4 Commits

Include renames

Author	SHA1	Message	Date
bvandeusenandClaude Opus 5.5	1ea86c0330	test: a reader's zone comes from their account; a London expiry reads BST or GMT (#6350) ... The change-form test set the zone on the session, which the auth middleware resets from the account on every request. The password reset test asserted BST, which stopped being London's zone name on 25 Oct. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-24 21:39:14 -04:00
bvandeusenandClaude Opus 5.5	9a3e7ddba2	feat(email): the report, invites, resets and test sends go through the outbox; only it talks SMTP (#5508) ... #5508 "Every other email through the outbox: weekly report, invites, password resets, and the test buttons" (milestone 501). - outbox.send_each queues one email per reader (claimed, so the sender doesn't take it too) and tries them at once, for a page that answers with what happened; outbox.said words the result. attempt takes a cfg for a test of the form's unsaved settings and returns the settled rows. - Weekly report (scheduled and Send now) and invites: queued, tried at once; one the server couldn't take yet is retried for an hour. An invite that didn't go shows its link with the reason, as before. - Password reset: queued in the reset link's own transaction; the sender delivers it on its next tick. - Settings -> Notifications test email and a rule's Send test: queued and recorded with retry=False, tried once (System 156 ruling). - Removed mail.send, notifications._send_email and _smtp_send_sync; dispatch_notifications is webhook only. A guard asserts only the outbox (and smtp_open itself) opens an SMTP connection, with a self-test. Also fixes run 8941 (#5507's integration test): its Also-send-to addresses were "@test", which is_real_address rightly drops; they are example.com now. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-09 16:05:01 -04:00
bvandeusenandClaude Opus 5.5	593b583d23	feat(auth): reset a forgotten password from an emailed link (milestone 497) ... Step #5429 "Reset by email: request, link and new-password page" of milestone 497 "Passwords: change your own, and reset it by email". - Sign-in page: "Forgot your password?" while a mail server is set. - /forgot takes a username or email and answers the same either way; only an active local account with a real address gets mail. Requests count per address on their own throttle, so they never lock out sign-in. - password_resets (migration 0039): a one-time key, stored as its sha256, working for an hour; asking again replaces it. - /reset/<key>: the new password, then signed straight in; every other browser is signed out (sessions_since). Bad keys count as invite keys do. - Email "[Steward] Reset your password", in the account's own zone. - Audited: user.password_reset_requested, user.password_reset_by_email. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 20:17:24 -04:00
bvandeusenandClaude Opus 5.5	ea523b8c37	feat(account): change your own password on the Account page (milestone 497) ... Step #5428 "Account page: change your own password" of milestone 497 "Passwords: change your own, and reset it by email". A Password section in the page's one form, for local accounts: current, new, again. Blank keeps the password; a new one signs out every other browser (sessions_since) and keeps this one. A wrong current password counts toward the login throttle. Audited as account.password_changed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 20:14:45 -04:00