bvandeusenandClaude Opus 5.5
593b583d23
Step #5429 "Reset by email: request, link and new-password page" of milestone 497 "Passwords: change your own, and reset it by email". - Sign-in page: "Forgot your password?" while a mail server is set. - /forgot takes a username or email and answers the same either way; only an active local account with a real address gets mail. Requests count per address on their own throttle, so they never lock out sign-in. - password_resets (migration 0039): a one-time key, stored as its sha256, working for an hour; asking again replaces it. - /reset/<key>: the new password, then signed straight in; every other browser is signed out (sessions_since). Bad keys count as invite keys do. - Email "[Steward] Reset your password", in the account's own zone. - Audited: user.password_reset_requested, user.password_reset_by_email. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
20 lines
1.2 KiB
HTML
20 lines
1.2 KiB
HTML
{# A password-reset email's HTML part (milestone 497): r = the facts mail.reset_email builds. #}
|
|
{% extends "_layout.html" %}
|
|
{% from "_parts.html" import button, fact with context %}
|
|
{% block title %}Reset your Steward password{% endblock %}
|
|
{% block body %}
|
|
<tr><td style="padding:10px 24px 4px 24px;font:600 20px/1.35 {{ c.font }};color:{{ c.text }};">Reset your Steward password</td></tr>
|
|
<tr><td style="padding:6px 24px 4px 24px;font:14px/1.55 {{ c.font }};color:{{ c.text }};">Someone asked to reset the password for {{ r.username }}. Open the link to choose a new one. Anywhere you're signed in now, you'll be signed out.</td></tr>
|
|
<tr><td style="padding:10px 24px 4px 24px;">
|
|
<table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0">
|
|
{{ fact("Account", r.username) }}
|
|
{{ fact("Link works until", r.expires) }}
|
|
</table>
|
|
</td></tr>
|
|
<tr><td style="padding:16px 24px 8px 24px;">{{ button(r.link, "Choose a new password") }}</td></tr>
|
|
<tr><td style="padding:4px 24px 20px 24px;font:12px/1.5 {{ c.font }};color:{{ c.muted }};word-break:break-all;">Or paste this into your browser: {{ r.link }}</td></tr>
|
|
{% endblock %}
|
|
{% block footer %}
|
|
The link works once. If you didn't ask for this, ignore it: your password is unchanged.
|
|
{% endblock %}
|