Add Reset Password button to Edit User view

providers/fab/src/airflow/providers/fab/auth_manager/views/user.py

@@ -204,3 +204,23 @@ class CustomUserDBModelView(MultiResourceUserMixin, UserDBModelView):
         permissions.ACTION_CAN_EDIT,
         permissions.ACTION_CAN_DELETE,
     ]
+
+    edit_template = "appbuilder/general/model/user_edit.html"
+
+    @expose("/edit/<pk>", methods=["GET", "POST"])
+    @has_access
+    def edit(self, pk):
+        pk = self._deserialize_pk_if_composite(pk)
+        widgets = self._edit(pk)
+        if not widgets:
+            return self.post_edit_redirect()
+        return self.render_template(
+            self.edit_template,
+            title=self.edit_title,
+            widgets=widgets,
+            related_views=self._related_views,
+            # Surface the same "Reset Password" action already available on the Show User view.
+            actions={"resetpasswords": self.actions.get("resetpasswords")},
+            pk=pk,
+            modelview_name=self.__class__.__name__,
+        )

providers/fab/src/airflow/providers/fab/www/templates/appbuilder/general/model/user_edit.html

@@ -0,0 +1,29 @@
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements.  See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership.  The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License.  You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied.  See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+{% extends "appbuilder/general/model/edit.html" %}
+{% import 'appbuilder/general/lib.html' as lib %}
+
+{% block edit_form %}
+  {{ super() }}
+  {% if actions %}
+  <div class="well well-sm">
+      {{ lib.render_action_links(actions, pk, modelview_name) }}
+  </div>
+  {% endif %}
+{% endblock %}

providers/fab/tests/unit/fab/www/views/test_views_custom_user_views.py

@@ -34,7 +34,7 @@
     delete_role,
     delete_user,
 )
-from unit.fab.utils import check_content_in_response, client_with_login
+from unit.fab.utils import check_content_in_response, check_content_not_in_response, client_with_login
 
 pytestmark = pytest.mark.db_test
 
@@ -141,6 +141,78 @@ def test_user_model_view_with_access(self, url, permission, expected_text, app,
         response = client.get(url.replace("{user.id}", str(user_with_access.id)), follow_redirects=True)
         check_content_in_response(expected_text, response)
 
+    def test_user_edit_view_shows_reset_password_action_with_access(self, app, client):
+        # Visibility of the action link is gated on "read" access to Users (the same
+        # rule the Show User view relies on); "read" on Passwords is what's required to
+        # actually perform the reset once the link is followed.
+        user_with_access = create_user(
+            app,
+            username="has_access",
+            role_name="role_has_access",
+            permissions=[
+                (permissions.ACTION_CAN_READ, permissions.RESOURCE_WEBSITE),
+                (permissions.ACTION_CAN_READ, permissions.RESOURCE_USER),
+                (permissions.ACTION_CAN_EDIT, permissions.RESOURCE_USER),
+                (permissions.ACTION_CAN_READ, permissions.RESOURCE_PASSWORD),
+            ],
+        )
+        client = client_with_login(
+            app,
+            username="has_access",
+            password="has_access",
+        )
+        response = client.get(f"/users/edit/{user_with_access.id}", follow_redirects=True)
+        check_content_in_response("Reset Password", response)
+
+        response = client.post(f"/users/action/resetpasswords/{user_with_access.id}", follow_redirects=False)
+        assert response.status_code == 302
+        assert "/resetpassword/form" in response.location
+
+    def test_user_edit_view_hides_reset_password_action_without_access(self, app, client):
+        # No "read" access to Users means the action link is not visible, even though
+        # the user can still reach the edit page via "edit" access to Users.
+        user_with_access = create_user(
+            app,
+            username="has_access",
+            role_name="role_has_access",
+            permissions=[
+                (permissions.ACTION_CAN_READ, permissions.RESOURCE_WEBSITE),
+                (permissions.ACTION_CAN_EDIT, permissions.RESOURCE_USER),
+            ],
+        )
+        client = client_with_login(
+            app,
+            username="has_access",
+            password="has_access",
+        )
+        response = client.get(f"/users/edit/{user_with_access.id}", follow_redirects=True)
+        check_content_not_in_response("Reset Password", response)
+
+    def test_user_edit_view_shows_reset_password_action_without_passwords_read_access(self, app, client):
+        # The link's visibility follows "read" on Users, not "read" on Passwords, so a user
+        # without the latter still sees the link, while following it is refused.
+        user_with_access = create_user(
+            app,
+            username="has_access",
+            role_name="role_has_access",
+            permissions=[
+                (permissions.ACTION_CAN_READ, permissions.RESOURCE_WEBSITE),
+                (permissions.ACTION_CAN_READ, permissions.RESOURCE_USER),
+                (permissions.ACTION_CAN_EDIT, permissions.RESOURCE_USER),
+            ],
+        )
+        client = client_with_login(
+            app,
+            username="has_access",
+            password="has_access",
+        )
+        response = client.get(f"/users/edit/{user_with_access.id}", follow_redirects=True)
+        check_content_in_response("Reset Password", response)
+
+        response = client.post(f"/users/action/resetpasswords/{user_with_access.id}", follow_redirects=False)
+        assert response.status_code == 302
+        assert "resetpassword" not in response.location
+
     def test_user_model_view_without_delete_access(self, app, client):
         user_to_delete = create_user(
             app,