bvandeusenandClaude Opus 5.5
593b583d23
Step #5429 "Reset by email: request, link and new-password page" of milestone 497 "Passwords: change your own, and reset it by email". - Sign-in page: "Forgot your password?" while a mail server is set. - /forgot takes a username or email and answers the same either way; only an active local account with a real address gets mail. Requests count per address on their own throttle, so they never lock out sign-in. - password_resets (migration 0039): a one-time key, stored as its sha256, working for an hour; asking again replaces it. - /reset/<key>: the new password, then signed straight in; every other browser is signed out (sessions_since). Bad keys count as invite keys do. - Email "[Steward] Reset your password", in the account's own zone. - Audited: user.password_reset_requested, user.password_reset_by_email. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
33 lines
1.6 KiB
HTML
33 lines
1.6 KiB
HTML
{# auth/reset.html — choose a new password from an emailed link (milestone 497).
|
|
`username` is set while the link works; otherwise only `error` shows. #}
|
|
{% extends "base.html" %}
|
|
{% block title %}Choose a new password — Steward{% endblock %}
|
|
{% block content %}
|
|
<div class="invite-page">
|
|
<div class="card">
|
|
<h1 class="invite-title">Choose a new password</h1>
|
|
{% if username %}
|
|
<p class="invite-lede">For <strong>{{ username }}</strong>. Once it's set you're signed in here, and signed out anywhere else.</p>
|
|
{% endif %}
|
|
{% if error %}<div class="alert alert-error" role="alert">{{ error }}</div>{% endif %}
|
|
{% if username %}
|
|
<form method="post" action="/reset/{{ key }}">{{ csrf_field() }}
|
|
<input type="text" name="username" value="{{ username }}" autocomplete="username" hidden>
|
|
<div class="field">
|
|
<label class="field-label" for="reset-pw">New password</label>
|
|
<input class="input" id="reset-pw" type="password" name="password" minlength="{{ min_password }}" required autofocus autocomplete="new-password">
|
|
<span class="field-hint">At least {{ min_password }} characters.</span>
|
|
</div>
|
|
<div class="field">
|
|
<label class="field-label" for="reset-pw2">New password again</label>
|
|
<input class="input" id="reset-pw2" type="password" name="confirm" required autocomplete="new-password">
|
|
</div>
|
|
<button type="submit" class="btn invite-submit">Set password and sign in</button>
|
|
</form>
|
|
{% else %}
|
|
<a href="/forgot" class="btn btn-ghost">Ask for a new link</a>
|
|
{% endif %}
|
|
</div>
|
|
</div>
|
|
{% endblock %}
|