migrate to sveltekit action

[longrunningprocess]

Description

This PR migrates the change password functionality toward a newer SvelteKit feature called Actions.

Checklist

• I have labeled my PR with: bug, feature, engineering, security fix or testing
• I have performed a self-review of my own code
• I have reviewed the title & description of this PR which I will use as the squashed PR commit message
• I have enabled auto-merge (optional)

QA testing

Testers, use the following instructions on our staging environment. Post your findings as a comment and include any meaningful screenshots, etc.

• ensure passwords are required
• ensure the passwords match
• ensure password is actually updated to a new password

[github-actions]

Unit Test Results

362 tests   362 ✔️  17s ⏱️
  37 suites      0 💤
    1 files        0 ❌

Results for commit 92bf264.

♻️ This comment has been updated with latest results.

[myieye]

Just a few nits mostly 😉

I'm looking at the PHP...is there actually no password validation when changing your pasword 😲? In the long run I assume this validation will land in the new API, but this is maybe the best place for it now.

[longrunningprocess]

Just a few nits mostly 😉

I'm looking at the PHP...is there actually no password validation when changing your pasword 😲? In the long run I assume this validation will land in the new API, but this is maybe the best place for it now.

it depends where you look 😆 , but yes, we should have something like this in place: https://svelte.dev/repl/2d597987426345d697c5c6729dc2cacc?version=3.55.1

[megahirt]

I'm looking at the PHP...is there actually no password validation when changing your password 😲?

I would suggest that password validation (making sure the user typed it the same twice) should be done client-side and doesn't belong in the API layer. I can see making a case for password strength being enforced at the API layer, but we don't currently do that in PHP.

[myieye]

I'm looking at the PHP...is there actually no password validation when changing your password 😲?

I would suggest that password validation (making sure the user typed it the same twice) should be done client-side and doesn't belong in the API layer. I can see making a case for password strength being enforced at the API layer, but we don't currently do that in PHP.

Oh, of course you're right 🙈. We only pass 1 password to the server. Not sure what I was thinking there.

[longrunningprocess]

I'm looking at the PHP...is there actually no password validation when changing your password 😲?

I would suggest that password validation (making sure the user typed it the same twice) should be done client-side and doesn't belong in the API layer. I can see making a case for password strength being enforced at the API layer, but we don't currently do that in PHP.

yep, excellent point, I'll change that.

[myieye]

🧪 See my test results on #1719.

[laineyhm]

🧪 See my test results on #1719.

Ditto