Changing the password: Accounts gained a section of its own for it and names the Account menu instead of the Logout button, API describes POST auth/password with its 401 and 422 and the other sessions ending, Architecture lists PasswordDialog, Concepts mentions the account menu, Development carries the check sum 1126

API.md

@@ -5,6 +5,7 @@ All routes go through `api/index.php?r=…` (the site's nginx does not pass `PAT
 | GET | `auth/session` | `{user}` — the name of whoever is signed in, `null` when nobody is. Always 200, and the only route that needs no session |
 | POST | `auth/login` | `{username,password}` → `{user}` and the session cookie; **401** `{error}` for a wrong pair |
 | POST | `auth/logout` | 204, and the cookie is cleared |
+| POST | `auth/password` | `{currentPassword,newPassword}` → 204. Changes the password of whoever is signed in — the only `auth` route that needs a session. **401** for a wrong current password, **422** when the new one is shorter than 8 characters. Every other session of the account ends; the one asking keeps its own |
 | GET | `projects` | `[{id,name,revision,updatedAt}]` |
 | POST | `projects` | `{name}` → project document (201) |
 | GET | `projects/{id}` | `{id,name,revision,updatedAt,project}` |

Accounts.md

@@ -10,9 +10,10 @@ the form from there. The password is drawn as bullets and never appears as itsel
 A refused attempt says what went wrong under the form: *Enter your password* before anything is
 sent, *Wrong user name or password* when the server refuses the pair.
 
-The **Logout** button sits at the far right of the toolbar. It ends the session and brings the
-sign-in screen back. Who is signed in stands in the window title (`Game Maker — user`), not in
-the toolbar, which has no room to spare.
+The **Account** menu sits at the far right of the toolbar and holds everything about the account:
+who is signed in (as an entry that cannot be picked), *Change password* and *Logout*. Logout ends
+the session and brings the sign-in screen back. The name stands in the window title as well
+(`Game Maker — user`), because the toolbar itself has no room to spare for a label.
 
 Signing in and out never reloads the page and never builds a second canvas: the picture changes,
 nothing else. What is unsaved is written before the session ends, the editor then lets go of
@@ -20,6 +21,19 @@ everything it held — its tabs, the project, the running plugins, the console l
 sign-in screen is drawn in its place. Signing in builds a fresh editor in the same canvas, so a
 second account starts from nothing the first one left behind.
 
+## Changing the password
+
+*Account → Change password* opens a dialog asking for the current password, the new one and its
+repeat, all three drawn as bullets. The current password is asked for even though the session is
+already there: a tab somebody left open must not be enough to take an account over.
+
+A new password needs at least **8 characters**, may not be the current one, and has to match its
+repeat. The editor says so before sending anything; the server checks the length again, since a
+client is free to send whatever it likes.
+
+Every other login of the account ends with the change — a session started with the old password
+has no business outliving it. The tab that made the change keeps its own.
+
 ## The session outlasts a deployment
 
 A login is kept on the server (`data/sessions/`, one file per session, named after the hash of
@@ -50,9 +64,10 @@ straight away when a new project file is put there by hand without an owner.
     php tools/make-user.php --list
 
 Passwords are stored as hashes (`password_hash`) in `data/users.json`, which is git-ignored, as
-is `data/sessions/`. There is no route for signing up: registration (#178), administering users
-(#179), roles (#180), shared projects (#181) and changing one's own password (#182) are
-follow-ups of their own.
+is `data/sessions/`. The CLI is the only way to *create* an account and the only way to set a
+password without knowing the old one; changing one's own works in the editor (#182). Registration
+(#178), administering users (#179), roles (#180) and shared projects (#181) are follow-ups of
+their own.
 
 ## What the check tools do
 

Architecture.md

@@ -79,7 +79,7 @@ src/core/graph/        graph model, NodeRegistry/NodeContext/values, interpreter
 src/core/particles/    nodes (the catalogue), compile (a graph → one function per output),
                        emission (which particles are alive at a second — a pure rule, no state)
 src/core/store/        serialize (untrusted JSON → Project), tilemapCells (the compact form of a layer's cells in the file), http (one API call), ProjectStore/HttpProjectStore,
-                       AuthStore/HttpAuthStore (signing in and out, #177),
+                       AuthStore/HttpAuthStore (signing in and out, #177; changing the password, #182),
                        FileStore (what the server holds of one kind) + HttpFileStore (one generic client over the three
                        file collections) — TextureStore, FontStore and SoundStore are its type parameters, nothing else
 src/core/time.ts       the global clock: one scaled step a frame, shared by the world, the particles, the shaders and the animation preview
@@ -105,7 +105,7 @@ src/viewport/          view (transforms), items (what to draw), symbols (how to
 src/editor/            App → Editor (layout + ticker), PlaySession (the run), ProjectSession (load/create),
                        EditorRun (run in editor), state, actions, shortcuts, debugHook,
                        textProbe (finding widgets by their text — the ground floor of the test hook, shared with the sign-in screen),
-                       auth/LoginScreen + auth/loginRules (the sign-in screen in the canvas and what it may complain about, #177), autosave,
+                       auth/LoginScreen + auth/PasswordDialog + auth/loginRules (the sign-in screen and the change-password dialog in the canvas, and what either may complain about, #177/#182), autosave,
                        polygonEdit (corners of an outline: what is under the pointer, whether a point is inside, put / move / take away – scene view and Texture tab),
                        fileImport (drop/paste) → assetImport (one upload pipeline, an ImportKind per sort) ← textureImport / fontImport / soundImport,
                        FilePicker (the shared "+ → Texture / Font / Sound" dialog; ImagePicker/FontPicker/SoundPicker only describe their row),

Concepts.md

@@ -1,6 +1,6 @@
 | Term | Meaning |
 |---|---|
-| **Account** | Who you are signed in as. The editor asks for a user name and a password before it loads anything, and every project belongs to one account — see [Accounts](Accounts). The **Logout** button is at the far right of the toolbar; signing in and out changes what the canvas draws, it never reloads the page. |
+| **Account** | Who you are signed in as. The editor asks for a user name and a password before it loads anything, and every project belongs to one account — see [Accounts](Accounts). The **Account** menu is at the far right of the toolbar and holds the name, *Change password* and *Logout*; signing in and out changes what the canvas draws, it never reloads the page. |
 | **Asset** | Named thing with a type (`scene`, `camera`, `sprite`, `text`, `behavior`, `collider`, `container`, `texture`, `animation`, `statemachine`, `shader`, `font`, `sound`, `particles`, `variables`) and typed properties. Assets have **no position**. |
 | **Texture** | An uploaded image. Scenes, textures, animations, state machines, shaders, fonts, sounds and Variables assets are the eight types that cannot be placed: a texture has no position, it is *worn* by a sprite through the ordinary property `texture`. See [Textures](Textures). |
 | **Font** | An uploaded typeface, worn by a text through the ordinary property `font`; no font means the editor's own. Uploaded and picked exactly like a texture, and stored the same way. See [Fonts](Fonts). |

Development.md

@@ -13,7 +13,7 @@ npm run check        # typecheck + lint + format:check + tests, the gate CI runs
 npm run build        # writes dist/ and regenerates index.html
 ./build.sh           # the same under `set -o pipefail`, for callers that pipe the output
 php tools/make-user.php <name> <password>                     # an account; every tool signs in (see Accounts)
-node tools/seed-e2e.mjs && node tools/e2e.mjs                 # 1118 editor checks, screenshots in /tmp/gm-e2e-*.png
+node tools/seed-e2e.mjs && node tools/e2e.mjs                 # 1126 editor checks, screenshots in /tmp/gm-e2e-*.png
 GM_STEPS=20 node tools/e2e.mjs                                # or 1-12, or 6,20 — a subset while working on one step
 ./e2e.sh start [GM_STEPS]                                     # the same run detached, see below
 ./e2e.sh status                                               # live progress, or the last run's result