What is the expected UX for setting/changing initial password?

meonkeys

The issue

When I add a new user and check both "Require user to confirm this email" and "Generate random password" toggle buttons, they get an email with subject "Activate Your New Account" that says "simply click the following link and your account will be activated", which logs them in immediately.

How are they then expected to learn and/or change their password? It seems like Settings -> Account -> Change Password -> Send Password Reset Email is the expected UX, I am just confirming.

Flarum information

Flarum core: 1.8.5
PHP version: 8.3.6
MySQL version: 5.7.23-23
Loaded extensions: Core, date, libxml, openssl, pcre, zlib, filter, hash, json, pcntl, random, readline, Reflection, SPL, session, standard, bcmath, bz2, calendar, ctype, curl, dom, mbstring, fileinfo, ftp, gd, gettext, gmp, iconv, imap, intl, exif, mysqlnd, odbc, PDO, pgsql, Phar, posix, pspell, SimpleXML, soap, sockets, sodium, sqlite3, tidy, tokenizer, xml, xmlwriter, xsl, zip, mysqli, pdo_mysql, PDO_ODBC, pdo_pgsql, pdo_sqlite, xmlreader, apcu, imagick, Zend OPcache
+--------------------------+---------+--------+
| Flarum Extensions        |         |        |
+--------------------------+---------+--------+
| ID                       | Version | Commit |
+--------------------------+---------+--------+
| flarum-flags             | v1.8.0  |        |
| flarum-approval          | v1.8.1  |        |
| flarum-tags              | v1.8.0  |        |
| startracex-dark          | 0.0.1   |        |
| flarum-suspend           | v1.8.1  |        |
| flarum-subscriptions     | v1.8.0  |        |
| flarum-sticky            | v1.8.0  |        |
| flarum-statistics        | v1.8.0  |        |
| flarum-nicknames         | v1.8.0  |        |
| flarum-mentions          | v1.8.3  |        |
| flarum-markdown          | v1.8.0  |        |
| flarum-lock              | v1.8.0  |        |
| flarum-likes             | v1.8.0  |        |
| flarum-lang-english      | v1.8.0  |        |
| flarum-extension-manager | v1.0.3  |        |
| flarum-emoji             | v1.8.0  |        |
+--------------------------+---------+--------+
Base URL: https://redacted.example.com
Installation path: /home/user/redacted
Queue driver: sync
Session driver: file
Mail driver: mail
Debug mode: off

clarkwinkelmann

I didn't even know we had these options in the new user modal, but looking at the code there's no mechanism to share the password with the user. It must be intended to share the password to the user via other means, or ask them to reset it using the password forgot/reset button.

Checking "Generate random password" generates a 32-character password client-side using the crypto API. The password is then sent to the backend and immediately hashed. It's never shown in the UI, so it must have been added just as a convenient way to set a random strong password, because you are not allowed to create a user without giving it a password.