Challenge 2 / 2

We tucked the currentPassword field behind an option that defaults to off:

if ($options['require_current']) {
    $builder->add('currentPassword', PasswordType::class, [
        // ...
    ]);
}

Why not simply always add the field?

Always adding it would break RepeatedType, which needs to be the only field in the form.

The reset-password flow renders this very same form type - and someone resetting a forgotten password has no idea what their current one is.

PasswordType fields can't be added unconditionally when the form isn't bound to an object.

The UserPassword constraint only works on the first field of a form, so the field has to be added conditionally.