element-hq / element-hq/element-meta
Element X: in-app password change for password-auth homeservers (iOS first; Android on request)
- Dominant language
- No language data
- Stars
- 112
- Forks
- 25
- Avg merge
- 6h 6m
- Merged PRs (30d)
- 4
Description
# Feature request: Element X in-app password change for password-auth homeservers (iOS first)
## Problem
Element X currently supports password-based login for non-OIDC homeservers, but users cannot change their own password from mobile app settings. For self-hosted Synapse deployments that intentionally use manual account provisioning (admin-assigned initial passwords), this creates a practical security gap in day-to-day operations.
## Why this matters
- Home/family/community servers often do not run OIDC today.
- Admin sets initial password; user should immediately rotate it in-app.
- Requiring web/desktop for this one task is friction and causes delayed password rotation.
## Proposal
Add a minimal in-app "Change password" flow for password-auth accounts.
### Scope (v1)
- Single feature only: user changes own password.
- Use Matrix `/_matrix/client/v3/account/password` (UIA).
- No broader admin user-management scope.
### Delivery approach
- We can implement and contribute **iOS first**.
- If maintainers want parity in same effort, we are willing to follow with Android.
## Acceptance criteria
- Password-auth account can change password in app settings.
- Old password stops working; new password works.
- Optional existing Matrix behavior: "logout other sessions" if supported by flow.
- Feature hidden/disabled when auth type is OIDC-only or unsupported by homeserver.
## Context
There was a prior iOS issue closed as not planned:
- https://github.com/element-hq/element-x-ios/issues/3492
This request asks to re-evaluate based on current self-hosted operational reality where password auth login is already supported by Element X.
Contributor guide
No contributing guide indexed for this repository
Research direction
No implementation files or tests are identified in this meta issue. Start by reviewing the prior iOS issue #3492 and the Matrix v3 account/password UIA endpoint, then locate the current iOS settings and password-auth entry points. Done means password-auth users can change passwords, old credentials stop working, and the feature is unavailable for unsupported or OIDC-only homeservers.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ios
- Domain
- authentication, mobile-dev
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100