="test@example.com">',
         ];
 
         $this->assertEquals($expected, $actual[0]);
@@ -74,25 +83,26 @@ public function it_renders_form_with_fields_array()
     /** @test */
     public function it_renders_form_with_fields_array_and_custom_blueprint()
     {
+        $this->actingAs(User::make()
+            ->email('test@example.com')
+            ->data(['name' => 'Test User', 'phone' => '12345'])
+            ->save());
         $this->useCustomBlueprint();
 
         $output = $this->normalizeHtml($this->tag(<<<'EOT'
-{{ user:register_form }}
+{{ user:profile_form }}
     {{ fields }}
         <label>{{ display }}</label>{{ field }}
     {{ /fields }}
-{{ /user:register_form }}
+{{ /user:profile_form }}
 EOT
 ));
 
         preg_match_all('/<label>.+<\/label><input.+>/U', $output, $actual);
 
         $expected = [
-            '<label>Email Address</label><input type="email" name="email" value="">',
-            '<label>Password</label><input type="password" name="password" value="">',
-            '<label>Password Confirmation</label><input type="password" name="password_confirmation" value="">',
-            '<label>Full Name</label><input type="text" name="name" value="">',
-            '<label>Phone Number</label><input type="text" name="phone" value="">',
+            '<label>Full Name</label><input type="text" name="name" value="Test User">',
+            '<label>Phone Number</label><input type="text" name="phone" value="12345">',
             '<label>Over 18 years of age?</label><input type="text" name="age" value="" required>',
         ];
 
@@ -100,24 +110,20 @@ public function it_renders_form_with_fields_array_and_custom_blueprint()
     }
 
     /** @test */
-    public function it_wont_register_user_and_renders_errors()
+    public function it_wont_update_user_and_renders_errors()
     {
-        $this->assertNull(User::findByEmail('san@holo.com'));
-        $this->assertFalse(auth()->check());
+        $this->actingAs(User::make()->save());
 
         $this
-            ->post('/!/auth/register', [])
+            ->post('/!/auth/profile', [
+                'email' => '',
+            ])
             ->assertSessionHasErrors([
                 'email',
-                'password',
-            ], null, 'user.register')
-            ->assertLocation('/');
-
-        $this->assertNull(User::findByEmail('san@holo.com'));
-        $this->assertFalse(auth()->check());
+            ], null, 'user.profile');
 
         $output = $this->tag(<<<'EOT'
-{{ user:register_form }}
+{{ user:profile_form }}
     <p class="success">{{ success }}</p>
     {{ errors }}
         <p class="error">{{ value }}</p>
@@ -125,7 +131,7 @@ public function it_wont_register_user_and_renders_errors()
     {{ fields }}
         <p class="inline-error">{{ error }}</p>
     {{ /fields }}
-{{ /user:register_form }}
+{{ /user:profile_form }}
 EOT
         );
 
@@ -135,89 +141,26 @@ public function it_wont_register_user_and_renders_errors()
 
         $expected = [
             'The email field is required.',
-            'The password field is required.',
-        ];
-
-        $this->assertEmpty($success[1]);
-        $this->assertEquals($expected, $errors[1]);
-        $this->assertEquals($expected, $inlineErrors[1]);
-    }
-
-    /** @test */
-    public function it_wont_register_user_and_renders_custom_validation_errors()
-    {
-        $this->useCustomBlueprint();
-
-        $this->assertNull(User::findByEmail('san@holo.com'));
-        $this->assertFalse(auth()->check());
-
-        $this
-            ->post('/!/auth/register', [
-                'email' => 'san@holo.com',
-                'password' => 'chewy',
-                'password_confirmation' => 'chewy',
-            ])
-            ->assertSessionHasErrors([
-                'password', // Should fail now because we've defined `min:8` as a rule.
-                'age', // An extra `required` field that we added.
-            ], null, 'user.register')
-            ->assertLocation('/');
-
-        $this->assertNull(User::findByEmail('san@holo.com'));
-        $this->assertFalse(auth()->check());
-
-        $output = $this->tag(<<<'EOT'
-{{ user:register_form }}
-    <p class="success">{{ success }}</p>
-    <p class="age-error">{{ error:age }}</p>
-    {{ errors }}
-        <p class="error">{{ value }}</p>
-    {{ /errors }}
-    {{ fields }}
-        <p class="inline-error">{{ error }}</p>
-    {{ /fields }}
-{{ /user:register_form }}
-EOT
-        );
-
-        preg_match_all('/<p class="success">(.+)<\/p>/U', $output, $success);
-        preg_match_all('/<p class="age-error">(.+)<\/p>/U', $output, $ageError);
-        preg_match_all('/<p class="error">(.+)<\/p>/U', $output, $errors);
-        preg_match_all('/<p class="inline-error">(.+)<\/p>/U', $output, $inlineErrors);
-
-        // TODO: It seems
-        $expected = [
-            'The password must be at least 8 characters.',
-            'The age field is required.',
         ];
 
         $this->assertEmpty($success[1]);
         $this->assertEquals($expected, $errors[1]);
-        $this->assertEquals($expected[1], $errors[1][1]);
         $this->assertEquals($expected, $inlineErrors[1]);
     }
 
     /** @test */
-    public function it_will_register_user_and_render_success()
+    public function it_will_update_user_and_render_success()
     {
-        $this->assertNull(User::findByEmail('san@holo.com'));
-        $this->assertFalse(auth()->check());
+        $this->actingAs(User::make()->save());
 
         $this
-            ->post('/!/auth/register', [
+            ->post('/!/auth/profile', [
                 'email' => 'san@holo.com',
-                'password' => 'chewbacca',
-                'password_confirmation' => 'chewbacca',
             ])
-            ->assertSessionHasNoErrors()
-            ->assertLocation('/');
-
-        $this->assertNotNull(User::findByEmail('san@holo.com'));
-        $this->assertTrue(auth()->check());
-        $this->assertEquals('san@holo.com', auth()->user()->email());
+            ->assertSessionHasNoErrors();
 
         $output = $this->tag(<<<'EOT'
-{{ user:register_form }}
+{{ user:profile_form }}
     <p class="success">{{ success }}</p>
     {{ errors }}
         <p class="error">{{ value }}</p>
@@ -225,7 +168,7 @@ public function it_will_register_user_and_render_success()
     {{ fields }}
         <p class="inline-error">{{ error }}</p>
     {{ /fields }}
-{{ /user:register_form }}
+{{ /user:profile_form }}
 EOT
         );
 
@@ -233,64 +176,53 @@ public function it_will_register_user_and_render_success()
         preg_match_all('/<p class="error">(.+)<\/p>/U', $output, $errors);
         preg_match_all('/<p class="inline-error">(.+)<\/p>/U', $output, $inlineErrors);
 
-        $this->assertEquals(['Registration successful.'], $success[1]);
+        $this->assertEquals(['Update successful.'], $success[1]);
         $this->assertEmpty($errors[1]);
         $this->assertEmpty($inlineErrors[1]);
     }
 
     /** @test */
-    public function it_will_register_user_and_follow_custom_redirect_with_success()
+    public function it_will_update_user_and_follow_custom_redirect_with_success()
     {
-        $this->assertNull(User::findByEmail('san@holo.com'));
-        $this->assertFalse(auth()->check());
+        $this->actingAs(User::make()->save());
 
         $this
-            ->post('/!/auth/register', [
+            ->post('/!/auth/profile', [
                 'email' => 'san@holo.com',
-                'password' => 'chewbacca',
-                'password_confirmation' => 'chewbacca',
-                '_redirect' => '/registration-successful',
+                '_redirect' => '/profile-successful',
             ])
             ->assertSessionHasNoErrors()
-            ->assertLocation('/registration-successful');
-
-        $this->assertNotNull(User::findByEmail('san@holo.com'));
-        $this->assertTrue(auth()->check());
-        $this->assertEquals('san@holo.com', auth()->user()->email());
+            ->assertLocation('/profile-successful');
 
         $output = $this->tag(<<<'EOT'
-{{ user:register_form }}
+{{ user:profile_form }}
     <p class="success">{{ success }}</p>
-{{ /user:register_form }}
+{{ /user:profile_form }}
 EOT
         );
 
         preg_match_all('/<p class="success">(.+)<\/p>/U', $output, $success);
 
-        $this->assertEquals(['Registration successful.'], $success[1]);
+        $this->assertEquals(['Update successful.'], $success[1]);
     }
 
     /** @test */
-    public function it_wont_register_user_and_follow_custom_redirect_with_errors()
+    public function it_wont_update_user_and_follow_custom_redirect_with_errors()
     {
-        $this->assertNull(User::findByEmail('san@holo.com'));
-        $this->assertFalse(auth()->check());
+        $this->actingAs(User::make()->save());
 
         $this
-            ->post('/!/auth/register', [
-                '_error_redirect' => '/registration-error',
+            ->post('/!/auth/profile', [
+                'email' => '',
+                '_error_redirect' => '/profile-error',
             ])
             ->assertSessionHasErrors([
                 'email',
-                'password',
-            ], null, 'user.register')
-            ->assertLocation('/registration-error');
-
-        $this->assertNull(User::findByEmail('san@holo.com'));
-        $this->assertFalse(auth()->check());
+            ], null, 'user.profile')
+            ->assertLocation('/profile-error');
 
         $output = $this->tag(<<<'EOT'
-{{ user:register_form }}
+{{ user:profile_form }}
     <p class="success">{{ success }}</p>
     {{ errors }}
         <p class="error">{{ value }}</p>
@@ -298,7 +230,7 @@ public function it_wont_register_user_and_follow_custom_redirect_with_errors()
     {{ fields }}
         <p class="inline-error">{{ error }}</p>
     {{ /fields }}
-{{ /user:register_form }}
+{{ /user:profile_form }}
 EOT
         );
 
@@ -308,7 +240,6 @@ public function it_wont_register_user_and_follow_custom_redirect_with_errors()
 
         $expected = [
             'The email field is required.',
-            'The password field is required.',
         ];
 
         $this->assertEmpty($success[1]);
@@ -319,17 +250,17 @@ public function it_wont_register_user_and_follow_custom_redirect_with_errors()
     /** @test */
     public function it_will_use_redirect_query_param_off_url()
     {
-        $this->get('/?redirect=registration-successful&error_redirect=registration-failure');
+        $this->get('/?redirect=profile-successful&error_redirect=registration-failure');
 
-        $expectedRedirect = '<input type="hidden" name="_redirect" value="registration-successful" />';
+        $expectedRedirect = '<input type="hidden" name="_redirect" value="profile-successful" />';
         $expectedErrorRedirect = '<input type="hidden" name="_error_redirect" value="registration-failure" />';
 
-        $output = $this->tag('{{ user:register_form }}{{ /user:register_form }}');
+        $output = $this->tag('{{ user:profile_form }}{{ /user:profile_form }}');
 
         $this->assertStringNotContainsString($expectedRedirect, $output);
         $this->assertStringNotContainsString($expectedErrorRedirect, $output);
 
-        $output = $this->tag('{{ user:register_form allow_request_redirect="true" }}{{ /user:register_form }}');
+        $output = $this->tag('{{ user:profile_form allow_request_redirect="true" }}{{ /user:profile_form }}');
 
         $this->assertStringContainsString($expectedRedirect, $output);
         $this->assertStringContainsString($expectedErrorRedirect, $output);

From 11fc4b6800918d0351585e6e40bcdc3ce9e0da52 Mon Sep 17 00:00:00 2001
From: Jack Sleight <jacksleight@gmail.com>
Date: Wed, 10 Aug 2022 17:47:21 +0100
Subject: [PATCH 11/23] WIP

---
 tests/Tags/User/PasswordFormTest.php | 2 +-
 tests/Tags/User/ProfileFormTest.php  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/Tags/User/PasswordFormTest.php b/tests/Tags/User/PasswordFormTest.php
index 5a2741e2e19..0e269082966 100644
--- a/tests/Tags/User/PasswordFormTest.php
+++ b/tests/Tags/User/PasswordFormTest.php
@@ -33,7 +33,7 @@ public function it_renders_form()
     public function it_renders_form_with_params()
     {
         $this->actingAs(User::make()->password('mypassword')->save());
-        
+
         $output = $this->tag('{{ user:password_form redirect="/submitted" error_redirect="/errors" class="form" id="form" }}{{ /user:password_form }}');
 
         $this->assertStringStartsWith('<form method="POST" action="http://localhost/!/auth/password" class="form" id="form">', $output);
diff --git a/tests/Tags/User/ProfileFormTest.php b/tests/Tags/User/ProfileFormTest.php
index 582cdb28fca..3f448ea574b 100644
--- a/tests/Tags/User/ProfileFormTest.php
+++ b/tests/Tags/User/ProfileFormTest.php
@@ -34,7 +34,7 @@ public function it_renders_form()
     public function it_renders_form_with_params()
     {
         $this->actingAs(User::make()->save());
-        
+
         $output = $this->tag('{{ user:profile_form redirect="/submitted" error_redirect="/errors" class="form" id="form" }}{{ /user:profile_form }}');
 
         $this->assertStringStartsWith('<form method="POST" action="http://localhost/!/auth/profile" class="form" id="form">', $output);

From 86a77e27681cf2e6535ed8f67696bd820279cb9f Mon Sep 17 00:00:00 2001
From: Jack Sleight <jacksleight@gmail.com>
Date: Wed, 10 Aug 2022 17:52:27 +0100
Subject: [PATCH 12/23] WIP

---
 tests/Tags/User/PasswordFormTest.php | 4 ++--
 tests/Tags/User/ProfileFormTest.php  | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/tests/Tags/User/PasswordFormTest.php b/tests/Tags/User/PasswordFormTest.php
index 0e269082966..4062090da5a 100644
--- a/tests/Tags/User/PasswordFormTest.php
+++ b/tests/Tags/User/PasswordFormTest.php
@@ -156,7 +156,7 @@ public function it_wont_update_password_and_renders_errors_with_incorrect_passwo
         preg_match_all('/<p class="inline-error">(.+)<\/p>/U', $output, $inlineErrors);
 
         $expected = [
-            'The password is incorrect.',
+            'validation.current_password',
         ];
 
         $this->assertEmpty($success[1]);
@@ -261,7 +261,7 @@ public function it_wont_update_password_and_follow_custom_redirect_with_errors()
         preg_match_all('/<p class="inline-error">(.+)<\/p>/U', $output, $inlineErrors);
 
         $expected = [
-            'The password is incorrect.',
+            'validation.current_password',
         ];
 
         $this->assertEmpty($success[1]);
diff --git a/tests/Tags/User/ProfileFormTest.php b/tests/Tags/User/ProfileFormTest.php
index 3f448ea574b..0d74e30631f 100644
--- a/tests/Tags/User/ProfileFormTest.php
+++ b/tests/Tags/User/ProfileFormTest.php
@@ -73,8 +73,8 @@ public function it_renders_form_with_fields_array()
         preg_match_all('/<label>.+<\/label><input.+>/U', $output, $actual);
 
         $expected = [
-            '<label>Name</label><input type="text" name="name" value="Test User">',
             '<label>Email Address</label><input type="email" name="email" value="test@example.com">',
+            '<label>Name</label><input type="text" name="name" value="Test User">',
         ];
 
         $this->assertEquals($expected, $actual[0]);

From 85e13297501cfadaa5853b5533ae695f5af5d66e Mon Sep 17 00:00:00 2001
From: Jack Sleight <jacksleight@gmail.com>
Date: Wed, 10 Aug 2022 17:58:16 +0100
Subject: [PATCH 13/23] WIP

---
 tests/Tags/User/PasswordFormTest.php | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/tests/Tags/User/PasswordFormTest.php b/tests/Tags/User/PasswordFormTest.php
index 4062090da5a..94074785fee 100644
--- a/tests/Tags/User/PasswordFormTest.php
+++ b/tests/Tags/User/PasswordFormTest.php
@@ -155,13 +155,15 @@ public function it_wont_update_password_and_renders_errors_with_incorrect_passwo
         preg_match_all('/<p class="error">(.+)<\/p>/U', $output, $errors);
         preg_match_all('/<p class="inline-error">(.+)<\/p>/U', $output, $inlineErrors);
 
-        $expected = [
+        $expected = [[
             'validation.current_password',
-        ];
+        ], [
+            'The password is incorrect.',
+        ]];
 
         $this->assertEmpty($success[1]);
-        $this->assertEquals($expected, $errors[1]);
-        $this->assertEquals($expected, $inlineErrors[1]);
+        $this->assertContains($errors[1], $expected);
+        $this->assertContains($inlineErrors[1], $expected);
     }
 
     /** @test */
@@ -260,13 +262,15 @@ public function it_wont_update_password_and_follow_custom_redirect_with_errors()
         preg_match_all('/<p class="error">(.+)<\/p>/U', $output, $errors);
         preg_match_all('/<p class="inline-error">(.+)<\/p>/U', $output, $inlineErrors);
 
-        $expected = [
+        $expected = [[
             'validation.current_password',
-        ];
+        ], [
+            'The password is incorrect.',
+        ]];
 
         $this->assertEmpty($success[1]);
-        $this->assertEquals($expected, $errors[1]);
-        $this->assertEquals($expected, $inlineErrors[1]);
+        $this->assertContains($errors[1], $expected);
+        $this->assertContains($inlineErrors[1], $expected);
     }
 
     /** @test */

From 9e7c2f7b21b41400475a5b11ea9bd39165f6a6dc Mon Sep 17 00:00:00 2001
From: Jack Sleight <jacksleight@gmail.com>
Date: Sat, 13 Aug 2022 11:45:29 +0100
Subject: [PATCH 14/23] Fix defautlt value

---
 src/Tags/Concerns/RendersForms.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Tags/Concerns/RendersForms.php b/src/Tags/Concerns/RendersForms.php
index 15ba0c248cd..3a9ba6fc5a3 100644
--- a/src/Tags/Concerns/RendersForms.php
+++ b/src/Tags/Concerns/RendersForms.php
@@ -82,7 +82,7 @@ protected function getRenderableField($field, $errorBag = 'default', $manipulate
 
         $data = array_merge($field->toArray(), [
             'error' => $errors->first($field->handle()) ?: null,
-            'default' => $field->value(),
+            'default' => $field->value() ?? $field->get('default'),
             'old' => old($field->handle()),
         ]);
 

From 246d14a4862e0ffe1d1605a85b7930138cf2d337 Mon Sep 17 00:00:00 2001
From: Jason Varga <jason@pixelfear.com>
Date: Thu, 1 Dec 2022 17:42:25 -0500
Subject: [PATCH 15/23] Filter out asset fields for now.

---
 src/Http/Controllers/UserController.php | 64 +++++++------------------
 1 file changed, 17 insertions(+), 47 deletions(-)

diff --git a/src/Http/Controllers/UserController.php b/src/Http/Controllers/UserController.php
index eff731109de..2960db34685 100644
--- a/src/Http/Controllers/UserController.php
+++ b/src/Http/Controllers/UserController.php
@@ -13,8 +13,6 @@
 use Statamic\Exceptions\SilentFormFailureException;
 use Statamic\Exceptions\UnauthorizedHttpException;
 use Statamic\Facades\User;
-use Statamic\Forms\Uploaders\AssetsUploader;
-use Statamic\Support\Arr;
 
 class UserController extends Controller
 {
@@ -60,13 +58,13 @@ public function register(Request $request)
         $blueprint = User::blueprint();
 
         $fields = $blueprint->fields();
-        $values = array_merge($request->all(), $this->normalizeAssetValues($fields, $request));
+        $values = $this->valuesWithoutAssetFields($fields, $request);
         $fields = $fields->addValues($values);
 
-        $fieldRules = $fields->validator()->withRules(array_merge([
+        $fieldRules = $fields->validator()->withRules([
             'email' => ['required', 'email', 'unique_user_value'],
             'password' => ['required', 'confirmed', PasswordDefaults::rules()],
-        ], $this->assetRules($fields)))->rules();
+        ])->rules();
 
         $validator = Validator::make($values, $fieldRules);
 
@@ -74,9 +72,9 @@ public function register(Request $request)
             return $this->userRegistrationFailure($validator->errors());
         }
 
-        $values = array_merge($request->all(), $this->uploadAssetFiles($fields));
-        $fields = $fields->addValues($values);
-        $values = $fields->process()->values()->except(['email', 'groups', 'roles']);
+        $values = $fields->process()->values()
+            ->only(array_keys($values))
+            ->except(['email', 'groups', 'roles']);
 
         $user = User::make()
             ->email($request->email)
@@ -115,12 +113,12 @@ public function profile(Request $request)
         $blueprint = User::blueprint();
 
         $fields = $blueprint->fields();
-        $values = array_merge($request->all(), $this->normalizeAssetValues($fields, $request));
+        $values = $this->valuesWithoutAssetFields($fields, $request);
         $fields = $fields->addValues($values);
 
-        $fieldRules = $fields->validator()->withRules(array_merge([
+        $fieldRules = $fields->validator()->withRules([
             'email' => ['required', 'email', 'unique_user_value:'.$user->id()],
-        ], $this->assetRules($fields)))->rules();
+        ])->rules();
 
         $validator = Validator::make($values, $fieldRules);
 
@@ -128,10 +126,9 @@ public function profile(Request $request)
             return $this->userProfileFailure($validator->errors());
         }
 
-        $values = array_merge($request->all(), $this->uploadAssetFiles($fields));
-        $fields = $fields->addValues($values);
-        // only() added here to filter out fields that weren't actualy submitted
-        $values = $fields->process()->values()->only(array_keys($values))->except(['email', 'password', 'groups', 'roles']);
+        $values = $fields->process()->values()
+            ->only(array_keys($values))
+            ->except(['email', 'password', 'groups', 'roles']);
 
         if ($request->email) {
             $user->email($request->email);
@@ -223,39 +220,12 @@ private function userPasswordSuccess(bool $silentFailure = false)
         return $response;
     }
 
-    protected function assetRules($fields)
+    private function valuesWithoutAssetFields($fields, $request)
     {
-        return $fields->all()
-            ->filter(function ($field) {
-                return $field->fieldtype()->handle() === 'assets';
-            })
-            ->mapWithKeys(function ($field) {
-                return [$field->handle().'.*' => 'file'];
-            })
-            ->all();
-    }
+        $assets = $fields->all()
+            ->filter(fn ($field) => $field->fieldtype()->handle() === 'assets')
+            ->keys()->all();
 
-    protected function normalizeAssetValues($fields, $request)
-    {
-        return $fields->all()
-            ->filter(function ($field) {
-                return $field->fieldtype()->handle() === 'assets' && $field->get('max_files') === 1;
-            })
-            ->map(function ($field) use ($request) {
-                return Arr::wrap($request->file($field->handle()));
-            })
-            ->all();
-    }
-
-    protected function uploadAssetFiles($fields)
-    {
-        return $fields->all()
-            ->filter(function ($field) {
-                return $field->fieldtype()->handle() === 'assets' && request()->hasFile($field->handle());
-            })
-            ->map(function ($field) {
-                return AssetsUploader::field($field)->upload(request()->file($field->handle()));
-            })
-            ->all();
+        return $request->except($assets);
     }
 }

From 8d021af7aad9d62b1a4acfbc0339aa50b514a761 Mon Sep 17 00:00:00 2001
From: Jason Varga <jason@pixelfear.com>
Date: Fri, 2 Dec 2022 10:55:47 -0500
Subject: [PATCH 16/23] Add guards so the forms only render when applicable

---
 src/Auth/UserTags.php | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/src/Auth/UserTags.php b/src/Auth/UserTags.php
index 0ad45d01cad..99f61fd8ba0 100644
--- a/src/Auth/UserTags.php
+++ b/src/Auth/UserTags.php
@@ -140,6 +140,10 @@ public function loginForm()
      */
     public function registerForm()
     {
+        if (User::current()) {
+            return __('Cannot register while logged in.');
+        }
+
         $data = $this->getFormSession('user.register');
 
         $data['fields'] = $this->getRegistrationFields();
@@ -186,6 +190,10 @@ public function registerForm()
      */
     public function profileForm()
     {
+        if (! User::current()) {
+            return __('Cannot edit profile while logged out.');
+        }
+
         if (session()->has('status')) {
             return $this->parse(['success' => true]);
         }
@@ -226,6 +234,10 @@ public function profileForm()
      */
     public function passwordForm()
     {
+        if (! User::current()) {
+            return __('Cannot change password while logged out.');
+        }
+
         if (session()->has('status')) {
             return $this->parse(['success' => true]);
         }

From 51c9c1369697a1e087e1c819b7597fbd9f01126d Mon Sep 17 00:00:00 2001
From: Jason Varga <jason@pixelfear.com>
Date: Fri, 2 Dec 2022 10:56:26 -0500
Subject: [PATCH 17/23] Now profile fields will only be used when there's a
 user

---
 src/Auth/UserTags.php | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/src/Auth/UserTags.php b/src/Auth/UserTags.php
index 99f61fd8ba0..47e1b9fe52d 100644
--- a/src/Auth/UserTags.php
+++ b/src/Auth/UserTags.php
@@ -663,9 +663,8 @@ protected function getAdditionalRegistrationFields()
     protected function getProfileFields()
     {
         $user = User::current();
-        $values = $user
-            ? $user->data()->merge(['email' => $user->email()])->all()
-            : [];
+
+        $values = $user->data()->merge(['email' => $user->email()])->all();
 
         return User::blueprint()->fields()->addValues($values)->preProcess()->all()
             ->reject(function ($field) {

From c215a669cf5b1c9007d7b63b2afcc25ad63c0fd0 Mon Sep 17 00:00:00 2001
From: Jason Varga <jason@pixelfear.com>
Date: Fri, 2 Dec 2022 10:57:45 -0500
Subject: [PATCH 18/23] Prevent asset fields showing in form

---
 src/Auth/UserTags.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/Auth/UserTags.php b/src/Auth/UserTags.php
index 47e1b9fe52d..1a25b0a9cbb 100644
--- a/src/Auth/UserTags.php
+++ b/src/Auth/UserTags.php
@@ -668,7 +668,8 @@ protected function getProfileFields()
 
         return User::blueprint()->fields()->addValues($values)->preProcess()->all()
             ->reject(function ($field) {
-                return in_array($field->handle(), ['password', 'password_confirmation', 'roles', 'groups']);
+                return in_array($field->handle(), ['password', 'password_confirmation', 'roles', 'groups'])
+                    || $field->fieldtype()->handle() === 'assets';
             })
             ->map(function ($field) {
                 return $this->getRenderableField($field, 'user.profile');

From 3d614d027a3cc106600c05bd70c96e999cb6d1a3 Mon Sep 17 00:00:00 2001
From: Jason Varga <jason@pixelfear.com>
Date: Fri, 2 Dec 2022 11:27:32 -0500
Subject: [PATCH 19/23] If for some reason the developer added a "super" field
 to the blueprint, don't allow it to be updated by the form.

---
 src/Http/Controllers/UserController.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Http/Controllers/UserController.php b/src/Http/Controllers/UserController.php
index 2960db34685..36f84b69a9b 100644
--- a/src/Http/Controllers/UserController.php
+++ b/src/Http/Controllers/UserController.php
@@ -128,7 +128,7 @@ public function profile(Request $request)
 
         $values = $fields->process()->values()
             ->only(array_keys($values))
-            ->except(['email', 'password', 'groups', 'roles']);
+            ->except(['email', 'password', 'groups', 'roles', 'super']);
 
         if ($request->email) {
             $user->email($request->email);

From e7ed268f19be49248c46520e4c4d688081b8a4b4 Mon Sep 17 00:00:00 2001
From: Jason Varga <jason@pixelfear.com>
Date: Fri, 2 Dec 2022 11:33:26 -0500
Subject: [PATCH 20/23] Need to be logged in to see the form now

---
 tests/Tags/User/PasswordFormTest.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/Tags/User/PasswordFormTest.php b/tests/Tags/User/PasswordFormTest.php
index 94074785fee..b7c17ce5bdc 100644
--- a/tests/Tags/User/PasswordFormTest.php
+++ b/tests/Tags/User/PasswordFormTest.php
@@ -281,6 +281,7 @@ public function it_will_use_redirect_query_param_off_url()
         $expectedRedirect = '<input type="hidden" name="_redirect" value="password-successful" />';
         $expectedErrorRedirect = '<input type="hidden" name="_error_redirect" value="registration-failure" />';
 
+        $this->actingAs(User::make());
         $output = $this->tag('{{ user:password_form }}{{ /user:password_form }}');
 
         $this->assertStringNotContainsString($expectedRedirect, $output);

From 5264f070d572d4d7cb4ce628c2c522a00c68a1f4 Mon Sep 17 00:00:00 2001
From: Jason Varga <jason@pixelfear.com>
Date: Fri, 2 Dec 2022 11:36:42 -0500
Subject: [PATCH 21/23] Cant hurt

---
 src/Http/Controllers/UserController.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Http/Controllers/UserController.php b/src/Http/Controllers/UserController.php
index 36f84b69a9b..3ae3d9356ca 100644
--- a/src/Http/Controllers/UserController.php
+++ b/src/Http/Controllers/UserController.php
@@ -74,7 +74,7 @@ public function register(Request $request)
 
         $values = $fields->process()->values()
             ->only(array_keys($values))
-            ->except(['email', 'groups', 'roles']);
+            ->except(['email', 'groups', 'roles', 'super']);
 
         $user = User::make()
             ->email($request->email)

From 8c5fc91a58d12640d5ac3ede16ad5b6b3f3be842 Mon Sep 17 00:00:00 2001
From: Jason Varga <jason@pixelfear.com>
Date: Fri, 2 Dec 2022 11:36:48 -0500
Subject: [PATCH 22/23] Use method

---
 src/Tags/Concerns/RendersForms.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Tags/Concerns/RendersForms.php b/src/Tags/Concerns/RendersForms.php
index 337877b5afc..8c8f34fc7a4 100644
--- a/src/Tags/Concerns/RendersForms.php
+++ b/src/Tags/Concerns/RendersForms.php
@@ -129,7 +129,7 @@ protected function getRenderableField($field, $errorBag = 'default', $manipulate
 
         $data = array_merge($field->toArray(), [
             'error' => $errors->first($field->handle()) ?: null,
-            'default' => $field->value() ?? $field->get('default'),
+            'default' => $field->value() ?? $field->defaultValue(),
             'old' => old($field->handle()),
         ]);
 

From 2e80cb6bfc6cf448e3e618875a2adb842bdca3c9 Mon Sep 17 00:00:00 2001
From: Jason Varga <jason@pixelfear.com>
Date: Thu, 8 Dec 2022 16:22:58 -0500
Subject: [PATCH 23/23] undo the dont-render-anything logic

---
 src/Auth/UserTags.php                | 16 +++-------------
 tests/Tags/User/PasswordFormTest.php |  1 -
 2 files changed, 3 insertions(+), 14 deletions(-)

diff --git a/src/Auth/UserTags.php b/src/Auth/UserTags.php
index 1a25b0a9cbb..b718400e4c9 100644
--- a/src/Auth/UserTags.php
+++ b/src/Auth/UserTags.php
@@ -140,10 +140,6 @@ public function loginForm()
      */
     public function registerForm()
     {
-        if (User::current()) {
-            return __('Cannot register while logged in.');
-        }
-
         $data = $this->getFormSession('user.register');
 
         $data['fields'] = $this->getRegistrationFields();
@@ -190,10 +186,6 @@ public function registerForm()
      */
     public function profileForm()
     {
-        if (! User::current()) {
-            return __('Cannot edit profile while logged out.');
-        }
-
         if (session()->has('status')) {
             return $this->parse(['success' => true]);
         }
@@ -234,10 +226,6 @@ public function profileForm()
      */
     public function passwordForm()
     {
-        if (! User::current()) {
-            return __('Cannot change password while logged out.');
-        }
-
         if (session()->has('status')) {
             return $this->parse(['success' => true]);
         }
@@ -664,7 +652,9 @@ protected function getProfileFields()
     {
         $user = User::current();
 
-        $values = $user->data()->merge(['email' => $user->email()])->all();
+        $values = $user
+            ? $user->data()->merge(['email' => $user->email()])->all()
+            : [];
 
         return User::blueprint()->fields()->addValues($values)->preProcess()->all()
             ->reject(function ($field) {
diff --git a/tests/Tags/User/PasswordFormTest.php b/tests/Tags/User/PasswordFormTest.php
index b7c17ce5bdc..94074785fee 100644
--- a/tests/Tags/User/PasswordFormTest.php
+++ b/tests/Tags/User/PasswordFormTest.php
@@ -281,7 +281,6 @@ public function it_will_use_redirect_query_param_off_url()
         $expectedRedirect = '<input type="hidden" name="_redirect" value="password-successful" />';
         $expectedErrorRedirect = '<input type="hidden" name="_error_redirect" value="registration-failure" />';
 
-        $this->actingAs(User::make());
         $output = $this->tag('{{ user:password_form }}{{ /user:password_form }}');
 
         $this->assertStringNotContainsString($expectedRedirect, $output);