3 Commits

Include renames

Author	SHA1	Message	Date
bvandeusenandClaude Opus 5.5	9a3e7ddba2	feat(email): the report, invites, resets and test sends go through the outbox; only it talks SMTP (#5508) ... #5508 "Every other email through the outbox: weekly report, invites, password resets, and the test buttons" (milestone 501). - outbox.send_each queues one email per reader (claimed, so the sender doesn't take it too) and tries them at once, for a page that answers with what happened; outbox.said words the result. attempt takes a cfg for a test of the form's unsaved settings and returns the settled rows. - Weekly report (scheduled and Send now) and invites: queued, tried at once; one the server couldn't take yet is retried for an hour. An invite that didn't go shows its link with the reason, as before. - Password reset: queued in the reset link's own transaction; the sender delivers it on its next tick. - Settings -> Notifications test email and a rule's Send test: queued and recorded with retry=False, tried once (System 156 ruling). - Removed mail.send, notifications._send_email and _smtp_send_sync; dispatch_notifications is webhook only. A guard asserts only the outbox (and smtp_open itself) opens an SMTP connection, with a self-test. Also fixes run 8941 (#5507's integration test): its Also-send-to addresses were "@test", which is_real_address rightly drops; they are example.com now. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-09 16:05:01 -04:00
bvandeusenandClaude Opus 5.5	593b583d23	feat(auth): reset a forgotten password from an emailed link (milestone 497) ... Step #5429 "Reset by email: request, link and new-password page" of milestone 497 "Passwords: change your own, and reset it by email". - Sign-in page: "Forgot your password?" while a mail server is set. - /forgot takes a username or email and answers the same either way; only an active local account with a real address gets mail. Requests count per address on their own throttle, so they never lock out sign-in. - password_resets (migration 0039): a one-time key, stored as its sha256, working for an hour; asking again replaces it. - /reset/<key>: the new password, then signed straight in; every other browser is signed out (sessions_since). Bad keys count as invite keys do. - Email "[Steward] Reset your password", in the account's own zone. - Audited: user.password_reset_requested, user.password_reset_by_email. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 20:17:24 -04:00
bvandeusenandClaude Opus 5.5	ea523b8c37	feat(account): change your own password on the Account page (milestone 497) ... Step #5428 "Account page: change your own password" of milestone 497 "Passwords: change your own, and reset it by email". A Password section in the page's one form, for local accounts: current, new, again. Blank keeps the password; a new one signs out every other browser (sessions_since) and keeps this one. A wrong current password counts toward the login throttle. Audited as account.password_changed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 20:14:45 -04:00