bvandeusenandClaude Opus 5.5 593b583d23 feat(auth): reset a forgotten password from an emailed link (milestone 497) ...

Step #5429 "Reset by email: request, link and new-password page" of
milestone 497 "Passwords: change your own, and reset it by email".

- Sign-in page: "Forgot your password?" while a mail server is set.
- /forgot takes a username or email and answers the same either way; only
  an active local account with a real address gets mail. Requests count
  per address on their own throttle, so they never lock out sign-in.
- password_resets (migration 0039): a one-time key, stored as its sha256,
  working for an hour; asking again replaces it.
- /reset/<key>: the new password, then signed straight in; every other
  browser is signed out (sessions_since). Bad keys count as invite keys do.
- Email "[Steward] Reset your password", in the account's own zone.
- Audited: user.password_reset_requested, user.password_reset_by_email.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-08 20:17:24 -04:00

..

__init__.py

chore: rename project Roundtable → Steward

2026-04-25 16:20:14 -04:00

alerts.py

feat(email): each account gets its own email, in its own zone (milestone 495)

2026-10-08 15:16:17 -04:00

api_tokens.py

feat(api): personal API tokens and the AI access page

2026-10-06 07:15:23 -04:00

audit.py

feat(ansible): runs stay inside their source; controller-side vars are admin-only (#5034)

2026-10-06 10:57:34 -04:00

capabilities.py

feat(plugins): plugin capability registry + host_agent→Ansible deploy synergy

2026-06-16 11:28:29 -04:00

cleanup.py

feat(retention): every growing table is pruned; the audit log has its own window; charts read the raw window from Settings (#5155)

2026-10-06 21:05:22 -04:00

crypto.py

feat(crypto): name the failing setting in wrong-key decrypt log

2026-06-17 08:05:47 -04:00

formatting.py

feat(email): each account gets its own email, in its own zone (milestone 495)

2026-10-08 15:16:17 -04:00

ids.py

fix(metrics): time-series rows get time-ordered ids, so an insert stops costing a disk read (#5149)

2026-10-06 18:58:41 -04:00

invites.py

feat(users): invite by email — a one-time link where the invitee makes their own account (milestone 496)

2026-10-08 16:54:44 -04:00

logging_setup.py

feat(platform): tini as PID 1, Hypercorn, a log-level setting, the image on CI's Python, an airgapped boot gate before push (#5159)

2026-10-06 21:29:21 -04:00

mail.py

feat(auth): reset a forgotten password from an emailed link (milestone 497)

2026-10-08 20:17:24 -04:00

metric_series.py

fix(metrics): seed the latest table in the background, not in the migration (#5208)

2026-10-06 23:19:38 -04:00

metrics_retention.py

perf(metrics): a latest-value table for "what is it now"; dashboard cells say loading, failed and as-of (#5208)

2026-10-06 23:06:34 -04:00

migration_runner.py

feat(plugins): fold first-party plugins in-tree; bundled + external roots

2026-06-01 08:37:24 -04:00

migrations.py

chore: rename project Roundtable → Steward

2026-04-25 16:20:14 -04:00

notifications.py

feat(email): each account gets its own email, in its own zone (milestone 495)

2026-10-08 15:16:17 -04:00

paging.py

feat(ui): audit log, alert history and Ansible runs load as you scroll (#5211)

2026-10-07 00:10:53 -04:00

password_resets.py

feat(auth): reset a forgotten password from an emailed link (milestone 497)

2026-10-08 20:17:24 -04:00

plugin_manager.py

refactor(plugins): no plugin catalog; plugins ship in the image or are mounted (#5374)

2026-10-08 13:15:55 -04:00

proxy.py

feat(auth): sessions end when they should; logins are throttled; Secure behind HTTPS (#5035)

2026-10-06 11:02:27 -04:00

renames.py

perf(metrics): a latest-value table for "what is it now"; dashboard cells say loading, failed and as-of (#5208)

2026-10-06 23:06:34 -04:00

reports.py

feat(email): each account gets its own email, in its own zone (milestone 495)

2026-10-08 15:16:17 -04:00

scheduler.py

feat(reliability): fd-leak rails — self-watchdog, poll-overlap guard, fd tests

2026-06-24 10:36:53 -04:00

self_monitor.py

feat(alerts): one evaluation path; host-agent ingest fires rules (#5060)

2026-10-06 12:53:40 -04:00

settings.py

feat(email): each account gets its own email, in its own zone (milestone 495)

2026-10-08 15:16:17 -04:00

status.py

feat(docker): the service and container pages say each fact once (#5310)

2026-10-07 21:33:25 -04:00

time_range.py

fix(unifi): the Overview's history buckets on Postgres; devices name their state (#5207)

2026-10-08 17:28:19 -04:00

widgets.py

feat(monitors): Monitors absorbs the Status page; Status is removed (#5270)

2026-10-07 15:36:38 -04:00