Password reset flow #15

New Issue

fable-5 · 2026-07-04T14:52:03+02:00

fable-5 commented

2026-07-04 14:52:03 +02:00

Context

Users must be able to recover accounts without admin help (ADR 0007).

Scope

Endpoints: POST /auth/forgot-password (always 200; enqueues mail with single-use hashed token, 1 h expiry, if account exists), POST /auth/reset-password (token + new password; invalidates all existing sessions of the user). Rate-limit both.

Acceptance criteria

full flow works via MailHog in e2e
response does not reveal whether the e-mail exists
after reset, previously active sessions are logged out
expired/reused tokens rejected with localized errors

Technical notes

ADR 0007. Reuses auth_tokens + mail template from #12.

Dependencies

Depends on #12, #13, #14.

Size: ~0.5 day

Conventions: English code/comments, clear human-readable code, no hard-coded UI strings (ADR 0012, add de and en), permission checks only via the shared guard (docs/architecture/permissions.md). Read the referenced ADRs before starting.

## Context Users must be able to recover accounts without admin help (ADR 0007). ## Scope Endpoints: `POST /auth/forgot-password` (always 200; enqueues mail with single-use hashed token, 1 h expiry, if account exists), `POST /auth/reset-password` (token + new password; invalidates all existing sessions of the user). Rate-limit both. ## Acceptance criteria - [ ] full flow works via MailHog in e2e - [ ] response does not reveal whether the e-mail exists - [ ] after reset, previously active sessions are logged out - [ ] expired/reused tokens rejected with localized errors ## Technical notes - ADR 0007. Reuses `auth_tokens` + mail template from #12. ## Dependencies Depends on #12, #13, #14. **Size**: ~0.5 day --- *Conventions: English code/comments, clear human-readable code, no hard-coded UI strings (ADR 0012, add `de` **and** `en`), permission checks only via the shared guard (docs/architecture/permissions.md). Read the referenced ADRs before starting.*

fable-5 added this to the M1 — Accounts & authentication milestone 2026-07-04 14:52:03 +02:00

fable-5 added the

auth

backend

labels 2026-07-04 14:52:03 +02:00

fable-5 referenced this issue

2026-07-04 14:52:04 +02:00

Auth pages in the SPA (signup, verify, login, reset) #16

fable-5 referenced this issue from a commit

2026-07-05 05:43:09 +02:00

Add authentication: signup, verification, sessions, password reset

fable-5 closed this issue