user-reauth: the user form asks for your account password (audit A2)

Security audit 2026-10-17, finding A2 (high), stage 0; the mockup is
2c27275. A stolen global session could set its own password on the user
form - no current password asked, the session kept - and then pass the
backup's reauth with it, or add a second global user with a known
password. Now the user form calls reauth (the backup's check: bcrypt
against the signed-in user's own hash, under auth.AllowPasswordChange) when
it adds a user and when a save sets a password, changes the e-mail (reset
links go there) or changes the role, the own account included; deleting a
user asks too, refused on its own confirmation page (renderUserDelete, a
Flash on UserDelete). Name and reach alone are not asked. Missing or wrong:
401 on the same page, "Your account password is incorrect.", nothing saved.

Tests: TestUserFormAsksForTheAccountPassword (create, each of password,
e-mail, role, own password, reach alone, delete); the user-form tests send
the field (withAccountPassword gives root a real hash and h an auth
module). go vet, go test ./internal/web/... on Windows.

Docs: security.md § Backup and domain export, guide § Users, help word for
word with the mockup; CHANGELOG [Unreleased] Security; plan line ticked.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/handlers/handlers_sessions_test.go

@@ -102,7 +102,7 @@ func TestAccountPasswordSignsOutOnlyTheUsersOtherSessions(t *testing.T) {
 // An administrator who sets another user's password on the user form takes
 // away every login that user had under the old one.
 func TestUserFormPasswordSignsOutThatUsersSessions(t *testing.T) {
-	h, _ := settingsServer(t)
+	h, password := settingsServer(t)
 	admin := globalPrincipal
 	bob := addUser(t, h, "bob", "bobs-long-password-1")
 	adminCurrent := signedIn(t, h, "admin", "admin-current")
@@ -110,7 +110,7 @@ func TestUserFormPasswordSignsOutThatUsersSessions(t *testing.T) {
 	bob2 := signedIn(t, h, "bob", "bob-2")
 
 	rec := postWithSession(h.HandleUserEdit, admin, adminCurrent, "/server/users/"+idStr(bob.ID), map[string]string{"uid": idStr(bob.ID)},
-		url.Values{"username": {"bob"}, "role": {"global"}, "password": {"a-brand-new-long-password"}})
+		url.Values{"username": {"bob"}, "role": {"global"}, "password": {"a-brand-new-long-password"}, "account_password": {password}})
 	if rec.Code != http.StatusSeeOther {
 		t.Fatalf("POST user form = %d:\n%s", rec.Code, rec.Body.String())
 	}
@@ -125,12 +125,12 @@ func TestUserFormPasswordSignsOutThatUsersSessions(t *testing.T) {
 
 // Saving the form without a new password does not sign anyone out.
 func TestUserFormWithoutAPasswordKeepsTheSessions(t *testing.T) {
-	h, _ := settingsServer(t)
+	h, password := settingsServer(t)
 	bob := addUser(t, h, "bob", "bobs-long-password-1")
 	bob1 := signedIn(t, h, "bob", "bob-1")
 
 	rec := postWithSession(h.HandleUserEdit, globalPrincipal, "no-session", "/server/users/"+idStr(bob.ID), map[string]string{"uid": idStr(bob.ID)},
-		url.Values{"username": {"bob"}, "role": {"global"}, "email": {"bob@example.org"}})
+		url.Values{"username": {"bob"}, "role": {"global"}, "email": {"bob@example.org"}, "account_password": {password}})
 	if rec.Code != http.StatusSeeOther {
 		t.Fatalf("POST user form = %d:\n%s", rec.Code, rec.Body.String())
 	}
@@ -142,12 +142,12 @@ func TestUserFormWithoutAPasswordKeepsTheSessions(t *testing.T) {
 // An administrator who sets their own password through the user form is signed
 // out everywhere except in the browser they are using.
 func TestUserFormOwnPasswordKeepsTheCurrentSession(t *testing.T) {
-	h, _ := settingsServer(t)
+	h, password := settingsServer(t)
 	current := signedIn(t, h, "admin", "admin-current")
 	other := signedIn(t, h, "admin", "admin-other")
 
 	rec := postWithSession(h.HandleUserEdit, globalPrincipal, current, "/server/users/1", map[string]string{"uid": "1"},
-		url.Values{"username": {"admin"}, "role": {"global"}, "password": {"a-brand-new-long-password"}})
+		url.Values{"username": {"admin"}, "role": {"global"}, "password": {"a-brand-new-long-password"}, "account_password": {password}})
 	if rec.Code != http.StatusSeeOther {
 		t.Fatalf("POST user form = %d:\n%s", rec.Code, rec.Body.String())
 	}