From 3d328d7b5a1a37594a86ba41f6a308da83d16cb2 Mon Sep 17 00:00:00 2001
From: tischsoic <symfiz@gmail.com>
Date: Thu, 3 Sep 2026 12:48:30 +0200
Subject: [PATCH 01/11] IBX-11973: Added validation to login and forgot
 password screens
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Sign in button is no longer disabled until both fields are filled;
empty or malformed fields are now reported inline on submit, the same way
the rest of the back office does it, instead of native browser bubbles.

Backend errors on the forgot password screens now also mark the input
invalid, following the pattern IBX-11959 introduced on Set new password —
its error-row macro is extracted to a shared account partial.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .../Resources/encore/ibexa.js.config.js       |  3 +-
 .../scripts/admin.account.form.validation.js  | 64 +++++++++++++++++++
 .../Resources/public/js/scripts/login.js      | 31 ---------
 .../account/forgot_password/index.html.twig   | 40 +++++++++++-
 .../index_with_login.html.twig                | 35 +++++++++-
 .../admin/account/login/index.html.twig       | 26 +++++++-
 .../themes/admin/account/macros.html.twig     | 20 ++++++
 .../account/reset_password/index.html.twig    | 19 +-----
 8 files changed, 183 insertions(+), 55 deletions(-)
 create mode 100644 src/bundle/Resources/public/js/scripts/admin.account.form.validation.js
 delete mode 100644 src/bundle/Resources/public/js/scripts/login.js
 create mode 100644 src/bundle/Resources/views/themes/admin/account/macros.html.twig

diff --git a/src/bundle/Resources/encore/ibexa.js.config.js b/src/bundle/Resources/encore/ibexa.js.config.js
index f20be70610..22797d3824 100644
--- a/src/bundle/Resources/encore/ibexa.js.config.js
+++ b/src/bundle/Resources/encore/ibexa.js.config.js
@@ -250,11 +250,12 @@ module.exports = (Encore) => {
         .addEntry('ibexa-admin-ui-login-js', [
             path.resolve(__dirname, '../public/js/scripts/admin.input.text.js'),
             path.resolve('./vendor/ibexa/design-system-twig/src/bundle/Resources/public/ts/init_components.ts'),
-            path.resolve(__dirname, '../public/js/scripts/login.js'),
+            path.resolve(__dirname, '../public/js/scripts/admin.account.form.validation.js'),
         ])
         .addEntry('ibexa-admin-ui-reset-password-js', [
             path.resolve(__dirname, '../public/js/scripts/admin.input.text.js'),
             path.resolve('./vendor/ibexa/design-system-twig/src/bundle/Resources/public/ts/init_components.ts'),
+            path.resolve(__dirname, '../public/js/scripts/admin.account.form.validation.js'),
         ])
         .addEntry('ibexa-admin-ui-user-invitation-modal', [path.resolve(__dirname, '../public/js/scripts/user.invitation.modal.js')])
         .addEntry('ibexa-admin-ui-tabs-js', [
diff --git a/src/bundle/Resources/public/js/scripts/admin.account.form.validation.js b/src/bundle/Resources/public/js/scripts/admin.account.form.validation.js
new file mode 100644
index 0000000000..3b2d886f1e
--- /dev/null
+++ b/src/bundle/Resources/public/js/scripts/admin.account.form.validation.js
@@ -0,0 +1,64 @@
+(function (global, doc) {
+    const EMAIL_REGEXP =
+        /^(([^<>()[\]\\.,;:\s@"]+(\.[^<>()[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/;
+
+    const findErrorType = (input) => {
+        const value = input.value.trim();
+
+        if (!value) {
+            return 'empty';
+        }
+
+        if (input.type === 'email' && !EMAIL_REGEXP.test(value)) {
+            return 'invalid-email';
+        }
+
+        return null;
+    };
+    const toggleFieldState = (input, errorType) => {
+        const field = input.closest('.form-group');
+        const label = field.querySelector('.ids-label');
+        const hasError = errorType !== null;
+
+        field.classList.toggle('has-error', hasError);
+        input.classList.toggle('ids-input--error', hasError);
+        label?.classList.toggle('ids-label--error', hasError);
+
+        field.querySelectorAll('.ibexa-form-error__row').forEach((errorRow) => {
+            errorRow.hidden = errorRow.dataset.errorType !== errorType;
+        });
+    };
+    const checkIsInputValid = (input) => {
+        const errorType = findErrorType(input);
+
+        toggleFieldState(input, errorType);
+
+        return errorType === null;
+    };
+    const handleSubmit = (event) => {
+        const form = event.currentTarget;
+        const inputs = [...form.querySelectorAll('input[required]')];
+        const invalidInputs = inputs.filter((input) => !checkIsInputValid(input));
+
+        if (invalidInputs.length) {
+            event.preventDefault();
+
+            invalidInputs[0].focus();
+        }
+    };
+    const handleInput = (event) => {
+        const input = event.currentTarget;
+
+        if (input.closest('.form-group').classList.contains('has-error')) {
+            checkIsInputValid(input);
+        }
+    };
+
+    doc.querySelectorAll('form[data-account-validate]').forEach((form) => {
+        form.addEventListener('submit', handleSubmit, false);
+
+        form.querySelectorAll('input[required]').forEach((input) => {
+            input.addEventListener('input', handleInput, false);
+        });
+    });
+})(window, window.document);
diff --git a/src/bundle/Resources/public/js/scripts/login.js b/src/bundle/Resources/public/js/scripts/login.js
deleted file mode 100644
index 4f59528359..0000000000
--- a/src/bundle/Resources/public/js/scripts/login.js
+++ /dev/null
@@ -1,31 +0,0 @@
-(function (global, doc) {
-    const AUTOFILL_TIMEOUT = 500;
-    const loginBtn = doc.querySelector('.ibexa-login__btn--sign-in');
-    const nameInput = doc.querySelector('.ibexa-login__input--name');
-    const passwordInput = doc.querySelector('.ibexa-login__input--password');
-    const toggleLoginBtnState = () => {
-        const shouldBeDisabled = !nameInput.value || !passwordInput.value;
-
-        loginBtn.toggleAttribute('disabled', shouldBeDisabled);
-    };
-    const handleAutofill = () => {
-        const isNameInputAutofilled = nameInput.matches(':-webkit-autofill');
-        const isPasswordInputAutofilled = nameInput.matches(':-webkit-autofill');
-        const isAutofilled = isNameInputAutofilled && isPasswordInputAutofilled;
-
-        if (isAutofilled) {
-            loginBtn.removeAttribute('disabled');
-        }
-    };
-
-    if (loginBtn) {
-        nameInput.addEventListener('keyup', toggleLoginBtnState, false);
-        nameInput.addEventListener('change', toggleLoginBtnState, false);
-        passwordInput.addEventListener('keyup', toggleLoginBtnState, false);
-        passwordInput.addEventListener('change', toggleLoginBtnState, false);
-
-        toggleLoginBtnState();
-
-        global.setTimeout(handleAutofill, AUTOFILL_TIMEOUT);
-    }
-})(window, window.document);
diff --git a/src/bundle/Resources/views/themes/admin/account/forgot_password/index.html.twig b/src/bundle/Resources/views/themes/admin/account/forgot_password/index.html.twig
index e7ffa3b29c..c0bf3f14e4 100644
--- a/src/bundle/Resources/views/themes/admin/account/forgot_password/index.html.twig
+++ b/src/bundle/Resources/views/themes/admin/account/forgot_password/index.html.twig
@@ -3,14 +3,50 @@
 {% form_theme form_forgot_user_password '@ibexadesign/ui/form_fields.html.twig' %}
 
 {%- block content -%}
+    {% from '@ibexadesign/account/macros.html.twig' import error_row %}
+
     <div class="ibexa-login__actions-headline">{{ 'authentication.forgot_password'|trans|desc('Forgot password') }}</div>
     {% if reason == userForgotPasswordReasonMigration %}
         <p>{{ 'ezplatform.forgot_password.reset_your_password.reason.migration'|trans|desc('Your password has expired, change it.') }}</p>
     {% endif %}
     {% if form_forgot_user_password is defined %}
-        {{ form_start(form_forgot_user_password, {'attr': {'class': 'ibexa-form-validate ibexa-login__forgot-password-form'}}) }}
+        {% set email_form = form_forgot_user_password.email %}
+        {% set email_errors = email_form.vars.errors %}
+        {% set email_label = email_form.vars.label|trans({}, email_form.vars.translation_domain) %}
+
+        {{ form_start(form_forgot_user_password, {
+            attr: {
+                novalidate: true,
+                class: 'ibexa-login__forgot-password-form',
+                'data-account-validate': true,
+            },
+        }) }}
         <fieldset>
-            {{ form_row(form_forgot_user_password.email, {'attr': {'class': 'ibexa-login__input'}}) }}
+            <div class="form-group{% if email_errors is not empty %} has-error{% endif %}">
+                {{ form_label(email_form) }}
+                {{ form_widget(email_form, {
+                    attr: {
+                        class: 'ibexa-login__input' ~ (email_errors is not empty ? ' is-invalid'),
+                        error: email_errors is not empty,
+                        required: true,
+                    },
+                }) }}
+                <div class="ibexa-form-error">
+                    {% for error in email_errors %}
+                        {{ error_row(error.message) }}
+                    {% endfor %}
+                    {{ error_row(
+                        'error.required.field'|trans({ '%fieldName%': email_label }, 'forms')|desc('%fieldName% cannot be empty.'),
+                        'empty',
+                        true
+                    ) }}
+                    {{ error_row(
+                        'js.error.invalid_email'|trans({}, 'validators')|desc('A valid email address is required'),
+                        'invalid-email',
+                        true
+                    ) }}
+                </div>
+            </div>
         </fieldset>
         {{ form_widget(form_forgot_user_password.reset, {'attr': {'class': 'ids-btn ids-btn--primary ids-btn--medium ibexa-login__btn ibexa-login__btn--reset-password'}}) }}
 
diff --git a/src/bundle/Resources/views/themes/admin/account/forgot_password/index_with_login.html.twig b/src/bundle/Resources/views/themes/admin/account/forgot_password/index_with_login.html.twig
index 12a513896e..ae07111a3d 100644
--- a/src/bundle/Resources/views/themes/admin/account/forgot_password/index_with_login.html.twig
+++ b/src/bundle/Resources/views/themes/admin/account/forgot_password/index_with_login.html.twig
@@ -3,14 +3,43 @@
 {% form_theme form_forgot_user_password_with_login '@ibexadesign/ui/form_fields.html.twig'  %}
 
 {%- block content -%}
+    {% from '@ibexadesign/account/macros.html.twig' import error_row %}
+
     <div class="ibexa-login__actions-headline">{{ 'authentication.forgot_password'|trans|desc('Forgot password') }}</div>
     <p>
         {{ 'ezplatform.forgot_user_password.login'|trans|desc('This email is connected with several accounts. Enter your login instead.') }}
     </p>
     {% if form_forgot_user_password_with_login is defined %}
-        {{ form_start(form_forgot_user_password_with_login, {'attr': {'class': 'ibexa-form-validate'} }) }}
+        {% set login_form = form_forgot_user_password_with_login.login %}
+        {% set login_errors = login_form.vars.errors %}
+
+        {{ form_start(form_forgot_user_password_with_login, {
+            attr: {
+                novalidate: true,
+                'data-account-validate': true,
+            },
+        }) }}
         <fieldset>
-            {{ form_row(form_forgot_user_password_with_login.login) }}
+            <div class="form-group{% if login_errors is not empty %} has-error{% endif %}">
+                {{ form_label(login_form) }}
+                {{ form_widget(login_form, {
+                    attr: {
+                        class: login_errors is not empty ? 'is-invalid' : '',
+                        error: login_errors is not empty,
+                        required: true,
+                    },
+                }) }}
+                <div class="ibexa-form-error">
+                    {% for error in login_errors %}
+                        {{ error_row(error.message) }}
+                    {% endfor %}
+                    {{ error_row(
+                        'error.required.field_not_blank'|trans({}, 'forms')|desc('This value should not be blank.'),
+                        'empty',
+                        true
+                    ) }}
+                </div>
+            </div>
         </fieldset>
         {{ form_widget(form_forgot_user_password_with_login.reset, {'attr': {'class': 'ids-btn ids-btn--primary ids-btn--medium ibexa-login__btn ibexa-login__btn--reset-password'}}) }}
 
@@ -19,4 +48,6 @@
     <p class="mt-5">
     {{ 'ezplatform.forgot_user_password.contact_administrator'|trans|desc('If you do not remember your login, contact your Administrator.') }}
     </p>
+
+    {{ encore_entry_script_tags('ibexa-admin-ui-reset-password-js', null, 'ibexa') }}
 {%- endblock content -%}
diff --git a/src/bundle/Resources/views/themes/admin/account/login/index.html.twig b/src/bundle/Resources/views/themes/admin/account/login/index.html.twig
index 446fa64c64..f24225374f 100644
--- a/src/bundle/Resources/views/themes/admin/account/login/index.html.twig
+++ b/src/bundle/Resources/views/themes/admin/account/login/index.html.twig
@@ -9,7 +9,13 @@
     {% block login_form %}
         {{ ibexa_twig_component_group('admin-ui-login-form-before') }}
 
-        <form action="{{ path( 'login_check' ) }}" method="post" role="form">
+        <form
+            action="{{ path( 'login_check' ) }}"
+            method="post"
+            role="form"
+            novalidate
+            data-account-validate
+        >
             <fieldset>
                 {% block login_form_errors %}
                     {% if error %}
@@ -23,6 +29,8 @@
                 {% endblock %}
 
                 {% block login_form_fields %}
+                    {% from '@ibexadesign/account/macros.html.twig' import error_row %}
+
                     <div class="form-group{% if error %} has-error{% endif %}">
                         <div class="ibexa-login__input-label-wrapper">
                             <twig:ibexa:label for="username">{{ 'authentication.login'|trans|desc('Login') }}</twig:ibexa:label>
@@ -40,6 +48,13 @@
                                 placeholder: ' '
                             }
                         } only -%}
+                        <div class="ibexa-form-error">
+                            {{ error_row(
+                                'error.required.field'|trans({ '%fieldName%': 'authentication.login'|trans|desc('Login') }, 'forms')|desc('%fieldName% cannot be empty.'),
+                                'empty',
+                                true
+                            ) }}
+                        </div>
                     </div>
                     <div class="form-group{% if error %} has-error{% endif %} position-relative">
                         <div class="ibexa-login__input-label-wrapper">
@@ -55,6 +70,13 @@
                                 placeholder: ' '
                             }
                         } only -%}
+                        <div class="ibexa-form-error">
+                            {{ error_row(
+                                'error.required.field'|trans({ '%fieldName%': 'authentication.password'|trans|desc('Password') }, 'forms')|desc('%fieldName% cannot be empty.'),
+                                'empty',
+                                true
+                            ) }}
+                        </div>
                     </div>
 
                     <input type="hidden" name="_csrf_token" value="{{ csrf_token("authenticate") }}" />
@@ -68,7 +90,6 @@
                         type="primary"
                         htmlType="submit"
                         class="ibexa-login__btn ibexa-login__btn--sign-in"
-                        :disabled="true"
                     >
                         {{ 'authentication.sign_in'|trans|desc('Sign in') }}
                     </twig:ibexa:button>
@@ -80,7 +101,6 @@
                             type="secondary"
                             htmlType="submit"
                             class="ibexa-login__btn"
-                            :disabled="true"
                         >
                             {{ 'authentication.sso'|trans|desc('Sign in with SSO') }}
                         </twig:ibexa:button>
diff --git a/src/bundle/Resources/views/themes/admin/account/macros.html.twig b/src/bundle/Resources/views/themes/admin/account/macros.html.twig
new file mode 100644
index 0000000000..9bf90b4fda
--- /dev/null
+++ b/src/bundle/Resources/views/themes/admin/account/macros.html.twig
@@ -0,0 +1,20 @@
+{% macro error_row(message, error_type = null, is_hidden = false) %}
+    <em
+        class="ibexa-form-error__row"
+        {%- if error_type is not null %} data-error-type="{{ error_type }}"{% endif %}
+        {%- if is_hidden %} hidden{% endif -%}
+    >
+        <svg class="ibexa-icon ibexa-icon--small ibexa-form-error__icon">
+            <use xlink:href="{{ ibexa_icon_path('notice') }}"></use>
+        </svg>
+        {{ message }}
+    </em>
+{% endmacro %}
+
+{% macro field_errors(errors) %}
+    <div class="ibexa-form-error">
+        {% for error in errors %}
+            {{ _self.error_row(error.message) }}
+        {% endfor %}
+    </div>
+{% endmacro %}
diff --git a/src/bundle/Resources/views/themes/admin/account/reset_password/index.html.twig b/src/bundle/Resources/views/themes/admin/account/reset_password/index.html.twig
index 49acba07e1..eb4c4597c8 100644
--- a/src/bundle/Resources/views/themes/admin/account/reset_password/index.html.twig
+++ b/src/bundle/Resources/views/themes/admin/account/reset_password/index.html.twig
@@ -4,21 +4,8 @@
     {% form_theme form_reset_user_password '@ibexadesign/ui/form_fields.html.twig' %}
 {% endif %}
 
-{% macro password_field_errors(errors) %}
-    <div class="ibexa-form-error">
-        {% for error in errors %}
-            <em class="ibexa-form-error__row">
-                <svg class="ibexa-icon ibexa-icon--small ibexa-form-error__icon">
-                    <use xlink:href="{{ ibexa_icon_path('notice') }}"></use>
-                </svg>
-                {{ error.message }}
-            </em>
-        {% endfor %}
-    </div>
-{% endmacro %}
-
 {%- block content -%}
-    {% import _self as reset_password_macros %}
+    {% from '@ibexadesign/account/macros.html.twig' import field_errors %}
 
     <div class="ibexa-login__actions-headline">{{ 'ezplatform.reset_user_password.change_password'|trans|desc('Set new password') }}</div>
     {% if form_reset_user_password is defined %}
@@ -72,7 +59,7 @@
                     : {}
                 ) }}
                 {% if policy_errors is not empty %}
-                    {{ reset_password_macros.password_field_errors(policy_errors) }}
+                    {{ field_errors(policy_errors) }}
                 {% endif %}
             </div>
             <div class="form-group{% if other_errors is not empty %} has-error{% endif %}">
@@ -82,7 +69,7 @@
                     : {}
                 ) }}
                 {% if other_errors is not empty %}
-                    {{ reset_password_macros.password_field_errors(other_errors) }}
+                    {{ field_errors(other_errors) }}
                 {% endif %}
             </div>
         </fieldset>

From c0164be564918e33ca6dc9bc9c7c41190099816d Mon Sep 17 00:00:00 2001
From: tischsoic <symfiz@gmail.com>
Date: Thu, 3 Sep 2026 13:02:30 +0200
Subject: [PATCH 02/11] IBX-11973: Dropped the client-side validation from the
 account screens

Validation goes back to the backend: the forgot password screens post
their empty value, and the constraint violation now also marks the input
invalid instead of only printing the message. Native browser validation
stays as the safety net on the login form.

This leaves the Set new password screen untouched, so its error-row macro
no longer needs extracting.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .../scripts/admin.account.form.validation.js  | 64 -------------------
 .../account/forgot_password/index.html.twig   | 45 ++-----------
 .../index_with_login.html.twig                | 39 ++---------
 .../admin/account/login/index.html.twig       | 24 +------
 .../themes/admin/account/macros.html.twig     | 20 ------
 .../account/reset_password/index.html.twig    | 19 +++++-
 6 files changed, 30 insertions(+), 181 deletions(-)
 delete mode 100644 src/bundle/Resources/public/js/scripts/admin.account.form.validation.js
 delete mode 100644 src/bundle/Resources/views/themes/admin/account/macros.html.twig

diff --git a/src/bundle/Resources/public/js/scripts/admin.account.form.validation.js b/src/bundle/Resources/public/js/scripts/admin.account.form.validation.js
deleted file mode 100644
index 3b2d886f1e..0000000000
--- a/src/bundle/Resources/public/js/scripts/admin.account.form.validation.js
+++ /dev/null
@@ -1,64 +0,0 @@
-(function (global, doc) {
-    const EMAIL_REGEXP =
-        /^(([^<>()[\]\\.,;:\s@"]+(\.[^<>()[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/;
-
-    const findErrorType = (input) => {
-        const value = input.value.trim();
-
-        if (!value) {
-            return 'empty';
-        }
-
-        if (input.type === 'email' && !EMAIL_REGEXP.test(value)) {
-            return 'invalid-email';
-        }
-
-        return null;
-    };
-    const toggleFieldState = (input, errorType) => {
-        const field = input.closest('.form-group');
-        const label = field.querySelector('.ids-label');
-        const hasError = errorType !== null;
-
-        field.classList.toggle('has-error', hasError);
-        input.classList.toggle('ids-input--error', hasError);
-        label?.classList.toggle('ids-label--error', hasError);
-
-        field.querySelectorAll('.ibexa-form-error__row').forEach((errorRow) => {
-            errorRow.hidden = errorRow.dataset.errorType !== errorType;
-        });
-    };
-    const checkIsInputValid = (input) => {
-        const errorType = findErrorType(input);
-
-        toggleFieldState(input, errorType);
-
-        return errorType === null;
-    };
-    const handleSubmit = (event) => {
-        const form = event.currentTarget;
-        const inputs = [...form.querySelectorAll('input[required]')];
-        const invalidInputs = inputs.filter((input) => !checkIsInputValid(input));
-
-        if (invalidInputs.length) {
-            event.preventDefault();
-
-            invalidInputs[0].focus();
-        }
-    };
-    const handleInput = (event) => {
-        const input = event.currentTarget;
-
-        if (input.closest('.form-group').classList.contains('has-error')) {
-            checkIsInputValid(input);
-        }
-    };
-
-    doc.querySelectorAll('form[data-account-validate]').forEach((form) => {
-        form.addEventListener('submit', handleSubmit, false);
-
-        form.querySelectorAll('input[required]').forEach((input) => {
-            input.addEventListener('input', handleInput, false);
-        });
-    });
-})(window, window.document);
diff --git a/src/bundle/Resources/views/themes/admin/account/forgot_password/index.html.twig b/src/bundle/Resources/views/themes/admin/account/forgot_password/index.html.twig
index c0bf3f14e4..097c66f8dd 100644
--- a/src/bundle/Resources/views/themes/admin/account/forgot_password/index.html.twig
+++ b/src/bundle/Resources/views/themes/admin/account/forgot_password/index.html.twig
@@ -3,50 +3,19 @@
 {% form_theme form_forgot_user_password '@ibexadesign/ui/form_fields.html.twig' %}
 
 {%- block content -%}
-    {% from '@ibexadesign/account/macros.html.twig' import error_row %}
-
     <div class="ibexa-login__actions-headline">{{ 'authentication.forgot_password'|trans|desc('Forgot password') }}</div>
     {% if reason == userForgotPasswordReasonMigration %}
         <p>{{ 'ezplatform.forgot_password.reset_your_password.reason.migration'|trans|desc('Your password has expired, change it.') }}</p>
     {% endif %}
     {% if form_forgot_user_password is defined %}
-        {% set email_form = form_forgot_user_password.email %}
-        {% set email_errors = email_form.vars.errors %}
-        {% set email_label = email_form.vars.label|trans({}, email_form.vars.translation_domain) %}
-
-        {{ form_start(form_forgot_user_password, {
-            attr: {
-                novalidate: true,
-                class: 'ibexa-login__forgot-password-form',
-                'data-account-validate': true,
-            },
-        }) }}
+        {{ form_start(form_forgot_user_password, {'attr': {'class': 'ibexa-form-validate ibexa-login__forgot-password-form'}}) }}
         <fieldset>
-            <div class="form-group{% if email_errors is not empty %} has-error{% endif %}">
-                {{ form_label(email_form) }}
-                {{ form_widget(email_form, {
-                    attr: {
-                        class: 'ibexa-login__input' ~ (email_errors is not empty ? ' is-invalid'),
-                        error: email_errors is not empty,
-                        required: true,
-                    },
-                }) }}
-                <div class="ibexa-form-error">
-                    {% for error in email_errors %}
-                        {{ error_row(error.message) }}
-                    {% endfor %}
-                    {{ error_row(
-                        'error.required.field'|trans({ '%fieldName%': email_label }, 'forms')|desc('%fieldName% cannot be empty.'),
-                        'empty',
-                        true
-                    ) }}
-                    {{ error_row(
-                        'js.error.invalid_email'|trans({}, 'validators')|desc('A valid email address is required'),
-                        'invalid-email',
-                        true
-                    ) }}
-                </div>
-            </div>
+            {{ form_row(form_forgot_user_password.email, {
+                'attr': {
+                    'class': 'ibexa-login__input',
+                    'error': form_forgot_user_password.email.vars.errors is not empty,
+                },
+            }) }}
         </fieldset>
         {{ form_widget(form_forgot_user_password.reset, {'attr': {'class': 'ids-btn ids-btn--primary ids-btn--medium ibexa-login__btn ibexa-login__btn--reset-password'}}) }}
 
diff --git a/src/bundle/Resources/views/themes/admin/account/forgot_password/index_with_login.html.twig b/src/bundle/Resources/views/themes/admin/account/forgot_password/index_with_login.html.twig
index ae07111a3d..8e011fc272 100644
--- a/src/bundle/Resources/views/themes/admin/account/forgot_password/index_with_login.html.twig
+++ b/src/bundle/Resources/views/themes/admin/account/forgot_password/index_with_login.html.twig
@@ -3,43 +3,18 @@
 {% form_theme form_forgot_user_password_with_login '@ibexadesign/ui/form_fields.html.twig'  %}
 
 {%- block content -%}
-    {% from '@ibexadesign/account/macros.html.twig' import error_row %}
-
     <div class="ibexa-login__actions-headline">{{ 'authentication.forgot_password'|trans|desc('Forgot password') }}</div>
     <p>
         {{ 'ezplatform.forgot_user_password.login'|trans|desc('This email is connected with several accounts. Enter your login instead.') }}
     </p>
     {% if form_forgot_user_password_with_login is defined %}
-        {% set login_form = form_forgot_user_password_with_login.login %}
-        {% set login_errors = login_form.vars.errors %}
-
-        {{ form_start(form_forgot_user_password_with_login, {
-            attr: {
-                novalidate: true,
-                'data-account-validate': true,
-            },
-        }) }}
+        {{ form_start(form_forgot_user_password_with_login, {'attr': {'class': 'ibexa-form-validate'} }) }}
         <fieldset>
-            <div class="form-group{% if login_errors is not empty %} has-error{% endif %}">
-                {{ form_label(login_form) }}
-                {{ form_widget(login_form, {
-                    attr: {
-                        class: login_errors is not empty ? 'is-invalid' : '',
-                        error: login_errors is not empty,
-                        required: true,
-                    },
-                }) }}
-                <div class="ibexa-form-error">
-                    {% for error in login_errors %}
-                        {{ error_row(error.message) }}
-                    {% endfor %}
-                    {{ error_row(
-                        'error.required.field_not_blank'|trans({}, 'forms')|desc('This value should not be blank.'),
-                        'empty',
-                        true
-                    ) }}
-                </div>
-            </div>
+            {{ form_row(form_forgot_user_password_with_login.login, {
+                'attr': {
+                    'error': form_forgot_user_password_with_login.login.vars.errors is not empty,
+                },
+            }) }}
         </fieldset>
         {{ form_widget(form_forgot_user_password_with_login.reset, {'attr': {'class': 'ids-btn ids-btn--primary ids-btn--medium ibexa-login__btn ibexa-login__btn--reset-password'}}) }}
 
@@ -48,6 +23,4 @@
     <p class="mt-5">
     {{ 'ezplatform.forgot_user_password.contact_administrator'|trans|desc('If you do not remember your login, contact your Administrator.') }}
     </p>
-
-    {{ encore_entry_script_tags('ibexa-admin-ui-reset-password-js', null, 'ibexa') }}
 {%- endblock content -%}
diff --git a/src/bundle/Resources/views/themes/admin/account/login/index.html.twig b/src/bundle/Resources/views/themes/admin/account/login/index.html.twig
index f24225374f..5dd6c2fa77 100644
--- a/src/bundle/Resources/views/themes/admin/account/login/index.html.twig
+++ b/src/bundle/Resources/views/themes/admin/account/login/index.html.twig
@@ -9,13 +9,7 @@
     {% block login_form %}
         {{ ibexa_twig_component_group('admin-ui-login-form-before') }}
 
-        <form
-            action="{{ path( 'login_check' ) }}"
-            method="post"
-            role="form"
-            novalidate
-            data-account-validate
-        >
+        <form action="{{ path( 'login_check' ) }}" method="post" role="form">
             <fieldset>
                 {% block login_form_errors %}
                     {% if error %}
@@ -29,8 +23,6 @@
                 {% endblock %}
 
                 {% block login_form_fields %}
-                    {% from '@ibexadesign/account/macros.html.twig' import error_row %}
-
                     <div class="form-group{% if error %} has-error{% endif %}">
                         <div class="ibexa-login__input-label-wrapper">
                             <twig:ibexa:label for="username">{{ 'authentication.login'|trans|desc('Login') }}</twig:ibexa:label>
@@ -48,13 +40,6 @@
                                 placeholder: ' '
                             }
                         } only -%}
-                        <div class="ibexa-form-error">
-                            {{ error_row(
-                                'error.required.field'|trans({ '%fieldName%': 'authentication.login'|trans|desc('Login') }, 'forms')|desc('%fieldName% cannot be empty.'),
-                                'empty',
-                                true
-                            ) }}
-                        </div>
                     </div>
                     <div class="form-group{% if error %} has-error{% endif %} position-relative">
                         <div class="ibexa-login__input-label-wrapper">
@@ -70,13 +55,6 @@
                                 placeholder: ' '
                             }
                         } only -%}
-                        <div class="ibexa-form-error">
-                            {{ error_row(
-                                'error.required.field'|trans({ '%fieldName%': 'authentication.password'|trans|desc('Password') }, 'forms')|desc('%fieldName% cannot be empty.'),
-                                'empty',
-                                true
-                            ) }}
-                        </div>
                     </div>
 
                     <input type="hidden" name="_csrf_token" value="{{ csrf_token("authenticate") }}" />
diff --git a/src/bundle/Resources/views/themes/admin/account/macros.html.twig b/src/bundle/Resources/views/themes/admin/account/macros.html.twig
deleted file mode 100644
index 9bf90b4fda..0000000000
--- a/src/bundle/Resources/views/themes/admin/account/macros.html.twig
+++ /dev/null
@@ -1,20 +0,0 @@
-{% macro error_row(message, error_type = null, is_hidden = false) %}
-    <em
-        class="ibexa-form-error__row"
-        {%- if error_type is not null %} data-error-type="{{ error_type }}"{% endif %}
-        {%- if is_hidden %} hidden{% endif -%}
-    >
-        <svg class="ibexa-icon ibexa-icon--small ibexa-form-error__icon">
-            <use xlink:href="{{ ibexa_icon_path('notice') }}"></use>
-        </svg>
-        {{ message }}
-    </em>
-{% endmacro %}
-
-{% macro field_errors(errors) %}
-    <div class="ibexa-form-error">
-        {% for error in errors %}
-            {{ _self.error_row(error.message) }}
-        {% endfor %}
-    </div>
-{% endmacro %}
diff --git a/src/bundle/Resources/views/themes/admin/account/reset_password/index.html.twig b/src/bundle/Resources/views/themes/admin/account/reset_password/index.html.twig
index eb4c4597c8..49acba07e1 100644
--- a/src/bundle/Resources/views/themes/admin/account/reset_password/index.html.twig
+++ b/src/bundle/Resources/views/themes/admin/account/reset_password/index.html.twig
@@ -4,8 +4,21 @@
     {% form_theme form_reset_user_password '@ibexadesign/ui/form_fields.html.twig' %}
 {% endif %}
 
+{% macro password_field_errors(errors) %}
+    <div class="ibexa-form-error">
+        {% for error in errors %}
+            <em class="ibexa-form-error__row">
+                <svg class="ibexa-icon ibexa-icon--small ibexa-form-error__icon">
+                    <use xlink:href="{{ ibexa_icon_path('notice') }}"></use>
+                </svg>
+                {{ error.message }}
+            </em>
+        {% endfor %}
+    </div>
+{% endmacro %}
+
 {%- block content -%}
-    {% from '@ibexadesign/account/macros.html.twig' import field_errors %}
+    {% import _self as reset_password_macros %}
 
     <div class="ibexa-login__actions-headline">{{ 'ezplatform.reset_user_password.change_password'|trans|desc('Set new password') }}</div>
     {% if form_reset_user_password is defined %}
@@ -59,7 +72,7 @@
                     : {}
                 ) }}
                 {% if policy_errors is not empty %}
-                    {{ field_errors(policy_errors) }}
+                    {{ reset_password_macros.password_field_errors(policy_errors) }}
                 {% endif %}
             </div>
             <div class="form-group{% if other_errors is not empty %} has-error{% endif %}">
@@ -69,7 +82,7 @@
                     : {}
                 ) }}
                 {% if other_errors is not empty %}
-                    {{ field_errors(other_errors) }}
+                    {{ reset_password_macros.password_field_errors(other_errors) }}
                 {% endif %}
             </div>
         </fieldset>

From 2047967b7c7a8ad9cb4547237ad65653ef74dd3a Mon Sep 17 00:00:00 2001
From: tischsoic <symfiz@gmail.com>
Date: Thu, 3 Sep 2026 13:09:02 +0200
Subject: [PATCH 03/11] IBX-11973: Removed the validation script from the
 Encore entries

The script itself was already deleted; the login and reset password
entries still pointed at it.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 src/bundle/Resources/encore/ibexa.js.config.js | 2 --
 1 file changed, 2 deletions(-)

diff --git a/src/bundle/Resources/encore/ibexa.js.config.js b/src/bundle/Resources/encore/ibexa.js.config.js
index 22797d3824..32a0b07254 100644
--- a/src/bundle/Resources/encore/ibexa.js.config.js
+++ b/src/bundle/Resources/encore/ibexa.js.config.js
@@ -250,12 +250,10 @@ module.exports = (Encore) => {
         .addEntry('ibexa-admin-ui-login-js', [
             path.resolve(__dirname, '../public/js/scripts/admin.input.text.js'),
             path.resolve('./vendor/ibexa/design-system-twig/src/bundle/Resources/public/ts/init_components.ts'),
-            path.resolve(__dirname, '../public/js/scripts/admin.account.form.validation.js'),
         ])
         .addEntry('ibexa-admin-ui-reset-password-js', [
             path.resolve(__dirname, '../public/js/scripts/admin.input.text.js'),
             path.resolve('./vendor/ibexa/design-system-twig/src/bundle/Resources/public/ts/init_components.ts'),
-            path.resolve(__dirname, '../public/js/scripts/admin.account.form.validation.js'),
         ])
         .addEntry('ibexa-admin-ui-user-invitation-modal', [path.resolve(__dirname, '../public/js/scripts/user.invitation.modal.js')])
         .addEntry('ibexa-admin-ui-tabs-js', [

From 4c91ec3e6fa4ebd2b4169c4e1cb43ac4e72fba3e Mon Sep 17 00:00:00 2001
From: tischsoic <symfiz@gmail.com>
Date: Thu, 3 Sep 2026 13:11:31 +0200
Subject: [PATCH 04/11] IBX-11973: Marked the label invalid alongside the field

An invalid field reddens both its input and its label elsewhere in the
back office; the forgot password screens only reddened the input.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .../views/themes/admin/account/forgot_password/index.html.twig | 3 +++
 .../admin/account/forgot_password/index_with_login.html.twig   | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/src/bundle/Resources/views/themes/admin/account/forgot_password/index.html.twig b/src/bundle/Resources/views/themes/admin/account/forgot_password/index.html.twig
index 097c66f8dd..00df085b4b 100644
--- a/src/bundle/Resources/views/themes/admin/account/forgot_password/index.html.twig
+++ b/src/bundle/Resources/views/themes/admin/account/forgot_password/index.html.twig
@@ -15,6 +15,9 @@
                     'class': 'ibexa-login__input',
                     'error': form_forgot_user_password.email.vars.errors is not empty,
                 },
+                'label_attr': {
+                    'class': form_forgot_user_password.email.vars.errors is not empty ? 'ids-label--error' : '',
+                },
             }) }}
         </fieldset>
         {{ form_widget(form_forgot_user_password.reset, {'attr': {'class': 'ids-btn ids-btn--primary ids-btn--medium ibexa-login__btn ibexa-login__btn--reset-password'}}) }}
diff --git a/src/bundle/Resources/views/themes/admin/account/forgot_password/index_with_login.html.twig b/src/bundle/Resources/views/themes/admin/account/forgot_password/index_with_login.html.twig
index 8e011fc272..3a5ceb7c10 100644
--- a/src/bundle/Resources/views/themes/admin/account/forgot_password/index_with_login.html.twig
+++ b/src/bundle/Resources/views/themes/admin/account/forgot_password/index_with_login.html.twig
@@ -14,6 +14,9 @@
                 'attr': {
                     'error': form_forgot_user_password_with_login.login.vars.errors is not empty,
                 },
+                'label_attr': {
+                    'class': form_forgot_user_password_with_login.login.vars.errors is not empty ? 'ids-label--error' : '',
+                },
             }) }}
         </fieldset>
         {{ form_widget(form_forgot_user_password_with_login.reset, {'attr': {'class': 'ids-btn ids-btn--primary ids-btn--medium ibexa-login__btn ibexa-login__btn--reset-password'}}) }}

From 74034ce6da2d60029e6f0c4c6e3a778ed046eb5b Mon Sep 17 00:00:00 2001
From: tischsoic <symfiz@gmail.com>
Date: Tue, 8 Sep 2026 07:44:42 +0200
Subject: [PATCH 05/11] IBX-11973: Reported blank login fields on the field
 itself
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Clicking Sign in with an empty field now always submits — the browser no
longer blocks it — and the field comes back marked invalid with a message
beneath it, matching the forgot password screen. The banner is kept for
failures that are not a blank field, so a wrong password still reads as
"Bad credentials." rather than pointing at one of the fields.

Requires ibexa/user to preserve which field was blank.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .../admin/account/login/index.html.twig       | 41 ++++++++++++++++---
 1 file changed, 35 insertions(+), 6 deletions(-)

diff --git a/src/bundle/Resources/views/themes/admin/account/login/index.html.twig b/src/bundle/Resources/views/themes/admin/account/login/index.html.twig
index 5dd6c2fa77..610d691fe9 100644
--- a/src/bundle/Resources/views/themes/admin/account/login/index.html.twig
+++ b/src/bundle/Resources/views/themes/admin/account/login/index.html.twig
@@ -3,16 +3,23 @@
 {% set is_sso = false %}
 
 {%- block content -%}
+    {% set blank_fields = error is not null and error.blankFields is defined ? error.blankFields : [] %}
+    {% set has_username_error = 'username' in blank_fields %}
+    {% set has_password_error = 'password' in blank_fields %}
+    {% set show_error_alert = error is not null and blank_fields is empty %}
+    {% set username_label = 'authentication.login'|trans|desc('Login') %}
+    {% set password_label = 'authentication.password'|trans|desc('Password') %}
+
     {# TODO: change to <twig:ibexa:label when ready #}
     <div class="ibexa-login__actions-headline">{{ 'base.sign_in'|trans|desc('Sign in to Cohesivo') }}</div>
 
     {% block login_form %}
         {{ ibexa_twig_component_group('admin-ui-login-form-before') }}
 
-        <form action="{{ path( 'login_check' ) }}" method="post" role="form">
+        <form action="{{ path( 'login_check' ) }}" method="post" role="form" novalidate>
             <fieldset>
                 {% block login_form_errors %}
-                    {% if error %}
+                    {% if show_error_alert %}
                         <div class="ibexa-login__errors-container">
                             {% include '@ibexadesign/ui/component/alert/alert.html.twig' with {
                                 type: 'error',
@@ -23,9 +30,9 @@
                 {% endblock %}
 
                 {% block login_form_fields %}
-                    <div class="form-group{% if error %} has-error{% endif %}">
+                    <div class="form-group{% if has_username_error or show_error_alert %} has-error{% endif %}">
                         <div class="ibexa-login__input-label-wrapper">
-                            <twig:ibexa:label for="username">{{ 'authentication.login'|trans|desc('Login') }}</twig:ibexa:label>
+                            <twig:ibexa:label for="username" :error="has_username_error">{{ username_label }}</twig:ibexa:label>
                         </div>
                         {%- include '@ibexadesign/ui/component/input_text_ds.html.twig' with {
                             type: 'text',
@@ -35,15 +42,26 @@
                                 name: '_username',
                                 value: last_username,
                                 required: true,
+                                error: has_username_error,
                                 autofocus: true,
                                 autocomplete: 'on',
                                 placeholder: ' '
                             }
                         } only -%}
+                        {% if has_username_error %}
+                            <div class="ibexa-form-error">
+                                <em class="ibexa-form-error__row">
+                                    <svg class="ibexa-icon ibexa-icon--small-medium ibexa-form-error__icon">
+                                        <use xlink:href="{{ ibexa_icon_path('notice') }}"></use>
+                                    </svg>
+                                    {{ 'error.required.field'|trans({ '%fieldName%': username_label }, 'forms')|desc('%fieldName% cannot be empty.') }}
+                                </em>
+                            </div>
+                        {% endif %}
                     </div>
-                    <div class="form-group{% if error %} has-error{% endif %} position-relative">
+                    <div class="form-group{% if has_password_error or show_error_alert %} has-error{% endif %} position-relative">
                         <div class="ibexa-login__input-label-wrapper">
-                            <twig:ibexa:label for="password">{{ 'authentication.password'|trans|desc('Password') }}</twig:ibexa:label>
+                            <twig:ibexa:label for="password" :error="has_password_error">{{ password_label }}</twig:ibexa:label>
                         </div>
                         {%- include '@ibexadesign/ui/component/input_text_ds.html.twig' with {
                             type: 'password',
@@ -52,9 +70,20 @@
                                 class: 'ibexa-login__input ibexa-login__input--password',
                                 name: '_password',
                                 required: true,
+                                error: has_password_error,
                                 placeholder: ' '
                             }
                         } only -%}
+                        {% if has_password_error %}
+                            <div class="ibexa-form-error">
+                                <em class="ibexa-form-error__row">
+                                    <svg class="ibexa-icon ibexa-icon--small-medium ibexa-form-error__icon">
+                                        <use xlink:href="{{ ibexa_icon_path('notice') }}"></use>
+                                    </svg>
+                                    {{ 'error.required.field'|trans({ '%fieldName%': password_label }, 'forms')|desc('%fieldName% cannot be empty.') }}
+                                </em>
+                            </div>
+                        {% endif %}
                     </div>
 
                     <input type="hidden" name="_csrf_token" value="{{ csrf_token("authenticate") }}" />

From 0aaeb860506f65c7ead6d325f4432bf8a24c7b3e Mon Sep 17 00:00:00 2001
From: tischsoic <symfiz@gmail.com>
Date: Tue, 15 Sep 2026 10:00:44 +0200
Subject: [PATCH 06/11] IBX-11973: Restored the red outline on invalid form
 fields
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fields rendered through the Symfony form theme also carry the legacy
ibexa-input class, whose border rule sits later in the stylesheet at the
same specificity as ids-input--error and therefore won the cascade — the
field kept its neutral outline while only the label and the message
turned red. The login screen was unaffected because it renders the
design-system input directly, without that class.

Also marks the label on the Set new password screen, which reported the
same inconsistency.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 src/bundle/Resources/public/scss/_inputs.scss          |  5 +++++
 .../admin/account/reset_password/index.html.twig       | 10 ++++++++--
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/src/bundle/Resources/public/scss/_inputs.scss b/src/bundle/Resources/public/scss/_inputs.scss
index 075d7442c3..e1dc20d4a9 100644
--- a/src/bundle/Resources/public/scss/_inputs.scss
+++ b/src/bundle/Resources/public/scss/_inputs.scss
@@ -1,6 +1,7 @@
 @use '@ibexa-admin-ui/src/bundle/Resources/public/scss/custom.scss' as *;
 @use '@ibexa-admin-ui/src/bundle/Resources/public/scss/functions/calculate.rem' as *;
 @use '@ibexa-admin-ui/src/bundle/Resources/public/scss/mixins/inputs' as *;
+@use '@ids-assets/scss/variables/colors' as *;
 @use 'sass:color';
 
 .form-control {
@@ -50,6 +51,10 @@
         border-color: var(--ibexa-input-disabled-border-color, #{$ibexa-color-dark-200});
     }
 
+    &.ids-input--error {
+        border-color: var(--ids-input-error-border-color, #{$color-error-80});
+    }
+
     &--text,
     &--textarea,
     &--date {
diff --git a/src/bundle/Resources/views/themes/admin/account/reset_password/index.html.twig b/src/bundle/Resources/views/themes/admin/account/reset_password/index.html.twig
index 49acba07e1..b5c5df9400 100644
--- a/src/bundle/Resources/views/themes/admin/account/reset_password/index.html.twig
+++ b/src/bundle/Resources/views/themes/admin/account/reset_password/index.html.twig
@@ -66,7 +66,10 @@
         {{ form_start(form_reset_user_password, {'attr': {'class': 'ibexa-form-validate'} }) }}
         <fieldset>
             <div class="form-group{% if policy_errors is not empty %} has-error{% endif %}">
-                {{ form_label(new_password_form.first) }}
+                {{ form_label(new_password_form.first, null, policy_errors is not empty
+                    ? { label_attr: { class: 'ids-label--error' } }
+                    : {}
+                ) }}
                 {{ form_widget(new_password_form.first, policy_errors is not empty
                     ? { attr: { class: 'is-invalid', error: true } }
                     : {}
@@ -76,7 +79,10 @@
                 {% endif %}
             </div>
             <div class="form-group{% if other_errors is not empty %} has-error{% endif %}">
-                {{ form_label(new_password_form.second) }}
+                {{ form_label(new_password_form.second, null, other_errors is not empty
+                    ? { label_attr: { class: 'ids-label--error' } }
+                    : {}
+                ) }}
                 {{ form_widget(new_password_form.second, other_errors is not empty
                     ? { attr: { class: 'is-invalid', error: true } }
                     : {}

From 41b147352242df01644938fd0a94572e8cc38ac5 Mon Sep 17 00:00:00 2001
From: tischsoic <symfiz@gmail.com>
Date: Tue, 15 Sep 2026 10:14:41 +0200
Subject: [PATCH 07/11] IBX-11973: Stopped marking every password requirement
 met on a blank submit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Submitting the Set new password form with both fields empty ticked all
requirements and showed nothing, because the resulting violation is
mapped to the root form rather than to the repeated field, so the
template saw no errors at all and treated the submission as one where
every rule had passed.

Root-level violations are now collected too, and are shown on the new
password field when nothing more specific applies — the mismatch case
still reports only "Passwords do not match." rather than also claiming
the value is blank.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .../account/reset_password/index.html.twig    | 20 +++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/src/bundle/Resources/views/themes/admin/account/reset_password/index.html.twig b/src/bundle/Resources/views/themes/admin/account/reset_password/index.html.twig
index b5c5df9400..4588621223 100644
--- a/src/bundle/Resources/views/themes/admin/account/reset_password/index.html.twig
+++ b/src/bundle/Resources/views/themes/admin/account/reset_password/index.html.twig
@@ -34,10 +34,18 @@
             {% set password_errors = password_errors|merge([error]) %}
         {% endfor %}
 
+        {% set unmapped_errors = [] %}
+        {% for error in form_reset_user_password.vars.errors %}
+            {% set unmapped_errors = unmapped_errors|merge([error]) %}
+        {% endfor %}
+
         {% set policy_errors = password_errors|filter((error) => error.cause.code|default(null) in requirement_identifiers) %}
         {% set other_errors = password_errors|filter((error) => error.cause.code|default(null) not in requirement_identifiers) %}
+        {% set new_password_errors = policy_errors is empty and other_errors is empty ? unmapped_errors : policy_errors %}
         {% set failed_requirement_identifiers = policy_errors|map((error) => error.cause.code) %}
-        {% set can_mark_requirements = form_reset_user_password.vars.submitted and other_errors is empty %}
+        {% set can_mark_requirements = form_reset_user_password.vars.submitted
+            and other_errors is empty
+            and unmapped_errors is empty %}
 
         {% if requirements is not empty %}
             <div class="ibexa-password-requirements">
@@ -65,17 +73,17 @@
 
         {{ form_start(form_reset_user_password, {'attr': {'class': 'ibexa-form-validate'} }) }}
         <fieldset>
-            <div class="form-group{% if policy_errors is not empty %} has-error{% endif %}">
-                {{ form_label(new_password_form.first, null, policy_errors is not empty
+            <div class="form-group{% if new_password_errors is not empty %} has-error{% endif %}">
+                {{ form_label(new_password_form.first, null, new_password_errors is not empty
                     ? { label_attr: { class: 'ids-label--error' } }
                     : {}
                 ) }}
-                {{ form_widget(new_password_form.first, policy_errors is not empty
+                {{ form_widget(new_password_form.first, new_password_errors is not empty
                     ? { attr: { class: 'is-invalid', error: true } }
                     : {}
                 ) }}
-                {% if policy_errors is not empty %}
-                    {{ reset_password_macros.password_field_errors(policy_errors) }}
+                {% if new_password_errors is not empty %}
+                    {{ reset_password_macros.password_field_errors(new_password_errors) }}
                 {% endif %}
             </div>
             <div class="form-group{% if other_errors is not empty %} has-error{% endif %}">

From 6f80b3bd7bb39f1e6e066dfec100194c8c0b29e8 Mon Sep 17 00:00:00 2001
From: tischsoic <symfiz@gmail.com>
Date: Tue, 15 Sep 2026 10:39:15 +0200
Subject: [PATCH 08/11] IBX-11973: Simplified reading the form-level errors

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .../themes/admin/account/reset_password/index.html.twig      | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/src/bundle/Resources/views/themes/admin/account/reset_password/index.html.twig b/src/bundle/Resources/views/themes/admin/account/reset_password/index.html.twig
index 4588621223..430491d560 100644
--- a/src/bundle/Resources/views/themes/admin/account/reset_password/index.html.twig
+++ b/src/bundle/Resources/views/themes/admin/account/reset_password/index.html.twig
@@ -34,10 +34,7 @@
             {% set password_errors = password_errors|merge([error]) %}
         {% endfor %}
 
-        {% set unmapped_errors = [] %}
-        {% for error in form_reset_user_password.vars.errors %}
-            {% set unmapped_errors = unmapped_errors|merge([error]) %}
-        {% endfor %}
+        {% set unmapped_errors = form_reset_user_password.vars.errors %}
 
         {% set policy_errors = password_errors|filter((error) => error.cause.code|default(null) in requirement_identifiers) %}
         {% set other_errors = password_errors|filter((error) => error.cause.code|default(null) not in requirement_identifiers) %}

From 2a2871f489d3fe4bab3dd5c4f2e9cf021dce700f Mon Sep 17 00:00:00 2001
From: tischsoic <symfiz@gmail.com>
Date: Wed, 16 Sep 2026 10:59:49 +0200
Subject: [PATCH 09/11] IBX-11973: Marked both password fields invalid on an
 empty submit

Submitting with nothing filled in produces a single violation against the
repeated field as a whole, so only the new password box was marked while
the confirmation next to it stayed neutral. Both are now marked, with the
message still printed once.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .../admin/account/reset_password/index.html.twig       | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/src/bundle/Resources/views/themes/admin/account/reset_password/index.html.twig b/src/bundle/Resources/views/themes/admin/account/reset_password/index.html.twig
index 430491d560..7cba9774de 100644
--- a/src/bundle/Resources/views/themes/admin/account/reset_password/index.html.twig
+++ b/src/bundle/Resources/views/themes/admin/account/reset_password/index.html.twig
@@ -38,7 +38,9 @@
 
         {% set policy_errors = password_errors|filter((error) => error.cause.code|default(null) in requirement_identifiers) %}
         {% set other_errors = password_errors|filter((error) => error.cause.code|default(null) not in requirement_identifiers) %}
-        {% set new_password_errors = policy_errors is empty and other_errors is empty ? unmapped_errors : policy_errors %}
+        {% set blank_errors = policy_errors is empty and other_errors is empty ? unmapped_errors : [] %}
+        {% set new_password_errors = blank_errors is not empty ? blank_errors : policy_errors %}
+        {% set is_confirm_password_invalid = other_errors is not empty or blank_errors is not empty %}
         {% set failed_requirement_identifiers = policy_errors|map((error) => error.cause.code) %}
         {% set can_mark_requirements = form_reset_user_password.vars.submitted
             and other_errors is empty
@@ -83,12 +85,12 @@
                     {{ reset_password_macros.password_field_errors(new_password_errors) }}
                 {% endif %}
             </div>
-            <div class="form-group{% if other_errors is not empty %} has-error{% endif %}">
-                {{ form_label(new_password_form.second, null, other_errors is not empty
+            <div class="form-group{% if is_confirm_password_invalid %} has-error{% endif %}">
+                {{ form_label(new_password_form.second, null, is_confirm_password_invalid
                     ? { label_attr: { class: 'ids-label--error' } }
                     : {}
                 ) }}
-                {{ form_widget(new_password_form.second, other_errors is not empty
+                {{ form_widget(new_password_form.second, is_confirm_password_invalid
                     ? { attr: { class: 'is-invalid', error: true } }
                     : {}
                 ) }}

From f32a639388bb42919c79662f73786f79c6c2106a Mon Sep 17 00:00:00 2001
From: tischsoic <symfiz@gmail.com>
Date: Thu, 17 Sep 2026 09:47:23 +0200
Subject: [PATCH 10/11] IBX-11973: Marked both password fields regardless of
 where the violation lands

Where Symfony attaches the empty-value violation depends on its version:
7.4.19 added a camelised fallback in ViolationMapper, which maps the
newPassword path onto the new_password child, while older releases left it
on the root form. The template read only one of those places, so the new
password field stayed unmarked on installations with the newer release.

All three locations are now collected, and any error that is not a
password-requirement failure marks both fields, so the pair is reported
consistently no matter which node Symfony chose.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .../account/reset_password/index.html.twig    | 24 +++++++++----------
 1 file changed, 11 insertions(+), 13 deletions(-)

diff --git a/src/bundle/Resources/views/themes/admin/account/reset_password/index.html.twig b/src/bundle/Resources/views/themes/admin/account/reset_password/index.html.twig
index 7cba9774de..e53d1a1304 100644
--- a/src/bundle/Resources/views/themes/admin/account/reset_password/index.html.twig
+++ b/src/bundle/Resources/views/themes/admin/account/reset_password/index.html.twig
@@ -27,6 +27,9 @@
         {% set requirement_identifiers = requirements|map((requirement) => requirement.identifier) %}
 
         {% set password_errors = [] %}
+        {% for error in form_reset_user_password.vars.errors %}
+            {% set password_errors = password_errors|merge([error]) %}
+        {% endfor %}
         {% for error in new_password_form.vars.errors %}
             {% set password_errors = password_errors|merge([error]) %}
         {% endfor %}
@@ -34,17 +37,12 @@
             {% set password_errors = password_errors|merge([error]) %}
         {% endfor %}
 
-        {% set unmapped_errors = form_reset_user_password.vars.errors %}
-
         {% set policy_errors = password_errors|filter((error) => error.cause.code|default(null) in requirement_identifiers) %}
         {% set other_errors = password_errors|filter((error) => error.cause.code|default(null) not in requirement_identifiers) %}
-        {% set blank_errors = policy_errors is empty and other_errors is empty ? unmapped_errors : [] %}
-        {% set new_password_errors = blank_errors is not empty ? blank_errors : policy_errors %}
-        {% set is_confirm_password_invalid = other_errors is not empty or blank_errors is not empty %}
+        {% set is_new_password_invalid = policy_errors is not empty or other_errors is not empty %}
+        {% set is_confirm_password_invalid = other_errors is not empty %}
         {% set failed_requirement_identifiers = policy_errors|map((error) => error.cause.code) %}
-        {% set can_mark_requirements = form_reset_user_password.vars.submitted
-            and other_errors is empty
-            and unmapped_errors is empty %}
+        {% set can_mark_requirements = form_reset_user_password.vars.submitted and other_errors is empty %}
 
         {% if requirements is not empty %}
             <div class="ibexa-password-requirements">
@@ -72,17 +70,17 @@
 
         {{ form_start(form_reset_user_password, {'attr': {'class': 'ibexa-form-validate'} }) }}
         <fieldset>
-            <div class="form-group{% if new_password_errors is not empty %} has-error{% endif %}">
-                {{ form_label(new_password_form.first, null, new_password_errors is not empty
+            <div class="form-group{% if is_new_password_invalid %} has-error{% endif %}">
+                {{ form_label(new_password_form.first, null, is_new_password_invalid
                     ? { label_attr: { class: 'ids-label--error' } }
                     : {}
                 ) }}
-                {{ form_widget(new_password_form.first, new_password_errors is not empty
+                {{ form_widget(new_password_form.first, is_new_password_invalid
                     ? { attr: { class: 'is-invalid', error: true } }
                     : {}
                 ) }}
-                {% if new_password_errors is not empty %}
-                    {{ reset_password_macros.password_field_errors(new_password_errors) }}
+                {% if policy_errors is not empty %}
+                    {{ reset_password_macros.password_field_errors(policy_errors) }}
                 {% endif %}
             </div>
             <div class="form-group{% if is_confirm_password_invalid %} has-error{% endif %}">

From 73531fdca990a86a1e1c9137830b29cdf6c424c1 Mon Sep 17 00:00:00 2001
From: tischsoic <symfiz@gmail.com>
Date: Sat, 19 Sep 2026 13:08:49 +0200
Subject: [PATCH 11/11] IBX-11973: Read the password errors from the fields
 that own them

Each of the two password inputs now carries its own violations, so the
template no longer has to gather them from the root form, the repeated
field and its first child and then work out which input each one belonged
to. Every field renders what is attached to it.

Requires the matching change in ibexa/user, which adds the blank
constraint to the confirmation field.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .../account/reset_password/index.html.twig    | 41 +++++++------------
 1 file changed, 15 insertions(+), 26 deletions(-)

diff --git a/src/bundle/Resources/views/themes/admin/account/reset_password/index.html.twig b/src/bundle/Resources/views/themes/admin/account/reset_password/index.html.twig
index e53d1a1304..4f318e5f79 100644
--- a/src/bundle/Resources/views/themes/admin/account/reset_password/index.html.twig
+++ b/src/bundle/Resources/views/themes/admin/account/reset_password/index.html.twig
@@ -26,23 +26,12 @@
         {% set requirements = content_type is defined ? ibexa_password_requirements(content_type) : [] %}
         {% set requirement_identifiers = requirements|map((requirement) => requirement.identifier) %}
 
-        {% set password_errors = [] %}
-        {% for error in form_reset_user_password.vars.errors %}
-            {% set password_errors = password_errors|merge([error]) %}
-        {% endfor %}
-        {% for error in new_password_form.vars.errors %}
-            {% set password_errors = password_errors|merge([error]) %}
-        {% endfor %}
-        {% for error in new_password_form.first.vars.errors %}
-            {% set password_errors = password_errors|merge([error]) %}
-        {% endfor %}
-
-        {% set policy_errors = password_errors|filter((error) => error.cause.code|default(null) in requirement_identifiers) %}
-        {% set other_errors = password_errors|filter((error) => error.cause.code|default(null) not in requirement_identifiers) %}
-        {% set is_new_password_invalid = policy_errors is not empty or other_errors is not empty %}
-        {% set is_confirm_password_invalid = other_errors is not empty %}
+        {% set new_password_errors = new_password_form.first.vars.errors %}
+        {% set confirm_password_errors = new_password_form.second.vars.errors %}
+        {% set policy_errors = new_password_errors|filter((error) => error.cause.code|default(null) in requirement_identifiers) %}
         {% set failed_requirement_identifiers = policy_errors|map((error) => error.cause.code) %}
-        {% set can_mark_requirements = form_reset_user_password.vars.submitted and other_errors is empty %}
+        {% set can_mark_requirements = form_reset_user_password.vars.submitted
+            and new_password_errors|length == policy_errors|length %}
 
         {% if requirements is not empty %}
             <div class="ibexa-password-requirements">
@@ -70,30 +59,30 @@
 
         {{ form_start(form_reset_user_password, {'attr': {'class': 'ibexa-form-validate'} }) }}
         <fieldset>
-            <div class="form-group{% if is_new_password_invalid %} has-error{% endif %}">
-                {{ form_label(new_password_form.first, null, is_new_password_invalid
+            <div class="form-group{% if new_password_errors is not empty %} has-error{% endif %}">
+                {{ form_label(new_password_form.first, null, new_password_errors is not empty
                     ? { label_attr: { class: 'ids-label--error' } }
                     : {}
                 ) }}
-                {{ form_widget(new_password_form.first, is_new_password_invalid
+                {{ form_widget(new_password_form.first, new_password_errors is not empty
                     ? { attr: { class: 'is-invalid', error: true } }
                     : {}
                 ) }}
-                {% if policy_errors is not empty %}
-                    {{ reset_password_macros.password_field_errors(policy_errors) }}
+                {% if new_password_errors is not empty %}
+                    {{ reset_password_macros.password_field_errors(new_password_errors) }}
                 {% endif %}
             </div>
-            <div class="form-group{% if is_confirm_password_invalid %} has-error{% endif %}">
-                {{ form_label(new_password_form.second, null, is_confirm_password_invalid
+            <div class="form-group{% if confirm_password_errors is not empty %} has-error{% endif %}">
+                {{ form_label(new_password_form.second, null, confirm_password_errors is not empty
                     ? { label_attr: { class: 'ids-label--error' } }
                     : {}
                 ) }}
-                {{ form_widget(new_password_form.second, is_confirm_password_invalid
+                {{ form_widget(new_password_form.second, confirm_password_errors is not empty
                     ? { attr: { class: 'is-invalid', error: true } }
                     : {}
                 ) }}
-                {% if other_errors is not empty %}
-                    {{ reset_password_macros.password_field_errors(other_errors) }}
+                {% if confirm_password_errors is not empty %}
+                    {{ reset_password_macros.password_field_errors(confirm_password_errors) }}
                 {% endif %}
             </div>
         </fieldset>